“Tax” on crypto profits

We are launching a column in which we will describe in detail various crypto fraud schemes and give advice on how to avoid falling into the trap of scammers. Be careful and protect your finances from crypto scammers!
Scheme description
With the growing popularity and accessibility of cryptocurrency, the number of scammers in this area is also growing. They promise to teach you how to easily make money through arbitrage, signals and other “profitable” methods, but in reality they only take money from gullible people. Be careful and don't trust promises of quick and easy money.

In this article we will look at this problem in more detail and tell you how to protect yourself from crypto scammers.

The essence of the fraud scheme is very simple: fishing rod - bait - catch.
As a fishing rod, attackers offer a simple method of operation. Typically, the guarantee of simplicity is the fact that the victim does not need to know or do anything himself, he only needs to follow simple steps that the attackers describe in detail.
The bait is varied and ubiquitous advertising that promises HIGH PROFITS. So as not to scare off potential victims, attackers can sometimes promise average earnings at the initial stage, but then they will definitely be HIGH. In this way, scammers take advantage of human greed to lure victims into their networks.
The catch is profit...only for the attacker. The victim, even if he received small payments (before his first large deposit), remains in the red. Payments come exclusively from the funds of other victims.
Over the past 2.5 years, social networks* have become the most popular source of scam posting. The reports for 2022 speak about this and agree on the calculations:
*According to these reports, social networks also include instant messengers such as Telegram, WhatsApp, Viber, etc.
The total amount of stolen funds is much higher for investment-related scams advertised on social networks.

The total amount of stolen funds is much higher for investment-related scams advertised on social networks.
These data are even more surprising when you consider that in terms of the number of requests from victims, online stores take the lead. Often, attackers resort to real payments to users. But this happens exclusively with the topic of whom the scammers will assess as solvent.

The user is promised to double his investment and successfully does so for a small amount. The procedure is repeated again and again. The victim gains trust and excitement... which means the trap will soon slam shut. Now the fraudster uses various tricks to lure the maximum possible amount from the victim for the next “promotion” and disappears, or force majeure circumstances appear.

The trick of such schemes is that the victim does not understand that she has been deceived. To avoid negative reviews and persecution, scammers resort to concealing the facts of deception. As an example, this is “the blocking of the accounts of our wonderful earning service by evil regulators,” now in order to withdraw funds you need to pay a tax... equal to the deposit amount. Needless to say, this is another attempt to double the jackpot?!

Another type is training in arbitrage trading on a scam site. They really taught me the basics of trading, but they drew the graphs themselves. The deposits of joyful victims and the percentages of earnings grew. And when the time came to withdraw funds, the same bad regulator scheme turned on... you need to pay tax... well, you understand.
Paths of distribution of the scheme
Fraudsters use social networks, forums, chat rooms and email to spread their advertisements.

Any available advertising goes into circulation - from popular bloggers and official company channels (and Telegram Ads and Twitter&). Promising easy money, they back it up with fake charts, statistics and reviews. Well, where would we be without photos with expensive cars, yachts, houses and lots of cash?

However, in real life they are ordinary scammers with no experience or knowledge in the advertised field. Cars are rented. Money are fake. And the houses and yachts are actually from other people’s photos.

Examples of advertising fraudulent channels in Telegram Ads:
Telegram ADS. Advertising that is displayed to users who, according to Telegram, are interested in cryptocurrency
Telegram ADS. Advertising that is displayed to users who, according to Telegram, are interested in cryptocurrency

Examples of warming up users in Telegram:
It includes running marathons to warm up users, during which they offer to follow their futures transactions to make a profit. Often, scammers make money either from a percentage of user income or from fees for access to such signals.

Examples of promoting fraudulent schemes on TikTok:
Includes training videos, profit making experience, advice and selling your training courses

A little bit about Twitter:
It is also worth noting that the fact of fraud begins already at the advertising stage of a scam project. This is not the most common practice, but nevertheless, last October, the SEC imposed a record fine of $1.26 million on Kim Kardashian and Floyd Mayweather.

In Russia, it is currently difficult to hold bloggers accountable for advertising scam projects, since it is almost impossible to prove their intent to commit fraud or organize a financial pyramid. To do this, you need to have malicious intent, and influencers often do not analyze what they are advertising.
Specific example from our practice
The victim, having seen the advertisement in Telegram Ads, subscribed to the telegram arbitrage group. In this group, scammers posted signals to buy cryptocurrency at the most favorable rate. The essence of the scheme was that the token conversion rate on the scam exchange was more profitable than on the official exchanges.

Users deposited USDT tokens on a scam exchange, exchanged them for a coin that was specified in the signal to the group, and could withdraw the funds received after the exchange to their address.
The victim who contacted us had been making similar exchanges for some time. At first, the tokens actually changed at a favorable rate, thereby making a profit from “arbitrage.” The victim bought USDT tokens on the Binance exchange and transferred them to his scam exchange account.

After some time, a post was published in the group, signaling the possibility of making money by exchanging USDT for TRX.

The victim entered $1,700, exchanged it for a TRX token and, having made a profit from the sale, tried to withdraw all TRX tokens back to the Binance exchange. An error occurred during the withdrawal of funds (I didn’t even mention the evil regulators) and the victim contacted the technical support of the scam exchange. Technical support offered the victim two options to solve the problem:
Making a transaction mirrored in amount to circumvent the problem. It's logical.
Waiting from 60 to 120 days.
The victim chose the first option and made another transaction equivalent to 1,700 USDT.

After conducting a repeat transaction, technical support notified that it was necessary to create 1 transaction for an identical amount (up to cents), so your transaction was not counted. After this, the scammers stopped contacting us.

Total: the scammers stole more than $3,400 using deceptive methods. Minus the small costs they paid the victim in the initial stages.
We analyzed the transfers of funds from victims by scammers and found the address where all the funds flowed.

All funds went to the address TMw1Mz…bBzZx, which belongs to the now blocked FORINCOME service (forincome.com). The resource is labeled as a pyramid scheme.
An interesting fact about FORINCOME is that it is included in the register of resources that have signs of a “financial pyramid” from the Bank of Russia. Presumably, the same persons may be behind both resources.

Graph of case connections with token output on FORINCOME


Green - victim

Black - scam

Purple - scam resource

How not to fall for this scheme
In order to avoid falling for such criminal schemes, the AML Crypto team recommends the DYOR (do your own research) practice:
Check the project domain registration. In most cases, the lifespan of a scam domain does not exceed several months.
Check the domain owner. If the domain owner is hidden, this is a warning sign.
Check reviews about the project. The presence of exceptionally rave reviews should raise suspicions. Reviews about fraudulent activities are even more so. Experience shows that such reviews appear quickly and you can save your money by spending 5 minutes on Google.
Pay attention to the popularity of the project website. For example, using the resource similarweb. Correlate the number of subscribers in a group/channel with the popularity of the site. Check activity in groups/channels on the site.
For more experienced users, we recommend conducting blockchain analytics on the flow of funds and whether the movement of cryptocurrency funds corresponds to the statements of project representatives. If you are not sure that you can analyze blockchain transactions yourself, we recommend contacting specialists.
To avoid such crypto fraud schemes, you should be extremely careful and not trust promises of quick money. Never invest money in untested projects and do not trust your funds to strangers or companies.

Before investing in projects or purchasing cryptocurrency, conduct the analysis available to you or contact specialists.

Simple steps and a little of your time will save your money and nerves! What to do if you do become a victim of crypto fraud (we hope not) read here.
We also recommend