Scammers are increasingly abandoning primitive letters demanding an urgent money transfer. Modern schemes masquerade as employment abroad, visa assistance, and "profitable investments," and their victims risk not only losing their savings but also finding themselves accused of complicity in a crime. Alexander Brazhnikov, Executive Director of RAKIB, warns about this.
In such stories, cryptocurrency serves merely as a convenient transfer tool. The main threat is the manipulation of people: forged documents, pressure through deadlines, and the desire to believe in a rare opportunity. An independent check of the employer, documents, and tokens allows one to recognize the deception before transferring funds.
How the scheme begins
First, the person is offered an attractive job abroad: a decent salary and official employment, assistance with a visa and a "visa specialist," partial payment of expenses and rapid processing of documents, relocation, and a new life. At the first stage, everything looks convincing — an interview, the employer's website, letters with seals and signatures, photographs of the office, a polite intermediary at every step.
Then a financial condition appears. The victim is told that for the visa it is necessary to confirm the presence of a certain sum for living expenses: the employer has allegedly already transferred most of it, and all that remains is to add the missing amount. Next, they are offered to open an account on a crypto exchange or create a Web3 wallet, receive or see tokens on it, buy cryptocurrency, and send it to the specified address. After that, they are asked to provide a statement and urgently complete the operation before a certain date — this is precisely where the person loses money.
Why people fall into such schemes
Scammers rarely demand a large sum right away: first they build trust and emotional involvement. The first technique is the dream: a job abroad, a high income, relocation, treatment, or access to a "closed" project. When the offer seems like a chance to change one's life, critical thinking weakens.
The second technique is someone else's generosity. The fraudsters remind the victim that the employer has already paid part of the expenses and transferred a large sum, and that all that remains is to add just a little. This creates a sense of obligation: it feels awkward to stop, ask questions, or refuse. The third technique is urgency: documents must be submitted by Friday, the vacancy may be filled, the funds in the wallet will soon burn up, and the exchange rate will change. The haste is needed not because the situation requires it, but so that the person has no time left to verify. The fourth technique is the sunk-cost effect: the more time, money, and emotions have been invested, the harder it is to stop.
Why a crypto wallet does not confirm the presence of money
One of the most dangerous parts of the scheme is the demonstration of a balance in a crypto wallet. The person is shown that their address already holds, for example, 2000 EURC, USDT, USDC, or another well-known token. The sum in euros or dollars is displayed on the screen, and the victim thinks the money is already there.
However, the figures on the screen do not guarantee that the coins can be sold, exchanged, or withdrawn. In blockchain networks, it is technically possible to create a token with virtually any name, including EURC, USDT, USDC, BTC, and ETH. Such a token may look in the wallet like an expensive asset, yet have no connection to the official issuer, possess no liquidity or buyers, not be traded on real platforms, not be exchangeable for real money, and have been created specifically for deception.
The same token name does not mean it is the same asset. Before any operations, one should verify the network and the smart contract address, the official issuer and the published contract addresses, the liquidity and trading pairs, the possibility of real exchange and withdrawal, the transaction history, and the reputation of the service. If a person is shown tokens and at the same time asked to "add a small sum" — this is a serious reason to stop and conduct an independent check.
A fake employer and forged documents
Another common element of the scheme is forged or partially forged documents. They may use real company names and existing addresses, logos of government agencies and templates of visa documents, seals and signatures, tax numbers and registration data of other organizations. A document may look professional, but that does not mean it is genuine. What needs to be checked is not the design of the letter but the facts: whether the employer exists in the state register and whether the name, registration number, and legal address match; who owns the specified tax number; when the company's website was registered and whether its age matches the claimed history of the business; whether the specified employees work for this organization; whether there is a vacancy on the official website; whether the phone, address, and email match the official contacts; whether the sender uses a corporate domain.
Particular attention should be paid to email. The sender's name can be anything: "German Embassy," "Visa Department," "HR Department," or "Legal Service." What matters is the address after the @ sign, where the domain of the mail server with the registered mailbox is indicated. A serious organization has its own domain there, not the domain of a mail server. If a letter allegedly from an official body arrives from an unknown, random, or similar-looking address, the procedure should be stopped immediately.
How one can lose money
Four scenarios of losing funds stand out. The first is a direct transfer: the person buys cryptocurrency and sends it to the address of a "visa specialist," "employer," or "investment consultant." After that, contact ceases, or the scammers put forward new demands: pay a tax, an insurance deposit, or a commission, confirm the origin of the money, unlock the wallet, or undergo "verification."
The second scenario — the wallet shows a large sum in a fake token with a well-known name, but it is impossible to withdraw or sell it. The victim is persuaded to pay a commission, gas, confirmation, insurance, or "unlocking." As a result, real money goes to the scammers, and the fake token remains in the wallet as a useless figure.
The third — the most dangerous — is involvement in the transit of other people's funds, when the person is asked to open a bank account and accept a transfer, buy cryptocurrency and send it to another address, use P2P exchange, run money through several banks, or provide their exchange account. Thus the victim becomes an intermediate link in the movement of money belonging to other victims and risks account blocking, bank investigations, and accusations of complicity in a crime.
The fourth scenario is repeated extraction: after the first transfer, the scammers report that the operation is stuck, the exchange requires a commission, or the bank is not letting the payment through, and each new transfer is called "the last step."
How not to become a victim of scammers
If a person is being rushed — this is a reason not to act faster but to check more thoroughly. A genuine employer, bank, embassy, or visa center will not prevent one from studying documents or consulting a lawyer. One should independently find the organization's official website, call the number listed there, or write to the official email, rather than use the intermediary's contacts.
One must not transfer cryptocurrency for the sake of a visa, a job, or "unlocking." Especially dangerous are requests to confirm financial solvency through an unknown wallet, to add a missing sum to an already displayed balance, to pay a tax or a withdrawal commission, as well as to buy cryptocurrency according to a third party's instructions and send it to an address from a messenger.
One should not agree to receive money on a card, buy cryptocurrency with it, and transfer it onward, even if payment or a percentage is promised for this. If the bank has stopped an operation, one should not look for another bank, a relative's card, a P2P service, or an exchanger: the block may be a signal of fraud risk. It is better to contact the bank and honestly explain that the operation was carried out according to a third party's instructions.
If an unfamiliar token has appeared in the wallet, one should not trust its name or follow links from its description. One must not connect the wallet to unknown sites, sign incomprehensible transactions, enter the seed phrase, hand over the private key, or pay an "unlocking commission."
If the money has already been transferred
There is no need to delete the correspondence or be embarrassed to seek help. One should preserve the correspondence, voice messages and emails, phone numbers and links to websites, documents, bank receipts and screenshots, crypto wallet addresses and transaction hashes, data of senders and recipients, and information about exchange accounts. After that — contact one's bank, the crypto exchange's support, law enforcement agencies, and also a lawyer or a specialist in digital financial risks. The faster the information can be recorded, the higher the probability of limiting the further movement of funds and gathering evidence.
Cryptocurrency in itself is not a sign of fraud. But if it is proposed to be used for urgent visa processing, obtaining a job, unlocking money, confirming financial solvency, or transferring according to a stranger's instructions — this is a serious danger signal. The real threat often does not look like cryptocurrency at all, but like an official letter, a foreign employer, a caring intermediary, a beautiful website, or a document with a seal and a deadline of Friday.
Cryptalist analysis: The scheme demonstrates the shift of social engineering from direct phishing to multi-stage scenarios involving the victim in the transit of funds — this raises not only financial but also legal risks for users. The key technical vector is the substitution of contract addresses and the use of look-alike tokens, which makes visual verification of the wallet balance fundamentally unreliable. For the market, this is a signal of the need to strengthen educational and compliance practices: verification of the issuer and the smart contract should become a basic standard for any operations related to employment and cross-border transfers.