FBI Warns of Fake Crypto Apps Spoofing Financial Institutions

The FBI is warning financial institutions and investors about cybercriminals that are creating fraudulent cryptocurrency investment apps.

In a Monday alert, the FBI said that it has identified 244 victims and estimated the approximate loss associated with this activity to be $42.7 million.

In its alert, the FBI encourages financial institutions and their customers who suspect they have been defrauded through fake cryptocurrency investment apps to contact the FBI via the Internet Crime Complaint Center or their local FBI field office.

The FBI has observed cybercriminals using “the names, logos and other identifying information of legitimate USBUSs, including creating fake websites with this information, as part of their ruse to gain investors. Financial institutions should warn their customers about this activity and inform customers as to whether they offer cryptocurrency services.”

In one instance, between Dec. 22, 2021, and May 7, 2022, unidentified cyber criminals purporting to be legitimate U.S. financial institutions defrauded at least 28 victims of approximately $3.7 million.

“The cybercriminals convinced victims to download an app that used the name and logo of an actual US financial institution and deposit cryptocurrency into wallets associated with the victims’ accounts on the app,” the FBI noted. ”When 13 of the 28 victims attempted to withdraw funds from the app, they received an email stating they had to pay taxes on their investments before making withdrawals. After paying the supposed tax, the victims remained unable to withdraw funds.”

The FBI recommends investors take the following precautions before downloading apps:

• Be wary of unsolicited requests to download investment applications, especially from individuals you have not met in person or whose identity you have not verified. Take steps to verify an individual’s identity before providing them with personal information or relying on their investment advice.
• Verify an app is legitimate before downloading it by confirming the company offering the app actually exists, identifying whether the company or app has a website, and ensuring any financial disclosures or documents are tailored to the app’s purpose and the proposed financial activity.
•  Treat applications with limited and/or broken functionality with skepticism.