With technology improving by the hour, cybercrime is also steadily on the rise. Every other day, one hears about crimes like phishing, ransomware attacks, BEC (Business Email Compromise), and others affecting businesses globally. Unfortunately, despite organizations employing the latest anti-phishing and anti-ransomware solutions, these crimes are on the increase.
Cryptocurrency As Ransom
Ransomware is a unique cyberattack method where the attacker demands the ransom in cryptocurrency. The specific reason behind it is the anonymity that cryptocurrency transactions offer. It is practically impossible to discover and determine the transaction chain in the cryptocurrency blockchain. Today, more cryptocurrencies are being introduced into the market regularly. It provides more opportunities for crypto scams to take place.
Statistics reveal that the value of cryptocurrency theft has risen over the years, with 2018 being the worst affected year. There was a comparative decline in 2019, but it picked up again in 2020, with the loss estimated at $513 million.
Value Of Cryptocurrency Theft Worldwide From 2016 To 2020 (In Million U.S. Dollars)
(Source – Statista)
Business Email Compromise Cryptocurrency Scams
Like ransomware, the corporate world is witnessing an unprecedented rise in BEC attacks. Business Email Compromise is a cyberthreat explicitly targeted at corporate-level entities. The cyber adversaries send emails to the organization’s employees by impersonating the CEO or any other top management officials through emails. These messages instruct the recipient employees to transfer funds to a specific account. As the emails seemingly originate from the highest management levels, the employees take immediate action and remit the funds as instructed.
Nowadays, malicious actors have modified their mode of operations and involve cryptocurrency instead of the regular financial transfers in fiat currency. As a result, the FBI’s IC3 has received an increasing number of BEC complaints involving cryptocurrency. The numbers are rising alarmingly over the years.
(Source – FBI – Ic3)
The above graph indicates that the BEC complaints with a cryptocurrency nexus are increasing in number. And there is a proportionate amount of loss to organizations associated with BEC crypto scams, as evident from the graph below.
(Source – FBI – Ic3)
The Involvement Of Cryptocurrency – Why?
Cryptocurrency transactions occur through the Blockchain network, and this network is renowned for its anonymity as it is necessary to protect customers’ confidential data. However, malicious actors take advantage of the anonymity offered by Blockchain technology to carry out malicious attacks.
How Does The Cryptocurrency Scam Take Place?
Cyber adversaries dealing in BEC cryptocurrency scams are an intelligent lot. They create multiple crypto wallets and abandon these wallets after one transaction. More cryptocurrencies exist today than ever before. Some cryptocurrencies like Monero, Zcash, or Dash do not provide any visible information about the transactions and their parties. Such transactions happen through hidden crypto wallet addresses.
Usually, the details of cryptocurrency transactions are available publicly, but it never discloses the personal information of the parties involved. The only bit of data available in the public domain is the wallet address. When malicious actors do not use these wallets for more than one transaction, it becomes impossible to trace them.
Examples Of How BEC Cryptocurrency Scams Work
In its Alert Number I-041321-PSA, dated April 13, 2021, the FBI has warned the public about BEC cryptocurrency scams and detailed how they occur, based on the material presented by IC3. These illegal transfers happen in two ways.
Direct Transfer Method
The direct transfer method is similar to how the conventional BEC scams work. The target receives the instruction through a phishing email instructing to transfer funds to a specific bank account where the cryptocurrency exchange maintains a custodian account. Its nature is such that the bank automatically converts the fiat currency into cryptocurrency. It subsequently transfers the amount to the cyber adversary. Generally, phishing emails do not disclose the cryptocurrency wallet address to the target. Therefore, the instruction seems identical to a genuine fund transfer transaction, making it impossible to detect.
The Second Transition Method
This modus operandi is a two-step transaction that involves using social engineering tactics to obtain the victim’s credentials. Personal details could include identifying information like a passport or driver’s license details. It enables the malicious actor to gain access to the victim’s account. Using these credentials, they break into the victim’s email account to send an email with details to the victim’s bank account to transfer an amount.
As the target transfers the money to the specific bank account mentioned in the email, the amount gets automatically converted to cryptocurrency. Subsequently, the cyber adversary opens a crypto wallet in the victim’s name using the personal information obtained through social engineering to transfer the funds from the bank’s custodial account to it. Once the crypto funds reach this account, it becomes easy for the adversaries to transfer them to their crypto wallets.
How To Prevent Becoming A Target To Cryptocurrency Scams?
The FBI alert details the following measures one should adopt to prevent becoming a target to such BEC cryptocurrency scams.
- An ideal solution to prevent such scams is the use of Multi-Factor Authentication (MFA). This solution requires the individual to enter a specific PIN received on a personal device to authenticate the fund transfer transaction. It is an additional protection layer that could prevent malicious actors from accessing the victim’s account.
- One must install the latest anti-phishing solutions in the network systems to ensure the best email phishing protection. Individuals and corporations should take it upon themselves to go through various phishing email examples and learn how to stop phishing emails. One of the best phishing protection methods is to ensure that the URL in the emails genuinely belongs to the sender.
- One should be alert and not share personal information through emails or otherwise.
- Corporates should ensure that the employees’ systems have the settings enabled to allow the viewing of full email extensions.
- Individuals should monitor their bank accounts regularly and look out for irregularities. If they notice any discrepancy, they should inform the respective financial institution to rectify the same. Furthermore, if someone becomes a victim of a BEC cryptocurrency scam, they should immediately report the crime to the authorities concerned.
Final Words
One cannot wish away the cryptocurrency scams happening today. With improving technology, scams are bound to increase. Numerous cryptocurrencies are floating everywhere. It gives more teeth to the adversaries to launch such cyberattacks and target vulnerable users. The best way for organizations to prevent becoming victims of crypto scams is to ensure self-discipline and enhance awareness among employees not to fall prey to phishing emails.