Discord is a social media that’s best described as Slack for entertainment. It gained popularity in the gaming community with its ability to stream, video chat, and organize channels based on interests. After the gamers, other groups started to frequent this social media, creating open and invite-only communities. While some people organize to share cooking recipes, others use Discord as a communication channel for criminal activity, extremism, and radicalizing youth.

There are many examples of how Discord was used for nefarious purposes. Documents were leaked from the Pentagon related to the Russia-Ukraine war, white supremacists used it to organize protests in 2017, QAnon misinformation was spread widely, and the Capitol insurrection was organized on social media platforms in 2021.

Discord has a lot of value for investigations and intelligence gathering. It’s good for researching users and public servers, finding a history of communication, and observing trends. The easiest way to look into this information is to use OSINT tools.

Some of the tools require a user ID or a server ID. To get them, we need to switch our Discord account to Developer Mode. It can be done in User Settings, by scrolling to Advanced and switching a toggle of the Developer Mode. After that, a right-click on any user or server would show an ID.

User Search Tools

Each server has a member list visible on the right-side pane. It includes a hierarchy of server members and basic information about their profiles. Discord has embedded search by a user so it’s possible to see their commenting and posting activity in one place.

Additional Tools:

• User Search:  searchable Discord profiles

• Discord Lookup: any ID lookup

• Top.GG: a link https://top.gg/user/USER ID leads to profile information

Server Search

 A list of databases with different servers divided by categories:

• Disboard

• DiscordMe

• Discord Servers

• Discords

• Discord Lookup

• DiscordBee

• Disforge

• Server List

• Top GG (bot search)

Another way to find a server is to try different combinations of server names and put them in a link discord.gg/community name, and search for it in Google or on other social media.

Other Tools

• Discord History Tracker: a service that allows tracking and saving changes on servers, groups, and conversations. The tool is also available in the desktop application version.

• Unfurl: a service that helps to find the time when a Discord server (or any other link) was created

• Pixelatomy: another service that helps to identify when a server was established using a server ID

Interesting Reads This Week:

• Americans lost over $1 million last year falling for online puppy adoption scams

• An old SEO scam has a new AI-generated face

• Don’t let solar eclipse burn your cash: BBB scam warning

Telegram, like many other messaging platforms, has been known to be used by criminals for various illicit activities, including the sale of illegal goods. While Telegram itself is not inherently designed for criminal activity, its encrypted messaging features and relative anonymity can make it appealing to criminals.

Some Darknet communities migrated to Telegram in the past years. Certain channels or groups within the app facilitate a wide range of illegal activities from selling goods like drugs or fake documents to spreading pornography, extremist propaganda, hiring money mules, and finding scam victims. These channels often operate in the shadows, hidden from public view, and may require invitations to join.  

Others are open to join for everyone and are easily searchable by keywords. Compared to Darknet, with access through VPNs, special browsers, constantly changing links, and an unstable and slow connection, using Telegram is extremely easy.

The app has 900 million monthly active users and it’s growing rapidly. Telegram is known for its enhanced privacy and anonymity. To create an account, you just need a phone number and it can be a virtual number or a burner, not connected to any identity. The privacy settings allow users to hide almost all information about them and there is no verification involved.

Encryption makes it safe from government or law enforcement oversight. Even data on devices can be wiped out remotely so it’s very hard to access information for evidence collection. Even if law enforcement can come up with subpoenas, the only available user information, is a name, phone number, and IPs.

Some usernames can be bought and sold between users. Telegram bot and automation capabilities serve perfectly for marketplace purposes. Buyers can buy goods with one click and get delivered digital products instantly. All of these conditions created a perfect criminal underground ecosystem.  

Telegram doesn’t monitor chats or private groups and they do not process any takedown requests related to them. They promise to remove illegal content from public channels and groups by request but it’s unclear how proactively they monitor for violations. Telegram pledged to remove all terrorism-related groups and chats, but they are still available.

The list of investigations against illegal activity on Telegram is growing. The app was removed from the App Store for not taking action to curb the spread of child pornography in 2018. The Brazilian Supreme Court forced the app to remove disinformation posts under the threat of suspension in the country, and the Central Narcotics Bureau of Singapore arrested more than 500 Telegram drug dealers in the last few years.

Considering the sheer number of channels, groups, chats, bots, keywords to survey, and users to listen to, it’s impossible to monitor Telegram manually. Different channels can have the same bot posting and reposting the same messages, creating ever-present noise that needs to be filtered through. Many companies promise to provide comprehensive Telegram monitoring, but it seems that intelligence-gathering efforts are still lagging.

Interesting Reads This Week:

• Refund fraud schemes promoted on TikTok, Telegram are costing Amazon and other retailers billions of dollars

• Pluralistic: How I got scammed

• Big Tech Ditched Trust and Safety. Now Startups Are Selling It Back As a Service

The Federal Trade Commission (FTC) released its annual fraud statistics for the last year and the numbers are shocking. The fraud losses increased 14 percent compared to 2022 and hit the new benchmark of $10 billion.

Altogether, more than 2.5 million fraud reports were recorded by the FTC last year. We know that a lot of scams go unreported so the real number might be significantly higher. The median money loss in scams was $500 and in more than 98 thousand cases victims lost more than $10,000.

24 percent of victims were contacted over email, with the other 20 percent who was scammed over phone calls. The majority of fraud initiated over emails was business imposters, and phone calls are the most popular among government imposters.

The most amount of money lost

• Investment scams took the first place among other types of fraud with $4.6 billion in total losses, and most of the victims were contacted on social media. The FTC doesn’t have a special category for pig butchering, but this trend seems to be included in this category.

• Imposter scams are the second in the loss category. Victims lost $2.5 billion and the majority of them were contacted via email.

• Job scams took third place with $490.7 million in losses and with email as a contact method.

The most prevalent scams

• Imposter scams were reported to the FTC 853,935 times in 2023. This category is broad, and includes IRS scams, romance scams, fake charities, fake computer support, and grandparent scams.

• Online shopping scams and negative reviews had 368,379 reports. The most prevalent scam here is non-delivery, but the category also includes failure to deliver on time, undisclosed costs, and refusal to provide refunds.

• Fake prizes, sweepstakes, and lotteries were reported 157,520 times. This category includes all types of contests where people have to pay something upfront.

More fraud categories with a number of total reports and losses are shown below:

Victims of 30-39 years old provided 18 percent of reports with $840 million in losses, followed by the 60-69 age category with another 18 percent of reports and $980 million lost.

The FTC doesn’t provide any statistics about using AI in scams, but we should expect it to become a new reporting category in the next few years.

Interesting Reads This Week:

• Walmart Bought a Finance App and Reduced Fraud Protections. Guess What Happened Next?

• How Fraudsters Break Into Social Security Accounts and Steal Benefits

• The Day I Put $50,000 in a Shoe Box and Handed It to a Stranger

Our favorite time of the year has come and the Internal Revenue Service (IRS) is breathing down our necks. It’s also a perfect time for fraudsters to steal our sweet tax refunds. In 2023, the IRS investigated 87,591 fraud cases with $1.2 billion in fraudulent refunds and flagged 2.4 million tax returns worth $13.8 billion for suspicion of identity theft.

The majority of IRS scams start with someone impersonating an IRS agent and demanding to provide money or information. Fraudsters also urge victims to act immediately out of fear of punishment or losing money. Here are a few examples of IRS scams that are most common in 2024.

 Six Most Common IRS Scams and Their Telltale Signs

1. Unclaimed Refunds

Victims receive letters or emails from “IRS” reporting that they have an unclaimed refund or they need to recalculate the tax payment amount. To receive the refund, they must upload their IDs, and provide personal information, and bank credentials. The stolen data will be sold or used in identity fraud, claimed tax refunds, and other crimes. In another variation, the provided link will contain malware and will be used to steal the victim’s money.

2. Charity Fraud

Fake charities and non-profits often promise that donations can be claimed as deductions on donors’ tax returns to make people more generous. Money gets stolen, and the victims may be penalized for providing wrong information to the IRS.

3. IRS Money Demands

Victims receive phone calls from fake IRS agents notifying them about taxes or fees that they owe. They urge victims to pay immediately to avoid punishment. The fraudsters’ signature move is hostility, they may threaten with police, prison time, or deportation. Some of them may claim that a victim’s tax refund was sent by mistake and demand to send money back immediately.

4. Dirty Accountants

Fraudsters file taxes for other people using fake tax credits and redirect victims’ refunds to their accounts. A big case with hundreds of victims happened in Iowa in 2018-2022. The fraudsters targeted immigrants who worked in local meat-packing facilities, spoke little English, and didn’t know what a tax return was.  The fraudsters took fees from their customers, increased refunds by claiming fake tax credits, and redirected partial or full refunds to the accounts. They filed 1,600 tax declarations and stole $100,000 in unemployment benefits that were claimed without victims’ knowledge.

Ghost tax preparers pretend to file declarations, and collect fees, and victims are left with penalties from the IRS for not providing tax information on time. The U.S. Department of Justice keeps a list of prosecuted tax preparers and advises to check it before filing taxes with a new accountant.

5. Employee Retention Credit Scam

The Employee Retention Credit is a tax break established during the pandemic to help struggling businesses. Fraudsters encourage business owners to apply for the tax credit even if these organizations don’t qualify and charge them exorbitant fees for help with the applications. They often claim that it’s a very fast and easy process and urge victims to file as soon as possible to meet the deadline.

6. Stolen Identity/Documents Cancellations

Victims receive calls from fake IRS agents who claim that their identities were stolen or that their Social Security Numbers or IDs were suspended for unpaid taxes. To remedy this, victims have to provide money, and because their identity is stolen, they can’t use traditional banking methods and have to buy gift cards or prepaid bank cards. They give the card numbers to the scammers and never hear from them again.

 If you are a victim of the IRS scams, you need to contact the Treasury Inspector General for Tax Administration and the Federal Trade Commission to report the crime.

Interesting Reads This Week:

• Loophole allows man to live free in New York hotel for 5 years, then he claimed to own the building

• What Amazon, the F.T.C. and C.I.A. Won’t Say When You’ve Been Scammed

• U.S. adults lost a record $10 billion to fraud in 2023

Recording conversations is a common practice in our personal and professional lives, particularly for investigators. However, the legality of such recordings can be murky, especially when intended for use in legal proceedings. According to U.S. federal law, at least one participant must know the conversation is being recorded. Yet, individual state laws introduce specific nuances that investigators must navigate to ensure compliance.

Two main types of state laws governing consent exist. You can live in a state where it’s mandatory to notify all parties of the conversation or just one, which is usually the initiator of the recording. If the initiator is not present, which can happen in the case of a listening and recording device, consent still needs to be obtained (unless there is an exception from a state that allows recording in public settings or to collect evidence of a crime). This notification can be delivered verbally, in writing, or through audible beep tones during the call.

State law exceptions can affect how consent needs to be obtained. Nine states require to notify all parties of the conversation without exceptions – California, Florida, Maryland, Montana, New Hampshire, Pennsylvania, Washington, Massachusetts, and Illinois. Michigan will require two-party consent if the recording person isn’t a part of the conversation. South Dakota has a similar requirement but allows one participant’s consent.

Some states have conditional recording laws. Connecticut and Nevada require all parties to be notified in electronic recordings, but in-person conversations allow only one-party consent. Oregon requires one-party consent for electronic communication and two-party consent for in-person recordings.

Hawaii requires one-party consent unless the recording happens in a private place. Rhode Island doesn’t require consent when privacy is not expected. Vermont doesn’t have a special law so it’s considered a one-party state.

Interstate communication has requirements too. For example, if you call from a one-party state to someone in California, which is a two-party state, you have to comply with the laws of California. Other states apply the law of the physical location of the recording device. A general recommendation for interstate communication is to receive consent from everyone participating in the recording.

Breaking a recording law can be considered a misdemeanor in some states or a felony in others. Violators can also become subjects of civil liability. Recordings made with a violation of law are also inadmissible in a court, so investigators need to get legal advice before engaging in the act.

Interesting Reads This Week:

• Deepfake Digital Identity Fraud Surges Tenfold

• Tech companies to sign agreement with UK government to tackle online fraud

• India fights back against soaring digital fraud

A curated list of five riveting shows centered around fraud and scams that are perfect for Thanksgiving weekend binge-watch sessions. Thrilling crime dramas and insightful documentaries offer a unique perspective on the world of deception and investigative success.

The Dropout (Hulu)

The drama miniseries is based on the story of Theranos, a start-up that promised to revolutionize blood testing but ended up defrauding doctors and patients. Theranos was valued at $9 billion at the peak. Elizabeth Holmes and Sunny Balwani, the leaders of the company, were both charged with fraud and got prison terms.

Inventing Anna (Netflix)

A story of a fraudster, Anna Delvey, who pretended to be a wealthy heiress and defrauded companies and people for $300,000. She had access to the upper-class lifestyle and art scene in New York and Europe. Delvey ended up in prison but her story inspired books, TV shows, and movies.

FYRE: The Greatest Party That Never Happened (Netflix)

Fyre Festival was a luxury music event that was supposed to take place in the Bahamas and was promoted by music stars and influencers. The festival gathered 5,000 people but was an utter failure and was canceled. The organizer of the festival, Billy McFarland, went to prison for fraud. McFarland is promoting a new Fyre Festival II now.

The Tinder Swindler (Netflix)

A documentary film about Simon Leviev, who used Tinder to search for victims, pretended to be a wealthy man, and stole $10 million from women across the world. After showering his victims with gifts and attention, private jets, and expensive hotels, he would tell them stories of powerful enemies and would ask for help pretending that his life was in danger. He went to prison in Finland but was released 15 months later due to the pandemic.

Dirty Money (Netflix)

Six stories of corporate and government financial crimes, fraud, and corruption. The episodes uncover scandals in Wells Fargo, illegal activities of the Prime Minister of Malaysia, Jared Kushner’s story, gold mining crimes, elderly abuse, and plastics plant corruption.

Interesting Reads This Week:

• What is Binance, why is it in so much trouble, and what does it mean for crypto?

• Why 'Following the Money' Isn't Enough to Stop Organized Crime Anymore

• AMC's CEO thought he was texting naughty photos to a former ballerina fling. Then everything went haywire.

An investigator from a new financial start-up shared a story with me a few years ago. Their marketing team was trying to get more new customers and announced a campaign where every new client who opened an account would get a $20 credit. As usual, the marketing team didn’t talk to the risk team and didn’t consider potential abuse issues. In a matter of days, they got hit with thousands of new sign-ups, after which new clients moved money out of the accounts immediately. The business learned what is promo fraud in a very efficient way.

Another way for customers to take advantage of the business is chargeback fraud. Some chargebacks are not malicious with customers committing “friendly” fraud, and disputing legitimate transactions, and others are examples of suspicious behavior with account takeovers and stolen identities. The difference is important for decision-making on how to prevent these types of fraud.

Friendly Fraud

A legitimate transaction dispute for a bad reason is called friendly fraud. A client doesn’t like an item bought, can’t recognize a charge, or deals with bad customer experience and cancels the charge. It happens on the bank level and merchants have no way to prevent it.

A company looks at the customer’s account and sees no suspicious patterns – no email/password updates, new IPs, or any other changes. There is no way to predict this behavior and it’s either accepting the loss or suspending the client’s account after multiple instances of abuse. Friendly fraud usually represents a majority of chargebacks that merchants have to deal with. Some investigators define friendly fraud as any chargebacks from known customers, whether intentional or by mistake.

Real Fraud

Real chargeback fraud happens when a charge was made by someone else who accessed the client’s account and now it’s disputed. The most common situation is account takeover. Investigators can see unusual changes in the customer’s behavior such as new names, emails, and passwords, changes to two-factor authentication, a new phone number on file, unusual IPs, especially from locations known for fraud rings, and mismatches between billing and shipping addresses. Unusually big or repeated small purchases are also good candidates for future chargebacks.

Fraud prevention in this case is usually rule-based and can range from manual reviews to automatic account suspension, additional identity verification, and a blacklist for repeated offenders. Credit card verification is needed for cases with stolen cards to help stop fraudulent transactions before they happen in the first place. In the case of account takeovers accessing the account, a customer is usually a victim.

Promo Deals Abuse

Promotion fraud happens when people take advantage of promo codes, signup bonuses, referrals, discounts, coupons, or any other marketing tools. Social media and forums are filled with groups and discussions about how to get maximum from promo deals, circumvent, and exploit the system. One of the most prominent examples was a 4.5 million account bot farm that took advantage of PayPal’s sign-up rewards last year which led to a massive share price drop.

Promo deal abuse is often a variation of friendly fraud when customers find a way to bend the rules. The best way to deal with promo fraud is to manage customers' behavior, for example, by putting restrictions on multiple accounts on one device or monitoring the code redemption activity.

Interesting Reads This Week:

• Financial Fraudsters Have Escaped Justice for Far Too Long

• How the sneaky CEO Apple gift card scam almost got me

• Crushing fraud in the U.K.

Halloween is coming and it’s time to visit graves and cemeteries! Grave search is usually a part of genealogy research but can be useful in some traditional investigative cases as well. The work to digitize burials and death records is usually done by volunteers and the information is mostly free.

Many online search websites for gravesites and burials can point to a specific location. Most search engines require a name, years of life and a cemetery where a person was buried. Some services show family connections to other burials. Also, pictures of tombstones are a great way to find family connections, especially if they are located next to each other.

Sometimes, the information is not available online and it requires a visit to a cemetery that might have its records. If the place is small, county records, local churches, funeral homes, or local historical societies can be a great source of data. Death records can be available for free, but some clerk’s offices will require a fee to access certificates or apply family-based restrictions.

Because most of the cemetery genealogy research is done by volunteers, investigators need to check multiple websites and do fieldwork in some cases to get a full picture.

Grave Search

• Find a Grave – one of the biggest databases, both graves and cemeteries

• Billion Graves – another big database, that includes GPS coordinates

• Interment – both graves and cemeteries

• Family Search

• Ancestry

• Index of Burials

• U.S. Veterans Gravesites

• CemeteryFind

• Military Grave Locator

• Histopolis

• Forgotten Ashes

Cemetery Search

• Military Cemeteries

• Ancestry

• Names In Stone

• Histopolis

Obituaries Search

• Genealogy Bank

• Google Newspaper Archive

• Online Obituaries Index

Death Records Search

• Ancestry

• Archives

• Historical Death Records

• Cemetery Records

• State guides for finding death records

Interesting Reads This Week:

• The secret life of Jimmy Zhong, who stole – and lost – more than $3 billion

• New York Attorney General Sues Crypto Firms in $1 Billion Fraud Case

• The Fake Browser Update Scam Gets a Makeover

High-profile disasters create a wave of criminals taking advantage of people who want to help victims. Charity scams proliferate on social media and crowdfunding sites, and fraudsters use emails, calls, or home visits to get what they want. After the beginning of the Russia-Ukraine war, social media removed hundreds of charities that were created days after the beginning of the conflict and took donations in cryptocurrencies and NFTs.

Right now, Facebook is filled with new pages that ask for donations for victims of the Israel/HAMAS conflict. They have three followers and provide links for direct donations to shady websites. I just saw this post on LinkedIn about new suspicious domains registered to help victims of the war.

Fake charities made the news last year when the New York Times uncovered that the IRS approved 76 fake charities that shared the same address and were responsible for $152,000 in victims’ losses.

How to Spot a Fake Charity

• The social media page, profile, or website is new, empty, doesn’t look professional, doesn’t have enough followers, or possibly impersonates a more famous and reputable organization.

• There is no contact information, no address or website, or links are broken and the address is not real.

• The campaign encourages to donate immediately or someone might die or get hurt, and they use a lot of emotions in their pleas for help.

• The requested donation is in cryptocurrency, gift cards, cash, or wires.

• Google search doesn’t bring enough information about the charity, or celebrities, whose images were used, and never endorsed the cause.

• A reverse image search on photos provided in campaigns shows that they were used somewhere else.

• There is no information about how the money will be used or an explanation of why.

• Not tax-deductible donations to charities might be a red flag in some situations.

• People promised gifts, giveaway winnings, or something else in return for the donations.

• The campaign promises that 100% of donations will go to the victims, which is not how legitimate charities work.

Report fake charities

• Federal Trade Commission

• Federal Bureau of Investigations

• Internet Crime Complaint Center

• National Center for Disaster Fraud  

Check if a charity is real

• Better Business Bureau

• IRS Website

• Charity Navigator

• Charity Watch

Interesting Reads This Week:

• Ghost in the Machine: How Fake Parts Infiltrated Airline Fleets

• Online daters warned of fraudsters posting fake celebrity profiles

• 43 freed from phone scam syndicate in Peru were young people who arrived week earlier

A search for documents in Google can bring fascinating results. Many uploaded PDFs and other documents have non-indexed content or content that is very deep in the search results. Searching directly for specific types of files can help to remove noise and find very private information. For example, in 2018, a researcher was running a search on Google and found that the United Nations accidentally exposed passwords and internal documents by uploading them to public services.

There are special Google commands that can help investigators see the exact information that they are looking for.

Filetype Command

The filetype command can show specific files in combinations of keywords. For example, filetype:pdf Linkedin can bring presentations, resume examples, and metrics for job seekers. The filetype command will work with any file - PDF, DOC, DOCX, XLS, XLSX, TXT, PPT, PPTX, and others, and can be used to search for multiple files in a command like filetype:pdf OR filetype:xls linkedin. The commands work in most of the browsers.

To help with noise, it’s a good idea to use quotes around the keyword (“linkedin”) to avoid phrases that include it and other similar words, and the minus sign (-linkedin) to exclude a specific keyword or mix both quotes and the minus signs to exclude a full sentence -“linkedin news”.

Site Command

A great solution for websites that don’t have a search function on them is to use the site command. For example site:linkedin.com keyword. It also works with the filetype command, if you need to find downloadable files from a specific website. There is also a way to use this command to remove a specific website from the search with the minus sign -site:linkedin.com.

Interesting Reads This Week:

• We 'made' £3,000 on a Facebook Marketplace scam in just 24 hours

• Sam Bankman-Fried "directed me" to commit fraud, former FTX executive Caroline Ellison says

• ‘Top’ ransomware gangs favour smaller businesses

Every day I have suspicious accounts that try to befriend me on LinkedIn and other social media. Some have AI-generated images or gender mismatches, others are half-empty and have name patterns with other users who tried to become my friends yesterday. And some of them are well-aged accounts with following and posts.

They are all sock puppets or bots, and they are created to gather information or be involved in illicit activities. This activity goes against the Terms of Service of pretty much every website, but it’s almost impossible to stop.

To recognize a sock puppet or any fake account, investigators need to know how they were created in the first place.

Persona generators

Generators create fake profiles with a wide variety of information. You can get bad actors a name, birthday, address, physical description, SSN, mother’s maiden name, phone number, email, examples of usernames/passwords, card numbers, employment history, car license plate, and something fun, like their favorite colors or an astrology sign. All of this information is random, it’s not a real person in any way possible. The addresses, SSNs, and card numbers are also random combinations of letters and digits.

Generators can create profiles for different genders, ethnicities, and countries. Examples of profile generators are Fake Name Generator, Elfqrin, and DataFake Generator. Chat CPT is another way to create a persona, and you can always add a fake resume from This Resume Doesn’t Exist.

Images

Many free services provide AI-generated pictures that are often used for profiles. I wrote a blog post on how to recognize an AI-generated photo with examples of images used in real scam cases. The telltale signs are usually face asymmetry and background issues. These pictures generally have become more recognizable, so many other services were invented to avoid it. Examples of image generators are This Person Doesn’t Exist, Morph Thing, and Generated Photos.  It’s always a good idea to run an image through a reverse search because it might be taken from a real person or stock photo websites.

Account Age

Account aging is a process of creating an account and posting, commenting, and liking for some time to avoid suspicion. Aged accounts are a commodity, especially for Facebook and Instagram, whose prices usually start from $2. Social media often flag accounts created in the last 30 days and remove restrictions after that period. They also want to see a familiar IP pattern and other normal user behavior.

There is an interesting idea from a service Have I Been Pwned saying that if an email has never been found in any security breach, it was probably used in an account created to game the system and it was never a part of a normal internet activity. Almost all my emails were found in some breaches, so I guess I am a real person.

Anonymity

Burners, or prepaid phones, are available in almost every tech store, as well as virtual credit cards, prepaid cards, or gift cards that protect anonymity. Using burners, VoIP phone numbers, encrypted emails, VPNs, public Wi-Fi, and cryptocurrency can provide a lot of privacy and make a believable and almost untraceable person.

Humans Behind Puppets

Creators of sock puppets hide their IPs and use clean emails and phone numbers. But they are still people and they can make mistakes by using their birthdays, partial names, or hobbies and interests. They also might be posting during their awake time and not when their sock puppet is supposed to be active. Or they might be bots and, in this case, they post at the same every day.

As a disclaimer, there is a need for legitimate investigators to create sock puppets to avoid recognition and keep privacy and anonymity levels high. Social media can recommend accounts based on the activity of their users, IPs can be traced, and the use of real phone numbers and emails can lead to bad consequences. It’s illegal to impersonate a government employee, including a law enforcement officer, in the U.S. but it’s not illegal to have fake online personas for open-source intelligence.

Interesting Reads This Week:

• Gen Z falls for online scams more than their boomer grandparents do

• A $12 Million Request to Cover a Crypto Scam Sank a Bank CEO

• ChatGPT AI voice cloning, plus fake income-tax refund scam

I moved to the U.S. many years ago and it took me a long time to improve my English and find a job. While I was doing that, I decided to find a short-term side hustle just to be occupied and make some money. I always enjoyed teaching and I had experience teaching the Russian language so I decided to join a few tutoring websites. New York had a huge community of immigrants who spoke Russian and I was curious if someone would be interested in the culture and connection.

After a few weeks, I got a request from a woman who wanted to hire a tutor for her son. He had a father in Russia and needed to speak a better language to spend his first summer there. The request was in English and had grammatical mistakes that I would expect from a foreigner. Considering, that the family was supposed to be Russian, it didn’t raise any suspicions. I was very excited to finally start working so I agreed to help her son to learn something new and talk about the cultural experience.

She told me that she was on a business trip and their nanny would bring her son for lessons. After chatting with her for some time, and developing a connection, she asked me to do her a favor. She told me that she was going to send me a check with money for my first lessons, but she would add money for the nanny and she needed me to send it to them.

Checks are curious and very old-fashioned money vehicles. They are almost non-existent in other countries due to mistakes and fraud, but in the U.S., you need them regularly. It’s not convenient, it’s expensive, and customers are not protected from check fraud, but it’s a traditional and accepted payment method.

As a new immigrant, I had never seen a check before, and I assumed they worked as bank transfers. I received a check from the mother and deposited it into my bank account in Bank of America. Money became available almost immediately, although the transaction was still pending. Seeing the balance grow made me feel safe enough, and the mother was urging me to send the leftover money to the nanny immediately. I wanted to prove that I could be trusted and I didn’t want to keep money that belonged to someone else, so I was happy to send them.

The mother gave me detailed instructions on how to send a wire from Wells Fargo. The nanny’s name was an unexpected male African name but who am I to judge. I sent the money from a bank branch, the cashier didn’t ask any questions, and I felt good about being efficient and that someone trusted me.

By this time, it had been almost two weeks and I still hadn’t met the boy that I was supposed to be tutoring, and I started to feel weird about this. I googled the situation and found out that I might be a victim of a job scam. I called Bank of America immediately and they told me that nothing could be done. My checking balance was depleted the next day after I sent the wire, the check was obviously fraudulent. Wells Fargo said that they couldn’t stop the wire and they couldn’t give me any information about their client.

I felt ashamed and stupid, and only after reading about signs of fraud online, I recognized them in my circumstances. Still reeling from what happened, I decided to visit a local police precinct. The police officer laughed at me first, then told me that there was no crime because I gave money to the fraudster myself. I left the precinct determined to never talk to law enforcement officers ever again in my life. I reported the scam to many places online, including the Postal Inspection Service, but no one ever replied to me.

This intense shame and the feeling that no one could help me stayed with me for many years. It fueled my decision to move my career from anti-corruption and compliance investigations to financial crimes and fraud prevention and to become a certified fraud examiner.

When I look back at what happened, I ask myself why banks allow money to become available immediately, why they accept obviously fraudulent checks, and why it takes two to five days for them to recognize that a check is fraudulent. Considering that 680,000 cases of check fraud were reported to the Financial Crimes Enforcement Network last year, it seems that the problem has been ignored for a long time.

Interesting Reads This Week:

• You’ve Got (Scam) Mail. Is everyone being swindled all the time and just not talking about it?

• City Hall clerk has been paid more than a half million dollars not to work

• The seven lives of the £2m fraudster

Wallets like PayPal, Cash App, Zelle, and Venmo are easy to register, use, and research. While these platforms offer convenience, they can also be used for illicit activities, making them a prime focus for investigators who can find additional information or hidden assets with just a phone number or an email. Many people use their full names and real contact information because no one wants to lose their money by being sent to the wrong account.

A general recommendation for any phone app investigations is to add a person in question to the phone’s contact list. Many apps will prompt to sync contacts and will show if this person already has an account with them.

Venmo

Venmo is one of the most popular payment services with a huge privacy issue – everyone can see the user’s payment feed unless they make it private.

To find a person or a business on Venmo, investigators need a name or a username. After finding a person, it’s possible to see their feed with the names of senders and receivers, keywords, and emojis. Friend lists are available to check and it’s a great way to uncover associates and see their transaction history. Searching for a business makes it possible to find a phone number, email, address, or messaging app. I just searched the word “weed” on Venmo and found many sellers with their contact information available.

PayPal

PayPal has a built-in search for other PayPal account owners. When you send or request money the search will allow to find users via names, usernames, emails, or phone numbers. The account info usually contains a name, username, and photo.

There is also a way to find additional information without having a PayPal account. If an email of the person in question is known, it can be put into the “Forget Password” window, and it will show a partial phone number with an area code and five digits that can be googled.

Cash App

Cash App has the highest privacy out of all payment apps, with known fake accounts allowed on the platform. It’s enough to pay someone just by knowing their username or a “cashtag”, which usually looks like a link https://cash.app/$username. As any username, it can be searched on other platforms. The other way to find people on Cash App is through a phone number.

Zelle

The service doesn’t have a lot of open-source information but allows a user to search by checking a name, email, or U.S. phone number.

Username Search

It's always a good practice to check if the same usernames were used on other social media through Google in quotes or special username checks like below:

• UserSeach

• WhatsMyName

• Nameckecr

• Namecheckup

• Namechk

• InstantUserName

• CheckUserNames

• Knowem

Interesting Reads This Week:

• Mark Cuban Latest Victim of Nearly $1 million Phishing Scam: Here’s How they Drained his Wallet

• How AI is supercharging financial fraud and making it harder to spot

• A convicted fraudster was put in charge of California parolees, then he fraudulently used their identities in a $1 million COVID benefit scheme

Many times, an investigation would lead me to the Dark Web. Sometimes it’s to dive into forums and gather intelligence, and other times it would be to check illegal goods markets selling counterfeit products of my clients. Every time I mention that I use the Dark Web, people imagine a really scary place with criminals selling their goods right and left and that people can suffer dire consequences even for trying to open websites there. Other people ask if it’s even legal to access it. It’s not illegal, and the right precautions and tools make it a safe enough place and a source of abundant information not searchable through traditional means.

Investigators need a list of tools to start the process of understanding and using the darknet.

Step 1. Get the Tor Browser

The Tor Browser provides access to .onion websites and is pretty good for browsing anonymously. The browser usually opens with the DuckDuckGo search engine which adds an additional layer of protection. It behaves as a regular browser and all surface websites can be open as well. The downside is that Tor is painfully slow.

Step 2. Install a Virtual Private Network (VPN)

VPNs mask users’ IP addresses and add more anonymity. There are many free VPNs, but they limit the number of countries that can be used to hide IPs. They are easy to use and can be activated with a one-click button. Browsers also have VPN extensions. VPNs still can log data so their use doesn’t make users completely anonymous (for example, Onavo Project, a free VPN, was collecting user data and giving it to Meta, both companies were sued and had to pay $10 million each). Using them also can slow down the browsing process significantly.

Step 3. Find a list of websites to visit

There is no one centralized place to find all Dark Web websites but many directories try to keep their databases updated. Hidden Wiki, OnionLinks are popular darknet directories (links to be opened in Tor). Investigators can also use dark web search engines like Ahmia or Haystack (to be opened in TOR). Many databases haven’t been updated for some time, and new Dark Web sites appear and disappear every day, so aggregators’ data needs to be re-checked.

If a website doesn’t open today, it still might work tomorrow. There is a service to check if the most popular darknet websites are down and find new links when the old ones don’t work.

Forums and chats are also great places to find information about the subject. Marketplaces are useful as well, but they contain mostly illegal content.

There is also Hunchly, a service I wrote about in my previous post, that provides a free daily dark report with new websites collected in a spreadsheet.

Things to keep in mind

Anonymity is incredibly important on the Dark Web. Using Tor and VPNs doesn’t make it 100% safe. It’s always a good idea to back up your computer data and check for malware and viruses on a regular basis. Some investigators use virtual machines or clean computers just for the Dark Web. Users should never share any information that can unveil their identity including email addresses, usernames, photos, and other easily searchable information.

Any data extracted from the darknet can be used in an investigation only after cross-checking and source verification. Criminals, hackers, law enforcement, and tyrannical governments can be all in one space and share fake information.

Interesting Reads This Week:

• Swedish criminal gangs using fake Spotify streams to launder money

• We 'made' £3,000 on a Facebook Marketplace scam in just 24 hours

• Boss of Failed Crypto Exchange Gets 11,000-Year Sentence

I spent many years investigating Russian entities, first as a private investigator, then as an anti-corruption investigator at Transparency International, and then as a part of a short-lived but feisty investigative project RussianGate. The Russia-Ukraine war, political tension, and sanctions make investigations with Russian companies and individuals more relevant than ever.

Open-source research is an excellent way to find information on the Russian internet. Russian courts maintain accessible online databases, business registries for companies and sole proprietors are easily searchable and available online, and social media and Telegram provide plenty of data to work through. The Russian language is an issue for non-speaking investigators but a lot of data can still be found with online translation services.  

Yandex

Yandex is a Russian Google that has similar functionality and will bring results in the Russian language. It has maps, images, mail, genealogical archive records, videos, and many other tools. The search results are comprehensive and show tabs in the same way as Google does. Yandex Maps has street views and shows a lot of high-resolution details in pictures. Yandex also allows to use of the same advanced search techniques as Google.

Vkontakte

Vkontakte is the main social media for people who speak Russian. It started as a Facebook twin and became the biggest social media after Facebook and Instagram were banned. It might be hard to register for this service with an American phone number. It’s possible to search for people and check their profiles without registration on this social media.

Odnoklassniki

Odnoklassniki is another popular social media. The users are on the older side, but it’s still active. The website allows to search for users, posts, groups, music, and videos. The social media will show who visited the profiles in question unless the Invisibility mode is turned on which requires a subscription.

Businesses Public Records

This service allows to search for companies and sole proprietors based on their tax numbers, company names, individual names of owners, CEOs, shareholders, addresses, and use other filters. The search has to happen in the Russian language. The results will show a lot of company information and allow to download official documents from the federal tax service.

Court Public Records

Most of the Russian court decisions are scanned and available online. This service, this one, this one, or this one are examples of court record searches. The records for civil and criminal cases can be searched through participants of the cases, including witnesses, third parties, court specialists, case numbers, court locations, types of cases, and the appeal stages.

People Searches

The service provides a database of people and can show information that was published on social media, including date of birth, education, family ties, work information, and links to social media. Phone databases are available here, here, and here.

***

The Russian Internet is heavily regulated by the government and all information that is shared might become available to law enforcement. Also, any service that requires payments will not accept foreign bank cards, PayPal, or similar payment methods, but some of them are open to taking cryptocurrencies.

Interesting Reads This Week:

• The DEA Accidentally Sent $50,000 Of Seized Cryptocurrency To A Scammer

• Fraudster relaunches Fyre Festival from behind bars with $8,000 tickets

• Fake check scammers target Adobe Behance users with fake Waymo work

Despite the ebbs and flows of the cryptocurrency market, it’s here to stay. Crypto is often used in the criminal world for money laundering, terrorist financing, human trafficking, or in scams. Investigators need to know the basics of investigating cryptocurrency transactions and how to find information online.

Chainalysis reported that illicit transaction volume hit a record $20.1 billion in 2022. 44% of the transactions came from sanctioned entities. The graph below shows the upward trending growth.

All crypto transactions are public and available for everyone to see. While the ledgers, that have these transactions, don’t have personal information, it’s still possible to use them to uncover data. Wallets will have transaction IDs, dates and times, amounts, and senders and receivers. No exchange is fully anonymous and there were many examples of investigators solving their cases using this data.

Following transactions is like jumping into a rabbit hole, but a combination of tools, services, and Google search can go a long way.

Transaction Analysis

The easiest way to see all transactions in one place is to use explorers. They all provide similar information and it’s a matter of personal choice which one to choose. Some of the examples of explorers are below:

• Blockchain Explorer: the most popular tool that allows to search for wallets and transactions and shows a summary of data.

• WalletExplorer: the service pulls a list of transactions that can be downloaded as CSV for easier analysis

• Breadcrumbs: a crypto explorer with visualization

• MoneroHash: a Monero blockchain explorer

• Etherscan and Beaconcha: Ethereum explorers

• Blockhair

• BTC

• Blockpath

• Blockcypher

Uncovering the Identity

After seeing the transaction path, it’s time to try and find information about wallet owners. Although there is no direct way to do it, a mix of open-source intelligence and additional tools can help find clues. People report fraud cases involving cryptocurrencies on the websites below and they provide a lot of information, including websites, names, social media usernames, emails, and other data.

• BitcoinWhosWho: the biggest website where people report scams involving bitcoins. The tool allows to search for Bitcoin wallets, keywords, names, usernames, and other information. A wallet search shows transaction history, dates, amounts, and details of the scam with the scammer’s username or website, and where it was mentioned on the internet.

• ChainAbuse

• CheckBitcoinAddress

• Scam-Alert

• Bitcoin Abuse Information Service

• Cryptscam

• ScamSearch

• CryptoScamDB

• Ransomewhe

Other tools

• Cryptocurrency Alerting: a service that sends updates about new transactions in a specific wallet.

• Google search is always a good place to look for a wallet address or transactions. It can even show a specific transaction amount on a specific date if both are searched in quotation marks.

Special software like Chainalysis Reactor, CipherTrace, Crystal Blockchain, and similar solutions can help with uncovering more details about wallets including social media, forums, and darknet searches, and helps to trace and track the connections and transactions in a visual way.

Many investigations end at cryptocurrency exchanges or tumblers, which are services that mix suspicious funds with other transactions to obscure the money path. Cryptocurrency exchanges have to comply with financial regulations in the U.S., which means that they have to gather clients' information to fulfill Know Your Customer requirements and it usually involves some form of identification. Having a complete transaction story and wallet data gathered online might be a good start for a potential subpoena from law enforcement.

Interesting Reads This Week:

• Russian Jailed as $3.5 Billion Danish Central Bank Scam Fails

• Don’t fall for this Instagram art scam

• DOJ charges 371 people, launches new COVID fraud strike forces

One of the most popular questions I get on LinkedIn is about becoming a Certified Fraud Examiner (CFE). People are usually curious about the complexity of the exam preparation and if it’s worth getting the certification in general. I was certified in 2019, and it took me about three months to prepare and pass the exam. I have always found it extremely useful for my career development and network opportunities. I wrote down the biggest pros and cons of becoming a CFE to help people who consider getting the certification.

Pros

• A network of professionals: a CFE has access to local chapter meetings, the big annual ACFE conference, and many online communities and forums.

• Compensation and earnings: the ACFE reports that investigators with the certification earn 17% more than people without it. Their latest report showed that the average salary for a CFE is $106,000 globally and $120,000 in the Pacific region of the US.

• Ample resources for continuing education: every CFE has access to a big library of training, webinars, books, and in-person meetings.

• Great recognition and credibility: ACFE is a well-known brand and they have more than 90,000 members globally.

• Mentorship: the program is available for every member every year. I was a mentor and I hope to become a mentee at some point.

• A sense of belonging: every time I meet another CFE, I feel that we share a lot in common. On a minimal level, we attended the same training, hold the same ethical standards, and are interested in the anti-fraud occupation.

Cons

• The cost of obtaining and keeping the certification: It costs a lot to prepare for the exam and pass it, pay for annual membership, go to the annual ACFE conference, and keep up with CPE requirements. I had employers who were ready to pay for additional professional education, but some people will have to cover it from their pocket.

• The time cost: the exam preparation and maintaining CPE requirements take time and add additional complexity to our busy lives.

• The use outside of the U.S.: recognition of the certification is a bit lower in countries outside of the U.S. and the depth of exam preparation is different as well. The exam prep course is available for the U.S. specifically or in the international edition which can’t cover local specifics.

Interesting Reads This Week:

• Woman sent ‘Stranger Things’ ‘star’ $10K over 1 year, divorced husband in wild catfishing saga

• Should Banks Reimburse Scam Victims?

• Sam Bankman-Fried Pushed One Boundary Too Many

When I was looking into the pig-butchering scam a few weeks ago, a website that was used to defraud victims was one of the biggest sources of information. A simple search showed me that the website was new, registered in Hong Kong, and had negative online reviews. OSINT tools for websites can also help uncover personal information, connections, and other critical data.

I will show a few examples of free open-source tools that can be used to look into websites, domains, and IPs.  For full disclosure, I look at these tools from an investigator's perspective, and not a programmer’s.

WHOIS Lookups

The internet has hundreds of free services available to check who is a website’s owner in a public database. Although a majority of domain sellers make the owner's information private, it’s still possible to find a lot of data, including historical records, especially for older domains.

• Who.Is: a basic WHOIS lookup that also provides DNS records

• Whoxy: a tool that helps to find who is the current owner of a domain, when it was registered, and shows historic records of ownership. It also does a reverse domain search via an owner or company name, email, or domain keywords.

• DomainTools: this service provides similar information and also does IP searches

DNS Lookups

DNS records provide a lot of technical information that is not often used in investigations. For example, a DNS lookup can show a server name, which can be used in reverse lookups that show other websites hosted on the same server. It can help to see a network of websites that might belong to one person.

• Osint.sh: a basic DNS Lookup

• DNShistory: a DNS historical archive helps to find previous servers and other similar information

• DNSlyrics: a reverse name server lookup for searching additional domains

• Reverse-NS: another name server lookup

• Reversens: another reverse server lookup for domains

• Domain Crawler: provides DNS data, website metadata, and used technologies

IP Lookups

IP information is useful for identifying possible locations and finding other websites hosted on the same address

• Who is mind: a basic IP lookup

• IP History: historical IPs of the domain in question

• Reverse IP: a service that shows other domains hosted on the same server

• IP fingerprints: an IP location locator

Google Analytics

The analytics codes can help identify other websites that belong to the same owner. The code usually looks like UA-555555555-5 or G-HHHHH5HH5H. The fastest way to find the code is to click “View Page Source” and then search for gtag.js or analytics.js in the code. There is a way to look for a code for older websites on GA Checker.

• Nerdy Data: a tool that helps to search if Google Analytics was used on other websites

• Osint.sh: another tool for GA searches

Email Search

People reuse their emails to register different domains. Some services help to find all domains that were created with one email.

• Whoxy

• Whoisology

• Reverse WHOIS

Historical Records

Nothing helps to find more information than taking a peek at deleted and archived pages of websites and social media. Wayback Machine is one of the most important OSINT tools that are out there. Another way to find deleted or changed information is to check cashed pages in Google search.

Interesting Reads This Week:

• Etsy sellers say a fraud protection program is destabilizing their businesses

• The 10 Most Scammed States In America

• How to Catch Pandemic Fraud? Prosecutors Try Novel Methods

Fraud investigators know that the majority of fraud cases come from social media. The Federal Trade Commission reported that victims lost $1,228M on social media in the U.S. in 2022, and $658M in the first two quarters of 2023. This is the highest loss compared to all other methods of contact. I worked for Meta so I know that fraud prevention and detection exist and can work on social media. But looking at the sheer number of losses, it doesn’t seem to be enough.

In addition to investigating fraud on Meta and Instagram, I was lucky to work for a fintech company and I found interesting differences in how investigations were handled in both industries. Bad users are still users for social media companies and the latter care a lot about metrics, daily users, and user base growth. Removing all fraudsters and bots used in facilitating fraud will decimate the numbers. There is an estimation that Twitter has 15% bots and they removed 70 million fakes in 2018 with 330 million active users, Facebook deleted 6.5 billion bots while reporting 3.5 billion active users in 2021.

When a social media company encounters a fraudster they can disable the account, and any assets that belong to a bad guy. In a good scenario, there will be a cease-and-desist letter. In extremely rare and unusual cases, litigation might happen. Fraud usually is not reported to law enforcement by social media companies, and when users try to do so, they get no response (proven by my personal experience and many people around me).

But when fraud happens in a fintech company the response is always more serious. Like any financial institution or a money service business, fintech companies have an obligation to report suspicious activities to many government oversight organizations. They also have a more significant responsibility to their users considering that people expect fraud protection and demand actions from banks. The bot problem is still significant in fintech, especially in companies that deal with individual customers. I remember removing thousands of bots a day, that were directly responsible for fraud. Most of them used money layering techniques that were more common in money laundering than in garden variety scams.

Zelle is a notable exception with no one being liable for fraud losses because banks only cover transfers that are unauthorized, which, for example, can happen in account takeovers. When victims transfer money to a fraudster, they technically “authorize” the payment that instantly excludes them from any protection. Major U.S. banks are discussing the possibility of a refund of funds that were used in scams after pressure from the government. The UK banks will be implementing a similar reimbursement system in 2024.

Social media companies will not take down fraud because they profit from user activity. Government pressure seems to be the only way for corporate companies to start treating users’ losses to fraud seriously. The FTC issued a request in March for the eight biggest social media to provide information about fraud prevention in ads that they deliver.

The UK Lloyds Banking Groups called Meta to take responsibility for the fraud that originated on Facebook, Instagram, and WhatsApp. Their research, based on 25 million retail customers, showed that 68% of purchase scams started on Meta’s platforms, with someone in the UK falling victim to a scam every seven minutes. By the time a scam reaches a bank, it’s getting harder to identify suspicious patterns. Successful fraud prevention has to start on social media websites.

Interesting Reads This Week:

• Over $200 billion in pandemic business loans appear to be fraudulent, a watchdog says

• Man who targeted public figures in a hacking scheme sentenced in SF

• 13 Bizarre Email And Direct Message Scams To Watch Out For

When my husband told me that he got a hello text from an unknown phone number, I immediately told him it was a pig butchering scam. We continued to talk to the fraudster for two weeks to gain more knowledge and get a real-life example of the scam.

Pig butchering fraud has been gaining a lot of attention in the last few years. It’s different from a simple cryptocurrency or romance scam because a fraudster spends more time than usual to gain the trust and friendship of a victim. They often show their lavish lifestyles trying to convince targets that they know a lot about business and investing, and they can teach victims how to become rich.

The communication usually follows a pattern of a wrong number, conversation, weeks of regular texts with the exchange of personal information, and then a recommendation of a trading platform to get cryptocurrency. The initial investments are usually small and bring amazing results. The fraudsters will encourage victims to put in more money with time, but when victims will want to take their money back, they just disappear.

So, what does a pig butchering scam look like in real life? Talking to a fraudster showed us how they progressively involve victims into believing that they are real people.

• A victim gets a “hello” text and an explanation for a wrong number, then starts a conversation. Our fraudster introduced themselves as Bella Aziz from Toronto. She was from Malaysia, 32 years old and single.

• They share a lot of personal details immediately. Our fraudster was a shareholder in a jewelry store, and liked “shopping, traveling, reading, some outdoor activities”. They first told us that they were a student of economics and finance at the University of Toronto, and complained about how hard it was, but then explained they actually weren’t a student anymore because they were 32 years old.  

• They will try to switch to Telegram or WhatsApp because it’s easier to stay there without proper oversight of social media moderators. The fraudster told us that the phone number used for texts was only for business purposes.

• They text victims every day with more personal details, flirt, quotes, photos exchange

• They build an image of being really good at business or investing and start to talk about money using their achievements and knowledge

• They make a move suggesting to start trading and share a perfect platform for that

Deeper Look:

We didn’t invest any money and the fraudster didn’t want to continue the conversation. Their phone number used for texts was deleted.

The person in question had issues with the English language and would confuse themselves with lies from time to time. They often complained that they would receive messages from us when they were sleeping, implying a time difference.

The images of the woman and her life shared in the conversation were stolen from different sources – travel blogs and social media. For example, an exact photo was shared on a website with travel reviews describing a jewelry store in Hong Kong.

The phone number used in the text communication is based in the US, located in Newark, Delaware and, according to reverse phone record websites, belongs to 84 years old person. The WhatsApp phone number is a VOIP phone registered in Florida.

The trading platform website doesn’t contain any contact information or any data about the company that owns it. The website itself was created in May 2023, with an IP location in Hong Kong.

The case was a classic example of pig butchering, and anyone who would try to invest any money into their platform would lose them immediately.

Interesting Reads This Week:

• The Devastating Impact of Elder Financial Abuse

• Dozens in 16 states charged with health care fraud schemes, including $1.9B in bogus claims

• YouTube Fraudster Sentenced to Nearly 6 Years in Prison for $23M Royalty Scheme