Singapore-based security firm Group IB has identified a crypto fraud that has as many as 250,000 victims

A recent cryptocurrency scam was uncovered by a Singapore-based intelligence company Group IB. The investigation found evidence of 250,000 people who were potentially scammed.

The victims are mostly from the US, UK, Australia, Spain, South Africa and Singapore — with victims from the UK and Australia comprising 93% of the total number.

While the specific source of the leak is not available yet, Group IB has found that the scam operates by making itself appear as a multi-stage cryptocurrency investment scheme.

How the scam works
According to Group IB, the scam unfolds in three stages.

First, an SMS message will be sent out to the recipient, posing itself as a well-known media outlet. The content contains a celebrity endorsing a lucrative investment.

The link from the first stage will take the recipient to a fake website displaying a URL with their personal information, which is the second stage.

Group IB described the second stage in these terms: “[This second stage]…demonstrates their personal data, such as the phone number, first or/and last name, and sometimes an email address, and used for redirects to fake websites masquerading as a local media outlet.”

They also suspect that this personal information could be obtained through individuals using a fraudulent scheme or utilising a third-party service with the means to do so.

If the target continues, they will be redirected to another fake site with their personal information preloaded onto the signup sheet. In the third stage, a victim is required to pay 0.03 BTC to create and activate an account.

Be careful out there
Scams like this degrade the trust of consumers and are common in every facet of the financial industry. It is important to keep a close eye on your money and be aware of who you deal with.

Group IB warned: “The bad guys got smarter in a bid to increase the success rate of their fraudulent operations. Using personal data allows them to carry out targeted attacks and make a victim’s journey easier and smoother, which levels up the overall effectiveness of the scheme.”

Here are some simple things you can do to keep your tokens safe:
Be suspicious of a long redirect chain
Always double-check the domain name and site registration date when entering personal information or payment data
If you are from Singapore, use the ‘Do Not Call’ registry to avoid telemarketers