Scammers have come up with a new – and rather ingenious – way to rip people off. The Federal Trade Commission (FTC) says the ruse involves a QR code, an impersonator, and a trip to a cryptocurrency ATM where the scammer finishes up their swindle.
The scammer’s first move is to call a victim and pretend to be with the government, a local utility company, or law enforcement. FTC officials say they have also seen instances where someone calls to say you’ve won a prize or to follow up on a potential romantic relationship.
The key trigger is that once they’ve gained your confidence by getting you to bite on the story they’re telling, the scammer then asks you for money.
“If you believe the story they tell and you seem willing to engage, they’ll stay on the phone to direct you to withdraw money from your bank, investment, or retirement accounts,” Cristina Miranda from the FTC’s Division of Consumer and Business Education, said in laying out the narrative.
The scammer’s next step is to employ a cryptocurrency ATM, which are digital cash machines that are starting to show up at places like Walmart and Circle K. Once the victim gets to an ATM, the scammer asks them to insert money and buy cryptocurrency.
As the process unfolds, the scammer sends the victim a QR code to use during the transaction. However, that QR code is actually associated with the scammer’s cryptocurrency wallet. When the victim “buys” cryptocurrency at the ATM using that code, the money gets transferred to the scammer.
Using cryptocurrency ATMs is a clever part of the scam for a couple of reasons. According to a New Jersey investigation on the scam, close to 75% of the companies that operate a cryptocurrency ATM allow certain transactions to proceed without requiring the user to present any information outside of a cell phone number; more than half of those businesses permitted users to purchase up to $900 worth of cryptocurrency with only a cell phone number or no information at all.
How to protect yourself
The FBI’s Internet Crime Complaint Center is providing guidelines for consumers to follow so they can protect themselves from this scam. That advice includes the following:
Don’t send payments to someone you have only spoken to online, even if you believe you have established a relationship with the individual.
Don’t follow instructions from someone you have never met to scan a QR code and send payment via a physical cryptocurrency ATM.
Don’t respond to a caller who claims to be a representative of a company that you have an account with who requests personal information or demands cryptocurrency. Contact the entity directly for verification.
Don’t respond to a caller from an unknown telephone number who identifies as a person you know and requests cryptocurrency.
Practice caution when an entity states they can only accept cryptocurrency and identifies as an official with the government, law enforcement, a legal office, or a utility company. These entities will not instruct you to wire funds, send checks, send money overseas, or make deposits into unknown individuals’ accounts.
Avoid cryptocurrency ATMs advertising anonymity and only require a phone number or e-mail. These cryptocurrency ATMs may not be in compliance with U.S. federal regulations and may facilitate money laundering. Instructions to use cryptocurrency ATMs with these specific characteristics are a significant indicator of fraud.
If you are using a cryptocurrency ATM and the ATM operator calls you to explain that your transactions are consistent with fraud and advises you to stop sending money, you should stop or cancel the transaction immediately.
If you believe you have become a victim of this type of fraud, the FTC requests that you report the incident to its site here. The FBI also encourages victims to report fraudulent or suspicious activities to the FBI IC3.