Inside the world of crypto scams: how they operate, and why they are now a mainstream financial crime risk

From pig butchering to AI-powered phishing, Scott Pounder examines how crypto scams are evolving and why understanding fraud typologies is critical for financial institutions.

Crypto-related fraud has stopped being a niche, crypto-native problem. It now surfaces inside mainstream banking rails, payment service providers, and ecommerce platforms, often long before anyone realises a crypto scam is involved at all. A customer wiring savings to ‘top up a trading account’, a business banking client accepting a crypto payment from a counterparty that turns out not to exist, an employee with privileged access to a firm's digital asset wallets: each looks, at the point of transaction, like an ordinary instruction. Understanding how these scams are actually built and operated is what allows banks, PSPs, exchanges, and regulators to recognise them earlier in that chain, rather than only after the funds are gone.

A criminal industry, not a series of isolated incidents

The scale and organisation behind crypto fraud is often underestimated. Large parts of the ‘romance and investment’ scam economy, commonly labelled pig butchering, are run out of industrial-scale compounds, widely reported in Myanmar, Cambodia, and parts of Laos, where trafficked workers are coerced into running scripted, long-duration fraud campaigns against victims across North America, Europe, and East Asia. UNODC has estimated scam losses targeting East and Southeast Asian victims at USD 18–37 billion in 2023 alone, with later reporting warning that the industry has continued to expand. [1] This matters for risk teams because it means the fraud a bank sees in its own transaction monitoring is very rarely opportunistic; it is the output of a professionalised operation with scripts, escalation paths, and its own internal quality control.

The typologies most likely to touch an institution's own data

Romance and investment scams (pig butchering). Victims are cultivated over weeks or months on dating apps or social media before being directed to a fraudulent trading platform showing fabricated returns. [2] From a bank's perspective, this typically appears as a series of legitimate-looking crypto purchases or exchange transfers by an otherwise unremarkable retail customer, sometimes escalating rapidly in size.

Phishing and wallet-draining attacks. Fraudsters distribute spoofed exchange login pages or malicious browser extensions to capture seed phrases and private keys. A more technical variant, ‘approval phishing’, tricks a victim into signing a transaction that grants a malicious smart contract standing permission to move tokens, sometimes executed days after the original interaction, a technique significant enough to be the focus of a joint 2026 operation between the US Secret Service, the UK's National Crime Agency, and Canadian authorities. [3]

Fake investment platforms and Ponzi-style schemes. These promise unrealistic, fixed returns and rely on new deposits to pay early participants, a pre-crypto pattern accelerated by how cheaply a convincing platform accepting stablecoin deposits can now be built and marketed globally.

Insider threats. As more traditional financial institutions build digital asset trading desks, staff with privileged access to wallets or trading infrastructure represent a distinct and growing risk category, one that conventional external-facing fraud controls are not designed to catch.

Why geography still matters to a risk model

Certain scam types remain associated with specific regions, largely because of the infrastructure and labour behind them rather than the technology itself. Pig butchering compounds have been heavily reported in Southeast Asia. Fake investment and affinity-fraud platforms are frequently linked in open-source and law enforcement reporting to Eastern Europe and parts of the CIS region. Romance scam operations have long been associated with West Africa, predating crypto, but increasingly use digital assets as one payment and laundering rail. DeFi-native exploits, by contrast, such as rug pulls and smart contract attacks, are far less geographically concentrated, since blockchain development's anonymity allows perpetrators to operate from anywhere against a global investor base. None of this is a substitute for transaction-level monitoring, but it remains a useful input for corridor-level risk scoring and correspondent banking due diligence.

Typologies are evolving faster than most internal risk models

Generative AI has meaningfully lowered the skill threshold for convincing scams: deepfake video calls, cloned voices, and AI-generated chat personas are increasingly used to defeat the scepticism that trained staff and customers alike are told to rely on. ‘Address poisoning’, where scammers send small transactions from addresses that closely resemble ones a target has previously interacted with, exploits the habit of copying addresses from transaction history. ‘Quishing’, QR-code phishing, exploits the fact that a QR code hides its destination until scanned. Perhaps most significant for institutions is the rise of scam-as-a-service: ready-made phishing kits, fake exchange templates, and even scripted customer-support flows are now sold on underground forums, which has professionalised the lower end of the market and materially increased the sheer volume of attempts a compliance team has to screen against. [4]

The exposure is no longer confined to crypto-native firms

Regulators across the UK, EU, and US have increasingly signalled that banks, PSPs, and cryptoasset firms should understand and manage crypto-related fraud exposure earlier in the customer journey, including where customers move funds toward digital asset platforms. [5] That expectation is difficult to meet without understanding how these scams are actually constructed, who is running them, and where the operational patterns diverge from ordinary customer behaviour. The typologies and regional dynamics set out here are the foundation. 

The second article in this series looks at what happens once a scam has succeeded: how the resulting fraud is detected in practice, how illicit funds are traced once they move on-chain, and what a coordinated response between exchanges, banks, regulators and forensic investigators looks like in a real, time-pressured case.

Sources

^1.UNODC: https://www.unodc.org/roseap/en/2024/10/cyberfraud-industry-expands-southeast-asia/story.html;

https://www.unodc.org/roseap/uploads/documents/Publications/2024/TOC_Convergence_Report_2024.pdf;

FBI / IC3: https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report;

https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf

^2.FinCEN: https://www.fincen.gov/news/news-releases/fincen-issues-alert-prevalent-virtual-currency-investment-scam-commonly-known; 

FBI: https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/cryptocurrency-investment-fraud;

^3.NCA: https://www.nationalcrimeagency.gov.uk/news/fraudsters-targeting-cryptocurrency-stopped-and-12-million-frozen-in-nca-led-operation-atlantic;

https://www.nationalcrimeagency.gov.uk/news/operation-atlantic;

US Secret Service: https://www.secretservice.gov/OperationAtlantic; Ontario Securities Commission: https://www.osc.ca/en/news-events/news/operation-atlantic-disrupts-more-45-million-cryptocurrency-fraud-freezes-12-million-stolen-funds;

^4.UNODC: https://www.unodc.org/roseap/en/2024/10/cyberfraud-industry-expands-southeast-asia/story.html;

https://www.unodc.org/unodc/frontpage/2025/September/emerging-threats-in-southeast-asia--exploitation-of-ai-and-automation-in-the-regional-cybercrime-landscape.html

^5.FCA: https://www.fca.org.uk/firms/cryptoasset-financial-promotions-and-fiat-crypto-ramp-services;

ESMA: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica;

FinCEN: https://www.fincen.gov/news/news-releases/fincen-issues-alert-prevalent-virtual-currency-investment-scam-commonly-known

Author bio 

Scott Pounder is Head of Token Recovery and a recognised expert in blockchain forensics and digital asset recovery, with over 20 years across UK law enforcement and the private sector. A member of the Oxford and Cambridge Blockchain Societies and ISSA, he has testified in nearly 100 legal proceedings and lectures at the University of Cambridge. He holds qualifications from Blockchain Council, Chainalysis, Crystal Intelligence, Interpol, Met Police, and Pearson.

 

 

About Token Recovery  

Token Recovery is a blockchain forensics and crypto asset recovery firm headquartered in Zug, Switzerland. Its in-house team of investigators supports individuals, corporates, law firms, and financial institutions in tracing stolen digital assets and pursuing recovery through blockchain analysis, exchange engagement, and legal action worldwide. The firm's casework spans exchange hacks, insider theft and investment fraud, and has been reported by Thomson Reuters, the Financial Times, Fortune, and The Paypers.