Investigating Cases Involving Cryptocurrency
 

By Caroline M. Burnell, CFE, Director, Institute of Protective Services, Temple University Harrisburg

September 2024

Today’s cryptocurrency is much different from its original conception in the early 1980s as a digital payment method. Its uses have expanded to include governance, digital certificate of ownership, investment opportunities, and much more. It is also much easier to purchase and sell. Most significantly, there are thousands of individual cryptocurrencies in addition to Bitcoin, the original cryptocurrency released in 2009.  
 
With this increase in popularity and accessibility comes an increase in the number of exploitation reports made to adult protective services (APS) involving cryptocurrency. This article discusses what cryptocurrency is, its value, why people would own it, and how criminals are using it. It also offers information specific to APS’ investigations involving cryptocurrency. The endnotes include links to additional resources. In this article, “criminals” refers to people with ill intent.
 
Cryptocurrency is a digital asset recorded on a blockchain. Let’s examine the components of this definition. The idea of digital assets is not new. Think about how most of us currently do our banking. On payday, our employer electronically deposits our paycheck into our bank account. We spend that money through various electronic means such as debit cards, automatic bill payments, or a digital app on our smartphone. This describes assets — our wages — existing in a digital environment. Unlike our wages in a traditional bank account that can be converted into cash, there is no tangible component to cryptocurrency — it only exists in the digital realm, hence the term “digital asset.” (However, cryptocurrency can be sold for U.S. dollars, which can then be transferred into a traditional bank account.)
 
Let’s look next at the definition component “recorded on a blockchain.” Blockchain is a newer way of recording data. It is an electronic ledger with unique properties that secure and preserve the integrity of the data recorded. Instead of recording each transaction individually, blockchains group transactions and record them as a block of transactions. Each transaction within a block is identified by an alphanumeric string referred to as a “hash” or “transaction ID,” which is created through a cryptographic algorithm that converts the transaction data into a unique output of fixed length. Any change in the transaction data generates a new hash.
 
Most cryptocurrencies derive their monetary value from the market and what people are willing to pay for them. Other cryptocurrencies such as stablecoins derive their value from the currency, commodity, or financial instrument to which they are pegged, or tied.¹
 
Some people purchase cryptocurrency as an investment opportunity while others use it as a means to send assets to people in areas without traditional financial institutions. Still others use it as a payment method to purchase goods or services, or as ransom to retrieve confidential data either encrypted or stolen by criminals. And some people receive cryptocurrency as a reward in games and other promotions.
 
Criminals — including scammers — use cryptocurrencies to receive the proceeds of their crime. New data from the Federal Trade Commission shows fraud losses at cryptocurrency ATMs ² are “skyrocketing, increasing nearly tenfold from 2020 to 2023 and topping $65 million in just the first half of 2024.” ³
 
There are diverse ways in which criminals — including scammers — target cryptocurrency. For instance:

• Using cryptocurrency to receive the proceeds of a crime instead of gift cards or wire transfers.
• Manipulating people into purchasing cryptocurrency and depositing it into a wallet⁴ controlled by the criminals. Examples include:
  • Investment scams promising high rewards with little or no risk for investment into a particular cryptocurrency.⁵
  • Scams in which the criminal forms a relationship with the victim with the intent of getting them to “invest” in a nonexistent cryptocurrency investment opportunity. 
  • Impersonation scams such the multi-phased phantom hacker scam⁶ that ends with the victim withdrawing their funds from traditional bank accounts and purchasing cryptocurrency, unwittingly depositing it into a wallet controlled by the criminals.
  • Giveaway scams that promise a reward or prize in exchange for either information about a person’s cryptocurrency account or the cryptocurrency itself.⁷
• Phishing attacks are targeting information pertaining to a person’s cryptocurrency wallet, private key, and/or seed phrase. These items are similar to an online bank account’s account number, password, and answer to security questions, respectively. With this information, a person can access another person’s cryptocurrency wallet and transfer its content into another wallet.
• Criminals with in-person access can copy, photograph, or take a person’s cryptocurrency wallet, private key, and/or seed phrase.

Cryptocurrency is attractive to criminals because it is pseudo anonymous. Blockchains display the addresses that receive the “stolen” cryptocurrency, but the addresses themselves are not identifiable to a particular individual. In most cases, the identity of the address holder only becomes known if the cryptocurrency is sold for fiat currency (e.g., U.S. dollars) that is then deposited into a traditional bank or investment account whose owner is known. This pseudo anonymity makes it almost impossible to recoup lost or stolen cryptocurrency.

When investigating cases involving cryptocurrency, it is important for APS to obtain information specific to the cryptocurrency transactions. This includes, but is not limited to, the following:  

• What was taken or missing. Is it U.S. dollars used to purchase cryptocurrency, cryptocurrency itself, or both?
• Transaction details for each cryptocurrency transaction including the address of the sending and receiving wallets, the amount and type of cryptocurrency, date and time including time zone, and the transaction ID or hash. 
• Details including what the person hoped to achieve with the transaction(s), where they believed they were sending the cryptocurrency, the physical address of any cryptocurrency ATM used, the name of any cryptocurrency exchange⁸ used to send or receive funds, and a timeline of events.
• Details of the communication between the alleged perpetrator and the victim. For example, dates and times; communication method including social medial platforms, email addresses, and phone numbers; copies of texts and/or emails; and other relevant information. Steps should be taken to preserve this information for investigative leads and possible criminal prosecution.

When warranted by the investigation, it is important for APS to mitigate risk. The measures below are specific to cryptocurrency and should be considered in addition to any other risk reduction measures dictated by the evidence gathered during the investigation.
 

Reporting

• Immediately submit a report to the FBI Internet Crime Complaint Center (IC3) at www.ic3.gov or by contacting the local FBI field office.⁹ The most important information to provide to the FBI is the transaction details described above.
• Immediately contact the cryptocurrency exchange or wallet provider used. Contact information should be on their website. They may be able to freeze the scammer’s wallet or take other measures to recover lost cryptocurrency.
• File a report with the local police. 
• The Federal Trade Commission (www.FTC.gov) collects data on scams, collates the information, and sends it to investigatory agencies.

Additional Measures

Any cryptocurrency remaining in a wallet should immediately be transferred into a new wallet using a new password. If malware may have been installed on the adult’s computer or mobile device, this transfer should be done from a different device. Otherwise, the criminal may obtain the new account details.

• Qualified technicians should review any device suspected of containing malware and remove any malware found.
• With the prevalence of data breaches, many passwords and email addresses are available for sale on the dark web. Best practice is to use a unique email and password specifically for cryptocurrency. This adds an additional layer of security.
• Ensure that the security program(s) installed on any device containing a wallet or cryptocurrency data are up to date.

In closing, please remember: scammers are ruthless. Offers to recover a victim’s stolen cryptocurrency are likely a scam.¹⁰

¹ Stablecoins were designed to avoid the significant price fluctuations of traditional cryptocurrency. Stablecoins are cryptocurrencies that peg their value to a real-world asset, such as the US dollar, a community like gold, or other cryptocurrency. For example, a stablecoin pegged to the U.S. dollar should value 1 U.S. dollar, whereas a stablecoin pegged to the value of gold should value the price of gold as trading on the market specified by the stablecoin. The value of the stablecoins can fluctuate though.

² Cryptocurrency ATMs are automated teller machines where individuals can purchase – and sometimes sell – cryptocurrency. The type of cryptocurrency available varies depending upon the company operating the ATM.  

³ Fletcher, Emma, Bitcoin ATMS: A payment portal for scammers, U.S. Federal Trade Commission, September 3, 2024, https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2024/09/bitcoin-atms-payment-portal-scammers, last accessed September 4, 2024.

⁴ Wallets are the location where the information needed to access cryptocurrency is stored.   

⁵ For more information on investment scams, please see the FBI news release Crypto Scams Involving Tether, USD Coin on the rise, February 2, 2023,  https://www.fbi.gov/contact-us/field-offices/denver/news/crypto-scams-involving-tether-usd-coin-on-the-rise, last accessed September 4, 2024.

⁶ For more information on the phantom attacker scam including how it works, please see, Inside the FBI: The Phantom Hacker Scam, https://www.fbi.gov/video-repository/inside-the-fbi-the-phantom-hacker-scam-022924.mp4/view, last accessed September 4, 2024.

⁷ For more information on giveaway scams, please see, Slow your scroll: Spot and avoid social media giveaway scams, https://consumer.ftc.gov/consumer-alerts/2023/11/slow-your-scroll-spot-and-avoid-social-media-giveaway-scams, last accessed September 4, 2024.

⁸ A cryptocurrency exchange is an online platform that is similar to an investment broker, making it easy to purchase and sell cryptocurrency. It is important to use a reputable exchange to protect the cryptocurrency from theft. Criminals have created fraudulent exchanged and hacked into existing exchanges with less than robust security.

⁹ For more information on reporting to the FBI, please see FBI’s Guidance for Cryptocurrency Scam Victims, Alert number I-082423-PSA, August 24, 2023, https://www.ic3.gov/PSA/2023/psa230824, last accessed September 4, 2024.

¹⁰ For more information on false claims to recover cryptocurrency including how it works, please see the FBI’s alert, Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds, Alert number: I-062424-PSA, June 24, 2024,  https://www.ic3.gov/PSA/2024/PSA240624#:~:text=Using%20social%20media%20or%20other,to%20investigate%20fund%20recovery%20cases., last accessed September 4, 2024.

The APS Blog is updated regularly with posts from contributing authors and new publications from the APS TARC.

How did we do? Take our quick customer satisfaction survey to give us feedback.