Cornerstone March 2024 Issue #50

Homeland Security Investigations Cornerstone

March 2024 ISSUE #50

200 Plus HSI Special Agents

Designated HSI Cornerstone representatives across all HSI field offices.


Did You Know?

 

The HSI NLDC has been instrumental in coordinating HSI investigations involving victims of fraud.  To report criminal activity related to cryptocurrency related frauds, please contact the NLDC at HSILeads2@hsi.dhs.gov. 


Binoculars1

BE ON THE LOOKOUT FOR ISSUE #51

April 2024

Money Laundering Typologies 


CASE SPOTLIGHT

HSI's New York City Dark Web and Cryptocurrency Task Force recently worked multiple investigations involving NFTs:

  • Victim paid developer for NFT, developer kept private keys and stole NFT after created and given to victim.
  • NYC art gallery had NFT stolen from their digital art gallery.
  • Subject created funding hype for NFT and gained $1 million in funds then conducted a rug pull. 

Be aware of the types of fraud associated with cryptocurrency and stay alert when operating in a digital environment. 


Email Logo

Want to schedule a Cornerstone presentation?

Email Cornerstone@hsi.dhs.gov 
for more information.

HSI special agents are available to provide training and share red flag indicators, criminal typologies, and methods with businesses and industries that manage the very systems that terrorists and criminal organizations seek to exploit.to edit this placeholder text.


Crypto Coins

Cryptocurrency ATMs and Fraud

Cryptocurrency is a digital currency maintained through a decentralized, encrypted system. Unlike the United States Dollar or Euro, there is no central authority or state backing the value of these currencies. This innovation has attracted significant interest, with users enjoying a sense of perceived anonymity from governments and banking institutions. Cryptocurrency can now be used to buy goods and services, similar to fiat currency. However, like anything digital, it is highly suspectable to fraud.

As of February 2024, according to CoinMarketCap the global cryptocurrency market cap was $1.98 trillion with a daily market volume near $90 billion.  Among the hundreds of thousands of different types of cryptocurrencies created, Bitcoin remains the largest, with a current value of approximately $61,000.00 per coin and a $1.013 trillion market cap.  With a daily market volume in the billions and an overall market cap in the trillions, cryptocurrencies have become a haven for criminal enterprises, both foreign and domestic.

According to the Federal Trade Commission (FTC), more than 46,000 people have reported losing over $1 billion in cryptocurrency to fraud since 2021.  That is roughly one out of every four dollars reported lost, surpassing any other payment method.

Bitcoin ATM

Cryptocurrency ATMs

There are various types of fraud associated with cryptocurrency (Elder, Romance, Impersonations, Investment, Pig Butchering, Computer Lock Out, Ransomware, and Anti-Virus, etc.) This issue will not focus on the underlying fraud schemes, but rather on the method the fraudsters seek to receive stolen funds.

First, understand that cryptocurrency ATMs, “Bitcoin ATMs,” and virtual currency kiosks are found in locations like grocery stores, gas stations, convenience stores, and malls.  Regardless of the name, they look and operate like traditional bank ATMs. However, these “ATMs” allow individuals to purchase and send virtual currencies, like Bitcoin, Ether, and Tether, to other parties anywhere in the world instantaneously.

The global crypto ATM market size was estimated at USD 116.7 million in 2022 and is expected to grow at a compound annual growth rate (CAGR) of 62.5% from 2023 to 2030. To find cryptocurrency ATMs near you, check Bitcoin ATM Map – Find Bitcoin ATM, Online Rates (coinatmradar.com).

Bitcoin No Face

Cryptocurrency Fraud

Traditionally, a fraudster would convince an unsuspecting victim to send fiat currency via wire transfers, gift cards, P2P digital transfer, etc. Now, fraudsters direct victims to send virtual currency via cryptocurrency ATMs. The fraudster typically instructs the victim to withdraw fiat currency from their financial institution and deposit it into a cryptocurrency ATM, providing the victim with a QR code linked to a wallet controlled by the fraudster (this if often a screenshot of a QR code generated by the suspect’s wallet software). As noted above, tactics (or methods) may vary, but the goal is to gain a victim’s trust, creating a false sense of security before fabricating an urgent situation that requires the victim’s help and/or demand a payment. The fraudster directs the victim to deposit cash into a virtual currency ATM and purchase virtual currency, which is then sent to the fraudsters’ virtual currency wallet.

Once this is done the money is essentially gone.  Therefore, it is crucial to understand the difference between making a cash deposit at a traditional financial institution ATM and at a cryptocurrency ATM.  The traditional fiat currency deposited directly into a bank account at an ATM is a known party (controlled by a financial institution) or even to your own account. However, in this fraud, the cryptocurrency ATM deposit goes into an anonymous or un-hosted wallet address where the party that controls the wallet may or may not be known.  If using a cryptocurrency ATM, the user must only deposit funds into a wallet controlled by the user to not become a victim.  

old man ATM

Preventative Measures

These recommendations are intended for anyone utilizing and/or anyone that may have been asked to deposit funds at a cryptocurrency ATM by a third party:

  • Invest with reputable exchanges and wallets with a long user history.
  • Do not deposit cash in a crypto ATM in exchange for a QR code.
  • Don’t link cryptocurrency brokerage accounts to traditional bank accounts permanently.
  • Don’t respond to unsolicited messages about investing in cryptocurrency.
  • Enable multi-authentication services on accounts associated with crypto wallets or exchange platforms.
  • Be wary of personal information you post online, and ensure you are constantly updating your privacy settings on all social media platforms.
  • Use strong password management and set up two-factor authentication.
  • There are no get-rich-quick schemes, and if it sounds too good, then it is too good.
  • Genuine investment companies will never call you, so be extremely cautious with anyone you do not know who calls with any opportunity to increase your wealth.
  • Before investing in any type of opportunity, take the time to research and talk to people you trust, such as family, friends, or advisors.
  • Never send money to someone you have never met in person, and always seek advice from someone you trust before sending money to someone you recently met or started a relationship with online. This is especially true if the relationship is remote, or primarily through text/chat app/or by phone!
  • Be wary of anyone asking you to receive money on their behalf and then later transfer it.
  • You cannot win a lottery you have not entered, and legitimate lotteries will never ask for money up front (e.g. send fraudster $1,000 USD to claim $50,000 prize).
  • Don’t trust people who promise you can quickly or easily make money in the cryptocurrency markets.
  • If you meet someone on a dating site, app, or social media, and they want to show you how to invest in crypto or ask you to send them cryptocurrency, it is a fraud.
Men Red Flag

Red Flag Indicators

In 2023, an estimate published by Chainalysis revealed that $24.2 billion in cryptocurrency was received by illicit wallets or funds deemed stolen. This staggering number emphasizes the importance of protecting yourself, your assets, and those of your clients/customers. Here are some red flags to be on the look out for:

  • A crypto wallet or exchange platform advertising currency much below (>5%) market value.
  • A crypto wallet or exchange platform promising outrageous returns on investments.
  • A crypto wallet or exchange platform requiring a massive initial investment.
  • Being asked or forced to use a bitcoin ATM for a cash deposit in exchange for a QR code.
  • An unknown crypto exchange company using a similar layout to an official one.
  • Receiving calls, texts, email, or other unsolicited messages encouraging you to invest money into crypto.
  • Funds moved from an illicit source through numerous intermediary addresses over a short period of time before being deposited with an exchange.
  • Funds transferred through a number of intermediate addresses in a very short period of time prior to being deposited to customer’s wallet, or just after being withdrawn, and where the ultimate source or destination is an illicit entity.
  • Account is abandoned with a balance once supporting documents are requested from the Client.
  • Clients fails to provide information or documentation regarding source of funds and/or destination of funds.
  • Misleading or inaccurate information is provided regarding source of funds and/or destination of funds.
  • Account is abandoned with a balance once supporting documents are requested from the Client.
  • Individuals typically under the age of 40 years old with connections to high risk countries, with no financial or investment background, open a business account on behalf of a newly created investment
  • Identification documents provided do not align with the account activity or other details of the profile (e.g. employment, age, net worth, locations, and IP).
  • Round dollar deposits over $1,000 from individuals geographically dispersed throughout the country, with corresponding businesses
  • Deposits from individuals increase over short periods of time to tens of thousands of
  • Same-day outbound transfers corresponding to the money from potential victims to keep daily balance at near
  • Victims repeatedly moving money in round figures out of their account(s) g., $1,000 or $5,000, which is a sudden change in their banking practices.

If you have been a victim of one of these frauds, please contact the Homeland Security Investigations (HSI) National Lead Development Center (NLDC) by email at HSILeads2@hsi.dhs.gov


HSI encourages the public to report suspected suspicious activity through its toll-free Tip Line at 1-866-347-2423 or by completing an online Tip Form available at https://www.ice.gov/webform/ice-tip-form.

For areas outside the United States and Canada, callers should dial 802-872-6199. Hearing-impaired users may call TTY 802-872-6196.