Alert Number: I-081325-PSA

Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds

This PSA is an update to Alert Number I-062424-PSA titled, "Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds." This updated advisory provides additional red flag indicators and due diligence measures to help victims who have been in contact with fictitious law firms conducting this fraudulent activity.

This scheme combines a number of exploitation tactics including targeting vulnerable populations, particularly the elderly; exploiting victims' emotional state and financial need to recover funds from a previous scam; and giving victims the sense of safety and security by impersonating or falsely affiliating themselves with multiple government entities. Contact with scammers impersonating law firms continue to pose many risks, including the theft of personal data and funds from unsuspecting victims to the reputational harm of actual lawyers being impersonated.

Red Flag Indicators of Potential Fictitious Law Firm Activity:

  • Impersonation of actual lawyers and/or legitimate law firms and the production of fictitious documents with a legitimate law firm insignia or letterhead.
  • Impersonation or affiliation as official authorized partners with multiple US and foreign government or regulatory entities. There are no law firms which are officially authorized partners of US Government agencies.
  • References to fictitious government or regulatory entities, such as the International Financial Trading Commission (INTFTC). Double check whether such an agency exists.
  • Requesting payment in cryptocurrency or prepaid gift cards. The US Government does not request payment for law enforcement services provided.
  • Having knowledge of the exact amounts and dates of previous wire transfers and the third-party company where the victim previously sent scammed funds.
  • Stating the victim was on a government-affiliated list of scam victims and they can recover their money through "legal channels."
  • Referring victims to a "crypto recovery law firm."
  • State the victims' funds are in an account held at a foreign bank and tell victims to register an account at that bank. The domain or website provided for this bank appears legitimate but is a fraudulent platform to facilitate the ongoing scheme.
  • Placing victims into a group chat on WhatsApp, or other messaging applications, for supposed secrecy and safety of the client with supposed foreign bank processors and attorneys who may say that payment of bank fees is required to verify identity and ownership to withdraw funds.
  • An unwillingness or inability to provide credentials or a license, not appearing on camera, and not conducting video meetings.
  • Request victims send payment to a third-party entity (i.e., xyz trading company) for the supposed purposes of maintaining secrecy and safety.

Additional Due Diligence Measures to Prevent Hiring of Fictitious Law Firms:

  • Use a "Zero Trust" model in these circumstances, which assumes no one should be trusted by default and every request should be verified.
  • Be cautious of law firms contacting you unexpectedly, especially if you have not reported the crime to any law enforcement or civil protection agencies.
  • Request video verification or documentation or a photo of their law license. If this cannot be readily provided, assume they are not legitimate.
  • Request verification of employment for anyone claiming to work for the US Government or law enforcement. You can call your local office for the associated government entity and request to verify the identity of the individual with whom you are communicating.
  • Keep records, including recordings of video chats of all interactions.
  • Require notarized proofs of identity from the supposed lawyers before continuing any further communications and transactions.

Victim Reporting

The FBI requests victims of fraudulent law firm scams, or those who suspect they may have been victimized, to report the suspicious activity to their local FBI field office and the FBI's Internet Crime Compliant Center (IC3) at www.ic3.gov.

Additional Resources