x
In a dim room in downtown Toronto, a group of 20-somethings huddle in front of computers, running code to spot vulnerable websites and then disrupt them. Hackers? Definitely.
But they're not looking to steal your money or personal information. Instead, they're fighting scammers in an arms race involving AI, cryptocurrency and organized crime. They work for ChainPatrol, a start-up that takes down scam sites impersonating legitimate cryptocurrency brands.
Jeff Bezos backs a platform that lets anyone invest in rental homes for as little as $100 — 6 ways to build wealth like a landlord without actually being one
Dave Ramsey warns nearly 50% of Americans are making 1 big Social Security mistake. Here's what it is and 3 simple steps to fix it ASAP
A single line on your car insurance policy could be inflating your premium by up to 30% — here's what to change
Nikita Varabei once worked at one of those brands, then founded ChainPatrol with his friends Umar Ahmed and Vito Giovannetti. They recognized a need for the service amid confusion surrounding digital currencies like Bitcoin and the newness of crypto technology.
"It's a little bit of the Wild West," he told Moneywise. "It doesn't mean we shouldn't settle the Wild West. But when you're on that frontier, there's bandits and highwaymen and robbers."
"And snake-oil salesman," Ahmed added.
Varabei and his teammates are among the hired guns patrolling the frontier, employed by Coinbase, Polymarket, Moonpay and other big brands to track down charlatans, according to their website.
"These companies want to get rid of scammers," he said. "They're under attack."
Varabei wants to stop fraudsters in their digital tracks not only to prevent victim losses, but to restore trust in crypto, which he believes is a truly transformative and empowering technology.
Moneywise talked to Varabei and Ahmed about just what they're up against.
Every day, the team must scan the one to two million new websites that launch around the world, filter them down to 500,000 that may be relevant to their clients, and then identify fake ones. It's a daunting task.
Just two years ago, it would take a criminal up to a week to create an impostor site based on a real brand like Coinbase, PayPal or Booking.com. But impostor sites were flawed, with easy tells like poor spelling and grammar, imperfect images and amateur logos.
Now, thanks to AI, hucksters can do the same job within minutes, producing not just one but multiple clones with different web addresses. Take one down, another goes up. And the sites look more and more professional — evading detection by security researchers.
"We have to be constantly innovating and adapting, just like the scammers," Varabei said.
The biggest challenge is the scale of the crime syndicates involved. These crime rings operate throughout Asia, the Americas, Africa and Europe. They operate as big businesses and employ thousands of workers to carry out scams 24/7.
How does a small group of software engineers take on such a daunting challenge? They fight fire with fire, leveraging both AI and human intelligence. Their team of 10 in Toronto is bolstered by analysts employed in every time zone who work on investigations around the clock. Ahmed noted that their international colleagues bring both cultural awareness and language skills to the job to identify scams in multiple locations.
When they identify a fake site, they contact platforms around the world to load threat warnings every time someone opens a link to it. That's a process called blocklisting, and they can make it happen in as little as 15 minutes to immediately reduce the risk.
Ahmed said time is of the essence. Once someone loses money to a cryptocurrency scam, it's almost impossible to identify the thief or get the funds back. "There's no undo button for it," he said.
Once they identify the imposters, they work with search engines, social media apps and web hosts to take them down. That takes longer, because the platforms must be sure they aren't taking down legitimate sites. The team needs rock-solid evidence.
"Figuring out the right evidence is an art in and of itself, something that we've spent years developing and continue to upgrade," he told Moneywise.
Thanks to the trust the company has built with platforms, ChainPatrol can trigger takedowns in as little as 24 hours, compared to the weeks or months it takes others. Every week they take down tens to thousands of sites.
But the problem continues. Everyone has to be vigilant, including everyday consumers like you.
While cryptocurrency and AI are still part of the digital frontier, the scams the team sees follow familiar playbooks. Here are three of the most common.
This is a common scam in which criminals send out a message that they represent an institution — in this case a cryptocurrency company — reporting an issue with the recipient's account, complete with a link or phone number to call for support. If the victim is hooked, scammers ask them to share their account details.
These cruel scams target people who have already fallen victim to a cryptocurrency scam. Criminals send texts or emails to victims, promising to return their money for a fee. Of course, the fraudsters have no intention of returning the money, and just steal more in the process. Nikita said criminals watch for victims who post on social media about the scams they fell for.
Umar said anyone can fall for scams, including experts and professionals. That includes software engineers — many of whom are dealing with a tough job market in the face of AI. Criminals impersonate recruiters with LinkedIn and other organizations, approaching coders with offers to work at high-profile cryptocurrency brands. There may be an interview offer with a website link that takes the would-be job applicant to a fake Zoom link. Then the criminals install a virus on the victim's device.
Here's some advice from ChainPatrol on how to stay alert.
Question unusual requests via email, chat or text — especially involving your account security, requests for personal information or financial transactions. Don't click links in messages. Open a browser on a separate device, log into your official account, and check your security settings.
Scam victims often don't come forward out of embarrassment or fear of punishment, leaving them at even greater risk. If you suspect you're a scam victim, confide in a trusted friend or colleague and report it to authorities.
The best offense is a good defense. Make sure your digital valuables are harder to steal by using a reputable password manager and strong, unique passwords. Using Multi-Factor Authentication (MFA) options like authenticator apps and hardware tokens. Avoid SMS-based MFA because it is vulnerable to SIM swapping attacks.
Audit your social media accounts and messaging apps for privacy and security permissions. Does everyone need to see your phone number when they search your name? Do you need to post about your stock market gains or purchases? Each one is a signal to would-be scammers that they should pay attention to you.
