Crypto-trading scam demands thousands of dollars in fake 'profit tax' to unlock victims’ accounts, Sophos finds

Sophos, a global leader in next-generation cyber security, has released new insight into an international crypto currency trading scam called CryptoRom that targets iPhone and Android users through popular dating apps, such as Bumble and Tinder. The new research: “CryptoRom Swindlers Continue to Target Vulnerable iPhone/Android Users” is based on first-hand stories and content shared with Sophos by victims of the scam who got in touch after seeing Sophos’ previous reports on CryptoRom. 

In the new research, Sophos reports that when victims tried to withdraw their investments from one of the fake trading schemes, their accounts were frozen and were charged up to hundreds of thousands of dollars in fake “profit tax” to regain access. According to Sophos, the CryptoRom operation is increasingly well-organised and sophisticated and targets victims all over the world.

Escalating costs

In one case shared with Sophos, a victim was charged $625 000 to regain access to the $1 million they’d invested in a fake crypto-trading scheme recommended by someone they’d met on an online dating platform. The dating “friend” then claimed to have invested some of their own money to bring their joint stake up to $4 million. According to the scammers, their investment made a profit of $3.13 million, and they were liable for a 20% profit tax, or $625 000, if they wanted to access their account to withdraw funds. In fact, neither the co-investment nor the profits were real, and the online “friend” was part of the scam.

“The CryptoRom scam is romance-centred financial fraud that relies heavily on social engineering at almost every stage,” said Jagadeesh Chandraiah, senior threat researcher at Sophos. “The scammers attract targets through fake profiles on legitimate dating sites and then then try to persuade the target to install and invest in a fake crypto-currency trading app. The apps are usually installed as web clips and are designed to closely resemble legitimate, trusted apps.

“According to victims of this scam who contacted us after our earlier articles, the 20% ‘profit tax’ is only mentioned when they try to withdraw their funds or close the account. Victims who struggle to pay the tax are offered a loan. There are even fake websites that promise to help people recover their funds if they’ve been scammed. In short, whichever path the increasingly desperate victims go down to try to get their money back, the scammers are there waiting for them. People tell us they have lost a lifetime’s savings or their retirement funds to the scam.”

The Sophos research also found a few cases where the CryptoRom operators had approached targets directly via WhatsApp and SMS messages, probably using stolen information.

New technical features

Sophos’ research also details new technical aspects of the CryptoRom operation. For instance, according to Sophos, the fraudsters are misusing Apple’s TestFlight feature that allows for a limited group of people to install and trial a new iOS app and go through a less stringent Apple review process. During 2021, Sophos researchers observed CryptoRom misusing the iOS Super Signature and Apple’s Enterprise Program for the same purpose.

Sophos researchers also found that all the CryptoRom-related websites used by the fraudsters had very similar backend structure and content and that only the brand names, icons and URLs were different. Sophos believes this may enable the scammers to quickly change the websites they use for the scams when one of them is detected and shut down.

Staying safe – an industry issue

“It is deeply worrying that people continue to fall for these criminal schemes, particularly since the use of foreign transactions and unregulated crypto-currency markets mean that victims have no legal protection for the funds they invest,” said Chandraiah. “This is an industry-wide issue that is not going away. We need a collective response that includes traceability of crypto-currency transactions, warning users about these scams and quickly detecting and removing the fake profiles that enable this kind of fraud.”

For more information, please read the article: “CryptoRom Swindlers Continue to Target Vulnerable iPhone/Android Users”.

Sophos has published previous research into CryptoRom and other crypto-trading and financial fraud. Sophos has also published reports on other cyber threats facing consumers and home users, including “fleeceware”, where users are severely overcharged for mobile application services.

Sophos is a Platinum sponsor of the annual ITWeb Security Summit 2022 to be held at Sandton Convention Centre in Sandton, Johannesburg from 31 May & 1 June 2022 and a Silver sponsor at Century City Conference Centre, Cape Town on 6 June 2022. In an increasingly connected, digital world, cyber security threats are constantly evolving and increasing in number and sophistication. Security professionals need to be up to speed with the latest technologies, techniques and skills for predicting and mitigating potentially crippling cyber attacks, the methods and tools in use by today's threat actors, and the latest legal and compliance demands. ITWeb Security Summit 2022, now in its 17th year, will again bring together leading international and local industry experts, analysts and end-users to unpack the latest threats facing African CISOs, CIOs, security specialists and risk officers, demystify emerging cyber security strategies in AI, blockchain, IOT, DevSecOps and more, and explain how to increase an organisation's cyber resiliency. Register today.

Additional resources

Sophos recommends:

• iPhone users should only install apps from Apple’s App Store and Android users should do the same from the Google Play Store.
• All users should consider installing security solutions on their mobile and home computing devices, such as Intercept X for Mobile and Sophos Home.
• Tactics, techniques and procedures (TTPs), and more, for different types of ransomware can be found on Sophos News Threat Research, the home of Sophos’ latest threat intelligence.
• Read the latest security news and views on Sophos’ award-winning news website Naked Security and on Sophos News.
• Connect with Sophos on Twitter, LinkedIn, Facebook, Spiceworks and YouTube.