Police warn of cryptocurrency scams leveraging World Cup to target victims

SINGAPORE: The Singapore Police Force (SPF) on Wednesday (Jul 1) warned of cryptocurrency scams that leverage the ongoing World Cup to target victims.

In a news release, the police noted that the scams involve malicious links and unauthorised transactions, and that scammers are increasingly utilising online platforms and messaging services to deceive victims and gain access to their cryptocurrency holdings.

Scammers may create authentic-looking websites advertising World Cup tickets or official merchandise for purchase. The fake websites would offer "exclusive" tickets and direct victims to pay using popular cryptocurrencies like bitcoin or USDT.

Once payment is made, the goods would not be delivered, but the websites would be taken down. Recovering funds is often challenging, said the police.

Another scam targets victims searching for a way to stream World Cup matches for free. They may be redirected to phishing websites that prompt them to connect their cryptocurrency wallets, make payments or install malware.

These sites can compromise credentials, financial information or cryptocurrency assets, said the police.

"In some cases, AI-generated deepfake content featuring athletes or celebrities has been used to promote such fraudulent platforms, making them appear more convincing."

The authorities also said that they have observed scam variants involving fake "official World Cup tokens" or fan coins fraudulently marketed as official or team-affiliated digital assets.

"Victims may be misled into investing in these tokens, whose value is artificially inflated before scammers sell off their holdings, causing prices to collapse," SPF said.

SOCIAL ENGINEERING

Another scam variant flagged by the police on Wednesday involves the exploitation of permit signatures via social engineering.

In this variant, scammers would contact victims posing as clients or business associates, often through messaging platforms like Telegram.

The scammer would propose a video call and share a link to join one via a web browser. However, victims who click the link would instead face a pop-up message falsely claiming that a software component on their device has expired and requires updating.

They would then be asked to download a file and execute commands on their computer, unknowingly installing malware.

"With the malware in place, the attacker is positioned to monitor the victim's cryptocurrency activity and intercept wallet credentials," SPF said.

The attacker will then exploit this access by deceiving the victim into approving a "permit signature", a feature that allows users to pre-authorise a future cryptocurrency transaction by signing a message off-chain.

By doing this, the victim will have given the scammer authority to carry out future cryptocurrency transactions from their wallets without further approval, even if a hardware wallet is used.

As funds are not transferred immediately, victims may not realise they have given scammers access to their assets, said the authorities. 

The stolen cryptocurrency may then be moved through various platforms to make it harder to trace and recover.

Cryptocurrency users should take steps to secure their cryptocurrency holdings and to use cryptocurrency service providers that are licensed or regulated by the Monetary Authority of Singapore where possible.

Users who suspect that they are victims of cryptocurrency-related crime should contact their cryptocurrency exchange to halt further transactions or freeze their account and revoke any suspicious token approvals using their wallet interface or a blockchain explorer.

If one's seed phrase has been compromised, they should transfer all remaining assets to a new uncompromised wallet immediately and report the incident to the police, said the authorities.