Scam call - Crypto account frozen
Published - Estimated reading time: 6 minutes
- “Hello?”
- “Yes, am I speaking to Ragnar Karlsson please?”
- “What is this regarding?”
- “I am calling from Blockchain about your cryptocurrency account, it has been frozen due to lack of activity.”
- “Well, that’s just a technology buzzword. Very bold trying to scam someone in cyber security.”
That was how a conversation started when I answered my phone recently.
Normally Google is quick to highlight a number as a potential scam so I don’t answer them. Often the “Virtual assistant” function is enough to screen the call and I don’t even bother speaking at all. A few seconds to read the speech-to-text, report as spam and block, move on with my life.
This time though I had just arrived home from walking our dogs in the early evening and didn’t pay attention. It was a UK mobile number with no potential scam warning, so I hit answer. Very unlikely I’d get a call from a mobile phone number I didn’t already have in my contacts, red flag #1.
I have never bothered with cryptocurrency. I have never opened an account with a cryptocurrency exchange, created a wallet or made any deposits. It hasn’t been something that I wanted to get involved in. I knew this was a lie immediately, red flag #2.
The operative casually replied “Oh, you work in cyber security?” and moved straight into the script.
Initially I was actually angry. I know scam calls cost people significant sums of money every day, and the effect on a person’s mental health when they realise they were fooled is a double whammy. These social engineering scams are something I don’t wish on anyone, especially when they are successful in achieving their illegal goals.
Trying to use an authoritative tone the operative told me:
“Sir, I need you to listen to me. I am calling regarding your account which has been frozen due to inactivity.”
I refuted this. I don’t have an account. Never have. “This is a scam” I said.
“Well I can tell you that there is an account in your name with a balance of 3.5 Bitcoin, and this is not a scam.”
I think I might have made some sort of brief noise when I heard the amount, so the bait was the promise of a pretty large sum of bitcoin!
It was at that point that I stepped back and thought about it. This was an opportunity to waste the scammer’s time, reducing the potential for them to successfully scam someone else. At the same time I could find out if they were doing anything clever, or if this was a standard scam.
That short pause was enough to prompt him into asking if I was still there. Clearly the training included needing to put pressure on the target, creating a sense of urgency.
“Yes I’m here, but I don’t have a cryptocurrency account. I have never created one.”, I replied. Go on operative, ball is back in your court. I’m saying you are lying, what is your answer to that.
It was interesting that he immediately moved to trying to reinforce the story with both facts and falsehoods mixed together. He confirmed my name, claimed I had opened an account in 2017, that there were 3.5BTC in the account, and read out my phone number. Sandwiching the lie inside truths, but extremely thin ones.
I threw out another opportunity for him to just choose to end the call: “Look, I’m just wasting your time here. I know this is bullshit.” He kept going though, repeating that my account was frozen and I needed to do what he said to prevent it being closed.
The first tactic was to offer a temporary password to an account on a bitcoin tracking site where I could see the account history for myself. This was offered as proof that I had invested the BTC, even though in reality all it would tell me was that a wallet existed with the claimed balance. It wouldn’t prove anything else, and I suspected they wanted to get my IP from login so I refused to go to the site.
At this point I wondered what other information they had on me, so I challenged him. If I really had created an account the organisation must have completed the Know Your Customer steps. How did they validate my identity?
Well, interestingly they had used both my passport and drivers license for identity documents. Or so he claimed.
“Ok, tell me either my passport number or drivers license number then.”
He couldn’t. A flimsy excuse that he didn’t have access to that information for security. The same when I asked him to provide my home address. In fact when I asked him to confirm my email address, because surely I need that as part of my account, he made something up on the spot with my name and a few numbers with Gmail.
From all of this I surmised that they actually only have a record which matched my name and phone number.
Having heard of locations where people are kidnapped and forced to run these scams I wondered if this person I was speaking to was in the same situation. When I asked him if he was doing this under duress there was no response, he kept to the script and it was as if I hadn’t said anything at all.
We even had an argument about the price of bitcoin back in 2017, amusingly. I couldn’t remember exactly how much it was, but my point was that I wouldn’t have forgotten investing several thousand dollars into cryptocurrency. He was at least on the ball enough to Google while I spoke and correct me on how much it was worth at the time!
Eventually I reached the end of my patience, Theo and Fae were hungry and I was bored of the circular conversation.
“Right, go on then, how am I supposed to unfreeze this fictional account?”
I’m quite certain I heard a sigh of relief from him. All I had to do was transfer a small amount of bitcoin into the account to prevent the inactivity freeze… Oh dear, so they wanted me to purchase cryptocurrency and send it to a wallet they controlled. In no way would that prove my ownership of the alleged account, it is no different functionally than sending money to a random bank account - the key difference is the lack of regulation.
The scam relied purely on the lack of understanding by the target; combined with fear, urgency and doubt the whole thing was aiming to get you to take action without thinking.
I am going to make the same call to action many others in the industry have:
- Regularly remind your colleagues, friends and family that these scams are common.
- They are designed to be plausible on the surface, combined with that sense of urgency or losing out to play on your own self induced fear.
- Importantly, they continue to be successful and will keep coming as long as they are.
Stay safe folks, and help your friends and colleagues to do the same.