Chainalysis: Tracking on-chain activity of suspected FTC impersonators

Source: Chainalysis; Compiled by: Tao Zhu, Golden Finance

The U.S. Federal Trade Commission (FTC) recently issued a press release warning consumers to beware of scammers impersonating FTC staff in an attempt to steal money from innocent victims. According to the FTC, these scammers typically fabricate emergency financial scenarios and threaten consumers, and some even refer victims to Bitcoin ATMs. In one case, an FTC impersonator warned a woman that her Social Security number had been compromised and even forged an FTC letter claiming that her account was under investigation, and then stole approximately $2 million from her.

Unfortunately, impersonator scams are on the rise—with losses reported to the FTC in 2023 exceeding $1 billion. While most impersonators operate with fiat currencies, they are increasingly turning to cryptocurrency due to the growing adoption of cryptocurrency by the consumer community. As discussed in our 2024 Crypto Crime Report, we estimate the amount of cryptocurrency stolen by impersonators and tax agency scams in 2023 to be approximately $24 million. For 2024, we estimate the total amount stolen to be closer to $17 million as of April 2024.

In this article, we will examine the suspected FTC impersonator's on-chain activity and explain how we examined the potential size of these scams after obtaining some of the scammers' addresses from victims.

Examining the size of funds stolen by the suspected FTC impersonator

We began our on-chain analysis of this suspicious activity when a victim of the FTC impersonator provided us with the impersonator's crypto address (shown in the top left corner of the image below). After successfully obtaining funds from the victim, the operator of this address made multiple transfers to exchange deposit addresses that likely represented withdrawal points.

Once we identified the exchange deposit addresses, we were able to look at their receiving exposure, which revealed nearly 40 addresses that behaved similarly to the addresses initially reported by victims. Given that these addresses had sent funds to the same four exchange deposit addresses, it is likely that they belonged to the same scam group that shared crypto wallets or worked with the same money launderer. In total, these addresses represent about $1.7 million worth of potential scam activity, suggesting that these losses could be very large, as the real FTC reported.

Another factor we examined was the possibility that these addresses belonged to FTC impersonators or a larger scam group, i.e., they were receiving funds from crypto ATMs, which the real FTC believes is a strategy to attract victims. In the Reactor graph below, we see how another address reported to us as an FTC scammer received funds from multiple crypto ATMs.

FTC Impostors Create Fake “Asset Recovery” Website

Unfortunately, scammers like the above not only approach victims by impersonating organizations, but often deceive victims who have already lost money by creating fake “asset recovery” websites in order to steal more money.

One example is a report we received about a website that appears to be a submission form created by more FTC imposters who encourage victims to report scams. The site's operators may follow up with victims to trick them into paying more money to "recover their original assets." The reported address has received payments from cryptocurrency ATMs and exchanges.

How to protect against crypto-related impersonation scams

As the FTC stated in its press release, it "will never take consumers to a Bitcoin ATM and tell them to buy gold bars, or ask them to withdraw cash and hand it over to someone in person. It will also never contact consumers to ask for money, threaten them with arrest or deportation, or promise prizes." In addition, the FTC implemented the Impersonation Rule on April 1, 2024, outlining the most common impersonation scams and giving the agency more effective tools to stop scammers.

Consumers who encounter this suspicious activity or are scammed can report it to the FTC and other relevant agencies. We hope to help combat these cryptocurrency-related scams by providing law enforcement with the best on-chain data and solutions to investigate and bring scammers to justice.