Hudson Intelligence

Cryptocurrency, Romance & Investment Fraud Schemes

An increasingly prevalent form of online fraud has emerged to wreak havoc in the financial lives of everyday investors, whose introduction to cryptocurrency comes in the form of an elaborate romance scam.

These frauds escalated during the pandemic, while people were socially isolated and prices of Bitcoin, Ether and many other coins and tokens were hitting all-time highs. Cryptocurrency became the top payment method for romance scams in 2021 in terms of total dollar losses, with an explosive +2500% increase over the prior two years, according to the FTC.

The massive scale of this problem is often underreported – partly due to the reluctance of victims to notify authorities – but complaints submitted to Hudson Intelligence and cryptocurrency industry analysts credibly convey the loss of billions of dollars worldwide.

Here are 10 warning signs of cryptocurrency romance scams:

1. Casual Introduction. Frequently, the first contact from fraudsters comes through a dating website or social media platform. It can also begin with an innocent-seeming text message that appears to be a ‘wrong number’ followed by a chatty introduction as fraudsters ingratiate themselves as a friendly new acquaintance. These encounters seem casual, flirty and fun – at first.

2. Daily Check-Ins. Fraudsters who initiate contact – and then build relationships with their victims through a false sense of intimacy and trust – are known as ‘hosts.’ Hosts greet their victims warmly each day and night. They solicit information about what’s happening in the personal lives of their targets.

3. Super Attractive, Super Successful. Hosts present photos of some good-looking stranger, and pretend to be that person – just with a different name. They are invariably attractive. They describe themselves as successful, hardworking businesspeople, with jobs that are mostly impossible to verify. Their professional credentials may be bolstered by a fake profile on LinkedIn.

4. Frequent Pictures of Everyday Life. Fraudsters share pictures depicting everyday events and domestic scenes, such as cooking dinner or walking down the street. This content has generally been staged or scraped/stolen from social media profiles.

5. Always Available: Hosts often work in teams, across multiple shifts, day and night, allowing them to be constantly available and immediately responsive. They keep notes of any important biographical details disclosed by their victims. Though the hosts are interchangeable, they always seem like the same person, because – behind the scenes – the whole team is working together from the same script.

6. Full of Compliments. Hosts are complimentary, praising the intelligence and wit of their newfound friend, claiming they want to ‘learn’ from them.

7. Daring You to Dream Big. They make declarations of beliefs and aspirations, including a desire to help other people achieve their own dreams. In turn, they encourage their new friend to aim higher and embrace bigger ambitions. This is a way of normalizing risk-taking, and weakening conventional habits of financial prudence and restraint.

8. The Come-On. Gradually the host appears to develop romantic interest, casually referring to the victim as “honey” or “dear” and entertaining plans to meet in person at some point in the (distant) future. At the same time, they continue to portray a lifestyle of wealth and luxury, dismissing petty concerns about money, fostering the impression that any potential romantic partner must have a hefty net-worth.

9. The Rich Uncle. After a relatively long introductory period – generally at least a week, sometimes a month – the host will start to discuss their success and passion for cryptocurrency or forex (foreign exchange) trading. Hosts often claim to have learned about trading from a close friend or family member, such as a rich uncle.

10. Finally, the Pitch. Hosts will eventually propose to teach these secret investment ‘techniques’ to their new friend, making their romantic connection – with rising social and economic status – seem increasingly plausible and attainable.

Fake trading sites often feature domain names that are confusingly similar to established crypto brands, and sometimes co-opt corporate logos, trademarks and other content from those companies through infringement and business identity theft.

The fraudster will guide the victim through every stage of the investment process – sharing screenshots with instructions – making it as frictionless as possible to send money to the fraudulent platform.

This is how fraudsters use fake trading platforms to solicit money in cryptocurrency romance scams:

• The victim is instructed to establish an account at a legitimate commercial cryptocurrency exchange, such as Coinbase or Crypto.com.

• The initial stakes are low. The victim is encouraged to purchase no more than $1,000 in cryptocurrency (e.g., Bitcoin) or tokens (e.g., USDT) through their commercial exchange account.

• In certain cases, the victim may be instructed to transfer those funds to a non-custodial wallet app (such as the Crypto.com DeFi Wallet or Coinbase Wallet) on their mobile phone. Fraudsters favor use of these external wallets because it adds an extra ‘hop’ in the transaction sequence – and reduces the likelihood that the transfer of funds from the victim to the fraudster will be flagged or frozen through automated compliance systems of the commercial exchanges, which scan for high-risk or criminal transactions.

• The victim is provided with a cryptocurrency ‘deposit’ address and instructed to send cryptocurrency/tokens to fund their personal ‘account.’ Alternatively, the victim may be given the option of sending money through a wire transfer.

• After the transfer has been made, the victim notifies their host, and then the ‘deposit’ appears in the victim’s online portfolio on the fraud website.

• The victim is coached through a trading ‘transaction’ on the online platform. In reality, no trading occurs; this is only a digital simulation controlled by the fraudsters. Fake trading activity comes in several flavors:

  • Token Arbitrage: The trading activity may be described as short-term arbitrage of cryptocurrency/token pairs. The victim is led to believe they can take advantage of pricing disparities between Bitcoin (BTC) and Ether (ETH), for example, to generate returns of 50% or more within a few minutes.

  • Micro-Trading: The host will stipulate the exact timing and terms for a quick burst of buy/sell trading activity, based on secret information from her so-called ‘source.’

  • Initial Coin Offering: The victim is presented with an ‘opportunity’ to acquire new cryptocurrency tokens at below-market prices, which will immediately increase in value.

  • DeFi Staking: Decentralized finance (DeFi) allows people and businesses to provide peer-to-peer financial services, such as loans, outside the normal regulatory framework of banks and institutional intermediaries. These networks often require large collective pools of tokens, contributed by investors, to fund lending and related activities. In DeFi fraud schemes, victims are encouraged to stake their stablecoins as collateral, with a false promise of future earnings. Yet instead of placing tokens in a liquidity pool, the victim is actually putting their money into the fraudsters’ pockets.

• Once the initial ‘transaction’ is complete, fake profits will post to the victim’s online portfolio.

• To build trust, many hosts will lead the victim through a process of making a ‘withdrawal’ back to the victim’s cryptocurrency exchange account at Coinbase or Crypto.com. The fraudsters allow their victims to momentarily enjoy the thrill of receiving real money. This small-dollar redemption feeds an appetite for more investment, and fools the victim into believing they can freely withdraw their money at any point in the future.

• Now that the victim is convinced of the reliability of the fraudulent site – and its low-risk profits – the host will coax them to invest larger and larger sums. Bonuses and incentives will be promised. Purported profits in their online portfolio will increase exponentially.

• Hosts work hard to expand the flow of incoming funds. Victims are pushed and cajoled to tap every available resource for more cash – borrowing from friends and family; cashing-out retirement plans; obtaining a second mortgage; applying for bank loans. From the victim’s perspective, the amount of anticipated profits make these dire decisions seem reasonable, but they can have devastating consequences.

Demands for Payment of Fees, Refusal to Release Funds

When the victim exhausts their financial resources, the tactics of the fraudsters will shift dramatically.

These are the final steps in the cycle of crypto-romance fraud schemes:

1. Demands are made for prepayment of purported fees. These may be described as taxes, commissions, audit fees, insurance premiums or compliance fines. The demands are triggered as soon as the victim claims to have no more money available to invest – or attempts to make a substantial withdrawal from their online portfolio.

2. Excuses are never-ending. After the fraudsters receive the first up-front payment, they make new demands for more money, often with elaborate explanations. After taxes are paid, commissions are due – then fees for a compliance audit, etc. There is no end to this vicious cycle – no amount of cooperation will ultimately satisfy their demands for more money.

3. The victim may be accused of a crime. The victim might be told his account was ‘frozen’ for tax evasion or AML non-compliance. He will be told to make a large ‘refundable’ deposit within 10 days for release of his funds. The host, in turn, might claim that the trading profits were indeed based on market manipulation or inside information, and encourage the victim to pay quickly to avoid criminal prosecution.

4. The fraudsters themselves will offer assistance. Hosts will claim that they, too, have been forced to pay these fees and fines. In a show of generosity, they may volunteer to cover a portion of the payments for the victim. As promised, funds appear in the victim’s online portfolio – one more fictitious number.

5. Fraudsters eventually offer reduced terms. If the victim is unable to pay, customer support or ‘management’ might offer a negotiated ‘final’ settlement. For example, they might agree to forgive all ‘remaining fees’ as long as the victim pays 50% within three days. These false compromises are meant to encourage the victim to continue making payments until they’ve lost every last penny.

6. Accusations are met with forceful denials. Any allegations leveled at the host, at this point, will be met with a steady counterattack of emotional abuse – belittling, shaming, cross-examining the victim – to force submission to the endless demands.

7. Desperation leads to greater damage. Unfortunately, large sums of money lost by fraud victims during this final phase of the fraud scheme often exceed the amount they originally ‘invested’ in the online platform. The fraudsters employ acute, well-honed tactics of coercion and exploitation, squeezing every available dollar.

Separating Fact from Fiction

Many victims of cryptocurrency romance frauds have undergone weeks or months of emotional and psychological manipulation before they finally realize they have been swindled. This is a sensitive and difficult stage of recovery, when men and women realize they had silenced all their inner doubts while pursuing a fantasy. Some victims may continue to cling to the made-up story, or certain parts of it – finding it difficult to distinguish fact from fiction.

Below are a few important lessons learned by victims of crypto-romance scams who have come to terms with the reality of their situation:

• Phony Portfolio. Every element of the fake trading websites are controlled by the fraudsters, including the financial figures in the online portfolios. The profits were fictitious. The funds from the principal investment are already gone. The account snapshot is nothing but a pretty picture.

• Zero Investment. The trading activity in which the victim participated – token arbitrage, defi staking, ICO, etc. – was simply a digital simulation. None of the victim’s funds were used to trade on their behalf. All investor money was immediately misappropriated by the fraudsters as soon as it was first received.

• Pooled Deposits: Every victim is given a cryptocurrency wallet address to make ‘deposits’ to their personal ‘account.’ In reality, fraudsters rarely bother to assign a unique address to each victim. Instead, the same address will be reused to receive funds from multiple parties. There is no effort to prevent funds from being co-mingled, because all incoming cryptocurrency and tokens are immediately misappropriated for the fraudsters’ benefit.

Please Don’t Call It ‘Pig Butchering’

Cryptocurrency romance scams have earned an unfortunate sobriquet – Pig Butchering Scam or “Sha Zhu Pan” – derived from the phrase Shāzhūpán (殺豬盤) in China where this model of financial fraud was reportedly developed. After a crackdown on cryptocurrency by the Chinese government in 2021, criminal operations migrated over the border to Laos and other countries in Southeast Asia.

Referring to the victims as “pigs” is demeaning and dehumanizing, but this has not stopped adoption of this phrase by law enforcement, regulatory agencies and the news media – everyone from the FBI, to FINRA, to Forbes. Fraud victims are not livestock, fattened for an inevitable bloodletting; they are vulnerable men and women who have been emotionally exploited, psychologically manipulated and financially devastated. Continued use of this insulting expression only serves to perpetuate a cycle of self-blame and shame for these victims, many of whom have lost their life savings.

Consult an Investigator

Hudson Intelligence assists fraud victims, cryptocurrency investors, law firms, businesses and law enforcement agencies. Every cryptocurrency fraud investigation is led by a Cryptocurrency Tracing Certified Examiner (CTCE) and Certified Fraud Examiner (CFE). If you would like to discuss a potential investigation, please complete the form below. We also suggest reviewing our FAQ.