Crypto and Virtual Asset Scams

Why This Topic Matters
Crypto and virtual asset scams are one of the fastest-growing categories of consumer fraud worldwide. Losses reported to agencies such as the U.S. Federal Trade Commission and FBI Internet Crime Complaint Center now run into billions of dollars annually, and the ACFE has expanded its coverage of this area within the Fraud Schemes section of the CFE Exam (Consumer Fraud and Scams). Fraud examiners must understand these schemes because the underlying technology (blockchain, wallets, exchanges, smart contracts) creates unique features that fraudsters exploit: transactions are irreversible, participants are pseudonymous, assets move across borders in minutes, and regulation is fragmented and evolving. Victims are frequently unsophisticated consumers who are drawn in by promises of rapid wealth, and recovery of funds is difficult. For the exam, you must be able to recognize scheme types, identify red flags, understand investigative and preventive responses, and distinguish crypto-specific variations from traditional fraud schemes.

What Are Virtual Assets?
The Financial Action Task Force (FATF) defines a virtual asset as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, excluding digital representations of fiat currency, securities and other financial assets already covered elsewhere. Examples include cryptocurrencies such as Bitcoin and Ether, stablecoins, utility tokens, governance tokens and non-fungible tokens (NFTs). Businesses that exchange, transfer, safeguard or issue virtual assets are called Virtual Asset Service Providers (VASPs) and are increasingly subject to anti-money laundering (AML) obligations, including the FATF Travel Rule, which requires originator and beneficiary information to accompany transfers above a threshold.

Key Technical Concepts You Need
Blockchain: a distributed, append-only ledger in which transactions are grouped into blocks and cryptographically linked. Public blockchains are transparent, meaning every transaction is visible, but the identities behind wallet addresses are not directly disclosed. This makes crypto pseudonymous, not anonymous, an important distinction frequently tested.
Wallets and keys: a wallet holds the private key that authorizes spending. Whoever controls the private key or the seed phrase (recovery phrase) controls the funds. Hot wallets are internet-connected; cold wallets are offline. Custodial wallets are controlled by a third party (such as an exchange); non-custodial wallets are controlled by the user.
Exchanges: centralized exchanges (CEX) act as intermediaries and typically perform Know Your Customer (KYC) checks; decentralized exchanges (DEX) operate through smart contracts with little or no identity verification.
Smart contracts and DeFi: self-executing code on a blockchain. Decentralized finance (DeFi) platforms offer lending, trading and yield products without traditional intermediaries, creating opportunities for code exploits and scams.
Mixers, tumblers and privacy coins: services and currencies (e.g., Monero, Zcash) designed to obscure the transaction trail. Their use is a laundering red flag.
Irreversibility: once confirmed, a blockchain transaction cannot be reversed by a bank or card network. There is no chargeback mechanism.

Major Categories of Crypto and Virtual Asset Scams

1. Investment and Trading Scams
These are the largest source of consumer losses. Victims are persuaded to invest in a fraudulent platform, token or trading program.
Pig butchering (sha zhu pan): the fraudster builds a relationship over weeks or months, often beginning with a wrong-number text, dating app match or social media contact. Once trust is established, the victim is coached to invest on a fake trading platform that shows fabricated profits. The victim is encouraged to invest more (fattening the pig), and when withdrawal is attempted, the platform demands taxes, fees or verification deposits before disappearing. This combines romance fraud and investment fraud, and the scammer typically never asks the victim for money directly as a gift, which distinguishes it from a classic romance scam.
Crypto Ponzi and high-yield investment programs (HYIPs): platforms promise fixed daily or monthly returns (for example 1 percent per day) from trading bots, arbitrage or staking. Early investors are paid with later investors' money. BitConnect and OneCoin are classic examples. Multi-level marketing structures with referral bonuses are common.
Pump-and-dump schemes: promoters accumulate a low-value token, hype it through social media, influencers and messaging groups, then sell when the price spikes, leaving buyers with worthless holdings.
Rug pulls: developers launch a token or DeFi project, attract liquidity from investors, then drain the liquidity pool or abandon the project. Hard rug pulls involve malicious code (for example hidden functions that prevent investors from selling, sometimes called a honeypot token); soft rug pulls involve developers quietly dumping their holdings.
Fake initial coin offerings (ICOs), token sales and presales: fraudsters create professional websites and white papers for projects that do not exist or have no intention of delivering.
Fake exchanges and trading apps: cloned or wholly fabricated platforms that display fake balances, manipulate prices, or simply refuse withdrawals.
Cloud mining and mining equipment scams: victims pay for mining contracts or hardware that produce no returns or are never delivered.
Celebrity and giveaway scams: impersonators of well-known figures or companies promise to double any crypto sent to a specified address. Deepfake videos and hacked verified social media accounts are increasingly used.

2. Theft of Credentials and Assets
Phishing and seed phrase theft: fake wallet apps, counterfeit exchange login pages, fake customer support agents, or urgent security alerts trick victims into revealing private keys or seed phrases. Legitimate providers never ask for a seed phrase.
SIM swapping: the fraudster convinces a mobile carrier to port the victim's number to a new SIM, intercepts SMS-based two-factor authentication codes, and takes over exchange accounts.
Malware and clipboard hijackers: malicious software replaces a copied wallet address with the attacker's address at the moment of pasting.
Address poisoning: the attacker sends tiny transactions from an address that looks nearly identical to one the victim regularly uses, hoping the victim will copy it from transaction history.
Fake airdrops and wallet drainers: victims are lured to a site to claim free tokens and asked to connect their wallet and approve a transaction that grants the attacker permission to drain assets.
Cryptojacking: unauthorized use of a victim's computing resources to mine cryptocurrency, often via malware or compromised websites.

3. Payment-Demand Scams Using Crypto
Here cryptocurrency is the payment method rather than the investment. Traditional schemes are adapted to exploit crypto's irreversibility and anonymity.
Government and utility impersonation: callers pose as tax authorities, police or utility companies and instruct the victim to deposit cash into a crypto ATM (Bitcoin ATM) and send it to a provided wallet or QR code. Any legitimate agency demanding payment through a crypto ATM is a decisive red flag.
Tech support and bank impersonation: victims are told their accounts are compromised and must move funds to a safe crypto wallet controlled by the scammer.
Ransomware and extortion: ransom demands and sextortion payments are routinely required in crypto.
Employment and task scams: victims perform online tasks, are paid small amounts in crypto to build trust, then asked to deposit their own crypto to unlock higher-paying tasks.

4. NFT and Gaming-Related Scams
Counterfeit or plagiarized NFTs, fake minting sites, phishing through fake marketplaces, wash trading (an insider buying and selling to themselves to inflate volume and price), and play-to-earn games whose tokens collapse after insiders cash out.

5. Recovery Scams
After an initial loss, victims are contacted by purported recovery agents, law firms or government investigators who promise to retrieve the stolen funds for an upfront fee. This is a reload scam that re-victimizes the same person, frequently using victim lists sold among fraudsters.

6. Money Laundering and Mule Involvement
Crypto is used to launder proceeds of other frauds. Techniques include chain hopping (converting between different cryptocurrencies), using mixers, peeling chains (moving funds through many wallets in small increments), privacy coins, unregulated or offshore exchanges, over-the-counter brokers, and recruiting money mules who convert fiat to crypto through their own accounts or ATMs. Fraud examiners should recognize that a consumer who is told to buy crypto and forward it may be an unwitting mule.

How the Schemes Typically Unfold: The Victim Lifecycle
Contact: unsolicited message, social media ad, dating profile, wrong-number text, influencer promotion or search engine ad.
Grooming: trust-building, display of lifestyle and wealth, small early wins or test withdrawals that succeed.
Escalation: pressure to invest larger sums, borrow, liquidate retirement savings or recruit friends and family.
Lock-in: withdrawal is blocked; fees, taxes, anti-money-laundering verification or account unfreezing charges are demanded.
Disappearance: platform goes offline, contacts vanish, funds are rapidly moved through multiple wallets and exchanges.
Re-victimization: recovery scam contact.

Red Flags to Memorize
Guaranteed, fixed or unrealistically high returns.
Pressure to act quickly or secrecy demands.
Unsolicited contact leading to investment advice.
Any request for a seed phrase or private key.
Instructions to pay a business, government agency or new romantic contact in cryptocurrency, particularly via crypto ATM.
Inability to withdraw funds, or new fees required before withdrawal.
Platform not registered with relevant regulators; anonymous or unverifiable team; copied white paper.
Celebrity endorsements and doubling offers.
Lookalike domain names and apps outside official stores.
Demands to move money to a safe wallet.

Investigating Crypto Scams
Blockchain analysis: because public ledgers are transparent, investigators can trace the flow of funds from the victim's transaction through intermediary wallets using block explorers and commercial analytics tools. Clustering heuristics group addresses likely controlled by the same entity. Tracing typically aims to reach a point where funds enter a regulated exchange that collected KYC information.
Legal process: subpoenas, court orders or mutual legal assistance requests to exchanges for account holder identity, IP logs and linked bank accounts. Freezing orders where jurisdiction allows.
Evidence preservation: collect wallet addresses, transaction hashes (TXIDs), screenshots of platforms and chats, URLs, phone numbers, and payment records. Transaction hashes are the key identifier for a crypto transaction.
Open source intelligence: domain registration records, social media accounts, reused images and copied documents.
Challenges: cross-border jurisdiction, use of mixers and privacy coins, decentralized exchanges without KYC, speed of movement, and lack of a central authority to reverse transactions.
Reporting: victims should report to law enforcement (for example FBI IC3 in the U.S.), consumer protection agencies, the exchange used, and securities regulators where tokens were marketed as investments.

Prevention and Consumer Protection
Never share seed phrases or private keys; store them offline.
Use hardware or cold wallets for significant holdings.
Enable app-based or hardware two-factor authentication rather than SMS.
Verify platform registration with regulators and research the team.
Send a small test transaction and verify addresses character by character.
Treat any payment demand in crypto from a government agency, utility or employer as fraud.
Be skeptical of unsolicited investment advice, especially from new online relationships.
Organizations should train staff, monitor for cryptojacking, and VASPs should implement robust KYC, transaction monitoring and Travel Rule compliance.

Exam Tips: Answering Questions on Crypto and Virtual Asset Scams

Tip 1: Classify by what the crypto is doing. Ask whether crypto is the investment (fake exchange, Ponzi, rug pull, pig butchering), the target of theft (phishing, SIM swap, wallet drainer), or merely the payment channel (impersonation scam paid via Bitcoin ATM, ransomware). Many questions describe a scenario and ask you to name the scheme; this three-way split narrows the answer quickly.

Tip 2: Know the signature feature of each scheme. Pig butchering equals long-term relationship plus fake trading platform plus withdrawal fees. Rug pull equals developers draining liquidity or abandoning a project. Pump-and-dump equals coordinated hype followed by insider selling. Giveaway scam equals send crypto to receive double back. Recovery scam equals upfront fee to retrieve prior losses. SIM swap equals carrier porting the number to defeat SMS authentication. Address poisoning equals lookalike address planted in transaction history. If a question mentions a honeypot token that cannot be sold, think rug pull or malicious smart contract.

Tip 3: Remember pseudonymous, not anonymous. A common distractor states that cryptocurrency transactions are untraceable or completely anonymous. The correct position is that public blockchain transactions are permanently visible and traceable, but wallet addresses are not inherently tied to identities. Identity is typically established at the point of interaction with a regulated exchange that performed KYC.

Tip 4: Irreversibility drives both the scheme and the victim impact. If asked why fraudsters prefer crypto payments, the best answer usually involves irreversibility, speed, cross-border transferability and reduced identity verification, not that crypto is illegal or unregulated everywhere.

Tip 5: Seed phrase requests are always fraud. Any answer option in which a legitimate exchange, wallet provider or support agent asks for a seed phrase or private key should be identified as a scam indicator. Equally, legitimate government agencies and utilities do not demand payment through crypto ATMs.

Tip 6: Distinguish crypto schemes from their traditional cousins. Pig butchering differs from classic romance fraud because the victim believes they are investing, not gifting money. A crypto Ponzi is still a Ponzi because returns are paid from new investor funds, regardless of the blockchain wrapper. Cryptojacking is a form of unauthorized computer use and is not an investment fraud. Wash trading in NFTs is the same manipulation concept used in securities markets.

Tip 7: Know the terminology the ACFE uses. Be comfortable with virtual asset, VASP, Travel Rule, private key, seed phrase, hot and cold wallet, custodial versus non-custodial, mixer or tumbler, privacy coin, chain hopping, smart contract, DeFi, DEX versus CEX, rug pull, pump-and-dump, pig butchering, cryptojacking, SIM swapping and recovery scam.

Tip 8: For investigation questions, think evidence and tracing. The transaction hash and wallet address are the starting points; block explorers and analytics tools trace funds; subpoenas or legal requests to exchanges obtain identity; mixers, privacy coins and non-KYC exchanges are obstacles. The correct answer is rarely to contact the blockchain to reverse the transaction because no such authority exists.

Tip 9: For prevention questions, choose the most specific control. If the scenario involves account takeover through text message codes, the best control is app-based or hardware two-factor authentication. If it involves a drained wallet after connecting to a website, the best control concerns reviewing and revoking token approvals and not connecting wallets to unknown sites. If it involves a payment demand, the best control is verifying the request through an independent, official channel.

Tip 10: Watch for absolutes and the best-answer format. The CFE Exam often offers several partially correct options. Eliminate choices containing words like always, never or impossible unless they match a known rule (for example, confirmed blockchain transactions cannot be reversed is a legitimate absolute). Read for the single detail that makes one scheme name fit better than another, and favor the answer that reflects the ACFE text's framing rather than popular media descriptions.

Quick Review Summary
Virtual assets are digital representations of value traded or transferred digitally. Scams fall into investment frauds (pig butchering, Ponzi, pump-and-dump, rug pulls, fake ICOs and exchanges), credential and asset theft (phishing, SIM swapping, drainers, address poisoning, cryptojacking), crypto as payment channel (impersonation and ATM scams, ransomware, task scams), NFT manipulation, and recovery scams. Red flags center on guaranteed returns, urgency, seed phrase requests, crypto payment demands and blocked withdrawals. Investigation relies on blockchain tracing to KYC chokepoints; prevention relies on key security, strong authentication, verification and skepticism toward unsolicited offers. Master the vocabulary, the signature feature of each scheme, and the pseudonymous-but-traceable and irreversible nature of blockchain transactions, and you will be well prepared for this section of the CFE Exam.