A new cyber incident that involves Ukrainians: it starts with an invitation to WhatsApp, then a transfer to Telegram and Binance

FRAUDSTERS PAY FUNDS WITHOUT ANY CONDITIONS AT THE BEGINNING OF THE SCHEME

This is the main point why this scam worked in Ukraine. Fraudsters pay out funds without any conditions at the beginning of the scheme.

But what kind of money is this? If you think that you have been scammed by scammers, you are very mistaken.

Small payments do not come from the accounts of the criminals, but from other individuals also drawn into the scheme.

Drops

Elena is 27 years old (name changed at the woman’s request). She is on maternity leave, lives in a village near Kiev, is constantly at home with her child, and has long been looking for opportunities to make money on the Internet. And now it seems to her that she is finally lucky. A luxurious offer comes from an unfamiliar number.

The tasks are very simple: you need to have a bank card, to which random amounts from 300 UAH to 5000 UAH are credited from time to time.

After receiving the tranche, the curator informs you of the card numbers to which you need to transfer 50, 100, 200 or a maximum of 300 UAH. Work only during daytime. Salary for the first working day - 600 UAH. The next day Elena received 800 UAH.

“They first drop small amounts and gain confidence,” says Elena. — I didn’t work for long, then I received 300, 500, 1-5 thousand hryvnia. The money did not remain on the card for a long time. They give you the card numbers and you move on. If you are not online, they call you on Telegram so that you can appear online and continue working. I didn’t just think that they were scammers. I thought it was a regular job online. I’m an honest person, not one of those who will cheat and steal something.”

People like Elena are usually called drops in Internet slang - these are people at the lowest level in a fraudulent scheme, who unknowingly take on all the risks, because they can easily be exposed by the police. Elena “worked” for only two days until she accidentally came across a message on the Internet that such earnings were a scam that threatened a very real crime.

“I worked the next day, they paid me and the money on the card just ran out,” she explains. “In general, not much went through me - about 30 thousand hryvnia. There was supposed to be a new enrollment in the morning, but I came across a video on TikTok, from which I realized that I had “gotten it,” so I decided to stop cooperation and blocked my card myself.”

But who topped up Elena's accounts so that she could pay all these small monetary rewards? Let's return to my case. I received 100 UAH from a drop, someone like Elena, and was ready to “work” further, having a clear benefit. The administrator “Ekaterina” asked me to join a telegram group where I would receive the following tasks. For three likes every half hour, they promised me 25 or 50 UAH.

There are hundreds of such groups. And each has its own nuances. The Spotify Workgroup, for example, regularly posts posts from other members saying they're doing well on tasks. But for some reason the administrators did not give me the right to add to the group. From time to time, publications appeared in the group where participants, in traditionally clumsy phrases (obviously, the consequences of automatic translation), are not recommended to write to anyone and seek advice about participating in this dubious income.

There are also several videos in the chat where people, clearly voicing the same texts, talk about how they recommend “this company.” I suspect they were also offered to read it for 100-200 UAH.

There is also war speculation in the chat. Sometimes there are reports that the “company” allocates part of the funds to charity.

“Everyday tasks”
When I “earned” 400 UAH from scammers from different accounts in different groups, they finally began offering me participation in paid tasks. This is where the scam begins.

Without completing a paid task, it will be impossible to continue earning 25-50 UAH for liking a video. But you don’t want to lose this easy income. The scheme and promised earnings may be different in different groups. “Employers” provide this kind of earning scheme.

Screenshots of correspondence describing the earning scheme

I decide to enter with a minimum deposit: invest 300 UAH and receive 390 UAH.

I am being referred to an even higher level scammer. These call themselves "teachers." Here, the profile photos show very business-like people, so that there is no doubt about the credibility of the “teacher.” These dear gentlemen are no longer under Ukrainian names. My first “teacher” for 300 UAH was Roberto Ovando.

Roberto Ovando and Natalio Enriquez are serious businessmen, it’s immediately obvious

They give me the card number of the next drop, the so-called Elena, where I should deposit the deposit. And they explain that this money will be used to quickly “roll” it on a crypto exchange. I send a screenshot of a money transfer of 300 UAH to a scammer, and he gives me a link to a site that looks very much like a crypto exchange, but is not one.

Fake cryptocurrency exchange

This is a handwritten fake of the famous OKX crypto exchange. Registration on a real exchange requires confirmation of identity and entering many data, such as a copy of your passport, address, verification via mobile phone and email, and photo of your face. But on a fake site I register in a few seconds, entering only my email and coming up with a primitive password. “Teacher” Roberto explains how to see my 300 UAH on the site, and seems to help me buy the USDT cryptocurrency with this money. In fact, what happens is a simple click on the site and nothing more.

My 300 UAH at this time went to the drop, which divided it among the other three newcomers to the scheme, giving them rewards supposedly for liking the video. My first paid task was completed successfully, reports “Roberto”. After a few minutes, 300 UAH is returned to the account with a bonus of +90 UAH.

Next, a few more tasks with liking videos - and we move on to the next prepaid task. Now the minimum bet is 800 UAH. The experience of receiving previous easy money encourages you to try again. For the sake of researching the scheme, I make two tranches to two different fraudulent organizations.

In the 800 UAH scheme, “exclusive teacher” Natalio Enriques, another “respectable manager”, works with me.

He sends me the rules of the game, which say that you must strictly follow the instructions and it is strictly forbidden to distribute information to third parties. The following is a well-known scheme. You transfer the drop money to the card and “buy cryptocurrency” with this money on their fake website.

But there is no easy money anymore. Natalio congratulates me on the fact that the system has allocated a new task to me: in order to get my 800 UAH back with a bonus, I need to invest another 5500 UAH and earn an additional 1650 UAH.

TO GET YOUR 800 UAH BACK WITH A BONUS, YOU NEED TO INVEST ANOTHER 5500 UAH

I didn’t do this, realizing that after the second bonus task another one would arrive for an even larger amount. And this can continue indefinitely. But I recommend reading the screenshots of our communication.

Fraudsters directly tell you to urgently borrow money and take out a loan.

“The payment did not go through”
In a scheme for a thousand hryvnia in another fraudulent organization, they also tried to lure money from me, but using a different method. After I transferred a thousand in the hope of getting 1400, the scammers informed me that, unfortunately, the payment did not go through and was returned to my card. So what needs to be done? That's right, try transferring the funds again. I refused because I understand that the payment would not go through in the future until the card was empty.

As a joke, I drop 2 UAH onto the offered card and inform them that the payment has been credited. To which the scammer shows a screenshot from the drop’s phone, where my transfer of 2 UAH is visible, and calls them yuan.

This suggests that the scam's "call centers" may be based somewhere in Asia. And from the style of writing the messages, it is obvious that this is a machine translation. Sometimes it didn’t work and people received messages in hieroglyphs.

So, is it clear from what budget the drop cards are replenished and, accordingly, where are the bonuses for liking videos then paid from? These small amounts are the result of transferring money from private cards to drop cards and back. That is, this money circulates in Ukraine, creating the illusion of easy profit. But what next? How do scammers withdraw money? In the same telegram there is a whole group of victims of fraud, where I meet several people who fell for the scheme and invested much more money “into nowhere” than I did.

250 thousand

Olga (name changed at the woman’s request) is another mother on maternity leave who agreed to make easy money on the Internet. The scheme is similar. A message from an unknown number on WhatsApp, directions to Telegram, primitive tasks: liking a video on TikTok and making your first easy money.

“Then I was added to the group, there were many participants, about 170, and after each task they wrote “completed.” This inspires confidence,” explains Olga. “After the task was to deposit 500 hryvnia, they returned 650 hryvnia. Then I deposited 700 hryvnia, they returned 850. Then again, likes and smaller payments. Then the task is for 5 thousand hryvnia. I deposited because before that they returned the funds. And after that they said that there was one more round of the order and that 20 thousand hryvnia needed to be paid. This is where I first doubted and started writing private messages to people who were in the group.”

This is Olga's fatal mistake. Only scammers are allowed to comment in the chat, and they keep bragging about their earnings. There are no real people there. Therefore, Olga, in fact, wrote to the employees of that same “call center”. She was not even embarrassed by the strange vocabulary of “employee Alena” (again automatic translation), who assured that the organization was honest and it was possible and even necessary to invest. In addition, the administrators sent Olga “supporting documents” and even photographs of some kind of Ukrainian passport.

“This convinced me, and I decided to pay another 20 thousand hryvnia,” the woman continues, “But after this task, the administrator said that there was one more, final one. Then I will definitely get all my money with my earnings. They told me to deposit another 60 thousand. I said that I don’t have that kind of money. They made “concessions” and promised to pay 40 thousand for me, but I only had to pay 20 thousand. When I transferred them, they began to demand that 40 thousand, explaining that it was a debt. And again they sent some kind of “confirming document” about the legality of their company.”

“I SAW THIS MONEY ON THE FIRM’S WEBSITE IN MY PROFILE”

After paying 40 thousand UAH, more and more new demands appeared. Either to withdraw money you need to buy VIP status for 20 thousand UAH, then before transferring the amount Olga had to pay a tax of almost 40 thousand UAH. Now she was driven by the desire to return the “invested” funds. I even had to take out a bank loan. And all this time she was convinced that the money would be returned.

“I saw this money on the company’s website in my profile,” she explains and shows me screenshots from this site, unfortunately, another fake crypto exchange.

When she paid 150 thousand UAH, all chats suddenly disappeared. But even that didn't stop her. She believed that the money would be returned. And again I wrote to my “employee Lyudmila,” who assured that this was some kind of annoying mistake, and referred Olga to the “main boss.”

“He said that they told him my story,” recalls Olga, “On the website he sees my funds, and only 130 thousand can be returned. But I need to pay another 60. I took out a loan because I wanted to return the funds.”

Noticing Olga’s incredible gullibility, the scammers helped her step by step to register on the real Binance crypto exchange. The woman topped up her account with 60 thousand UAH, bought USDT with it and... transferred the entire amount to the account indicated by the scammers. All screenshots of this operation are at the disposal of the editors.

“It was at 10 pm, the manager said that the finance department was closed and we had to wait until tomorrow. I didn’t sleep all night,” Olga recalls, “And in the morning everything was removed. I wrote again to the girl I was talking to. She said I was stupid and that they were all connected. In total, I lost about 250 thousand hryvnia. My husband and I collected money to buy an apartment.”

SHE SAID THAT I AM STUPID AND THAT THEY ARE ALL CONNECTED

Olga wrote a statement to the police. And she transferred there all the card numbers where she transferred the money, except for the last 60 thousand UAH. And these are transfers for 5, 10, 17, 17, 20, 35, 40 and 60 thousand UAH.

And this is bad news for the drops that received that money. Their accounts are either already blocked or will be blocked in the near future. The money will obviously have to be returned. Although, most likely, they transferred this amount further, leaving only 5% for themselves.

Withdrawal of funds

In the end, in the chat of the victims, I was able to communicate with the person who transferred money through crypto exchanges to the accounts of intermediaries or, possibly, directly to the scammers. This girl agreed to tell her story only on condition of anonymity. Let's call her Sofia. I won’t go into detail on the diagram. Job offer: receive money on a card and transfer it further. 200 UAH were paid immediately, another 500 UAH after registering an account on Binance. And the work began.

“I was transferred amounts of 10 thousand hryvnia daily, I withdrew them to Binance. They gave me step-by-step instructions on how to register there. I kept 500 hryvnia for myself, and bought USDT for the remaining 9,500. And I immediately transferred this money to the account that the scammers indicated to me. I couldn’t think that this was unclean money. If I knew that this was the money of ordinary people...” said Sofia.

On the third day, the girl had both cards blocked, and then she realized that something was wrong. PrivatBank and Monobank received complaints about fraud from people who actually dumped these 10 thousand UAH.

“In this situation, we are just as victims as those who dumped funds, they also did it consciously,” Sofia is sure. “We didn’t know that they were deceiving you.” We also wanted to make money, just like them. I have all the receipts. And screenshots and correspondence. I didn’t take this money for myself, but withdrew it to Binance. I didn’t know that the victims had dropped them on me.”

She says that she even contacted one of them and explained the situation. But will this help and free you from responsibility?

Payback for drops

Let’s conclude our analysis of this phenomenal fraudulent scheme with the story of Sergei, a 35-year-old engineer from Bukovina. The attackers began extorting money from him back in mid-October.

“Like each video cost 50 UAH. Then came the paid tasks,” recalls Sergei. “For 500 hryvnia I received 650.”

Then, after a few hours, he invested 1000, of which he was supposed to receive 1300. They wanted another 2 thousand hryvnia.

That is, I invested 3,000 hryvnia and received 3,900, after which I was added to the “group of privileged participants.”

The next task is to invest 3 thousand hryvnia. I did.

They asked for another 10 thousand, and I invested it again, having previous experience with payments.

But then a new task appeared: to pay an additional 35 thousand hryvnia.

It was scary, but I didn’t want to lose 13 thousand. Because if you don’t quit, you won’t get your previous money back. In the group chat they said that this was not the first time they had done this and that everything would be fine... I gave up.

After payment, the “teacher” says that I am very lucky and there is one more task. And you can’t refuse it - for 75 thousand hryvnia. I thought that I didn’t want to lose the rest. Threw it in.

Then they seemed to have a glitch. “Teacher” wrote that we can return the funds if we become a co-owner of the business, we need to top up the account with 150 thousand. Here I was smart enough to write a statement to the police.”

As of today, Sergei has managed to return a quarter of the amount he transferred. Some of the drops returned the money: some in full, and some partially, apparently fearing criminal liability. And this is the most likely scenario of what other drops can expect if victims of fraud write statements to the police.

“I still receive messages from scammers offering to earn money,” says Sergei, “And I found a way to help people through whom scammers are transferring funds. Every time I ask for a card number, supposedly in order to invest money, and I immediately tell the bank this number so that they block the card before the person gets into trouble.”

Mousetrap

So, all these likes of videos and songs on the Internet are just for the sake of throwing bait at you. I also mistakenly believed that by receiving easy money on the card, I had deceived the scammers. In reality, this is the stolen money of naive people. By receiving them, you become part of the scheme. It’s scary to even think about the scale of the fraud. In just one month, 3 thousand Monobank clients became victims, according to its co-founder mentioned at the beginning of the article.

To uncover the organizers and initiators of this large-scale fraud, the work of the Ukrainian cyber police alone is not enough. The money is clearly being transferred outside the country. An international investigation is needed here.

And within our borders, the victims may be, first of all, the drops - irresponsible participants in the scheme through whom the funds were siphoned. But those who transferred money have a great chance of returning it. Due, unfortunately, to drops. Not scammers.