Frontier Watch

AI-polished scams: deepfakes, voice cloning, machine-written messages

How it works: Chainalysis found that scams with on-chain links to AI vendors extracted $3.2 million per operation versus $719,000 for those without such a link (4.5 times more), and says AI tools help scammers reach more victims and make scams more persuasive. These figures show an association, not proof of cause. The result is a more convincing approach, not a new trick.

The tell: Polish is no longer a sign of legitimacy. A flawless message, a live-looking video or a familiar voice that nonetheless asks for money, a code or a signature is the same old request.

Verify like this: Verify the request on a second channel you already trust (call the person on a number you already have). For giveaways and 'live' streams, remember that no real giveaway needs you to send crypto first.

Primary source: 2026 Crypto Crime Report: Scams (Chainalysis)

Physical 'wrench' attacks aimed at people who are findable

How it works: Chainalysis documented 46 violent crypto-related incidents through late June 2026 and estimated more than $30 million stolen from holders so far that year; it says 2026 would exceed 2025's record of $58 million if the trajectory continues. It describes France as a hotspot and ties much of the surge there to a 2024 incident in which a French tax official allegedly stole and sold dossiers on crypto holders (names, addresses, holdings, phone numbers).

The tell: Anyone who knows your address and that you hold crypto: public posts about holdings, leaked customer data, oversharing on social media.

Verify like this: Shrink your footprint: do not publish holdings or screenshots of balances, keep wallet addresses out of public profiles, and read our wrench-attack guide before an incident rather than after.

Primary source: Violent Wrench Attacks Targeting Crypto Holders (published 6 August 2026) (Chainalysis)

One drainer / approval-exploit, dissected

Dissected: how a leaked holder dossier becomes a physical target (a data-exposure mechanism, not a contract drain)

Mechanism: Chainalysis describes a chain in which personal data on crypto holders (names, addresses, holdings, phone numbers) leaks or is sold, and criminals use it to pick targets and approach them in person. Per Chainalysis, home invasions made up 37% of 2026 incidents year to date and kidnappings about 52%.

Why it works: On-chain assets are bearer-style: whoever is forced to sign can move them, and the victim's location is the weak point rather than the blockchain.

Defense: Reduce what is knowable about you: do not advertise holdings, separate public identity from wallets, avoid sharing your address with services that do not need it, and keep any plan for a coercion scenario private and rehearsed. Report any threat to local police immediately.

Primary source: Violent Wrench Attacks Targeting Crypto Holders (published 6 August 2026) (Chainalysis)

One tool / venue, re-checked

Our wrench-attack safety guide

What we re-checked: On 2026-10-05 we compared our wrench-attack guide (page dated 2026-07-19) with Chainalysis's August 2026 analysis.

Finding: The guide covers the topic and describes a kidnapping case in France. In the text we extracted it does not cite the 2026 Chainalysis figures (46 incidents, more than $30 million, 26% of theft attempts paid versus 49% in 2025).

What changed: No change made in this issue. We logged a suggestion for the guide owner to cite the Chainalysis analysis.

Primary source: Violent Wrench Attacks Targeting Crypto Holders (published 6 August 2026) (Chainalysis)

One myth, killed

"Violent crypto attacks almost always end with the attacker getting paid, so there is nothing a holder can do."

Reality: Chainalysis reports that only 26% of violent theft attempts in 2026 (12 of 46) resulted in payment, down from 49% (47 of 95) in 2025. That is not a reason to be complacent: more than $30 million was still stolen in the first half. It is a reason to prepare, including a smaller public footprint.

Why the myth persists: Dramatic cases get the headlines and the failures do not, so the base rate looks higher than the data suggests.

Primary source: Violent Wrench Attacks Targeting Crypto Holders (published 6 August 2026) (Chainalysis)

Issue #4 · September 28, 2026

Frontier Watch #4 — The 'FBI will recover your crypto' message, AI-made videos of officials, and the cash courier

Two FBI IC3 alerts from 2026 read together: recovery scams that impersonate IC3 itself (20 July) and crypto-investment scams that send couriers to collect cash (15 June). Pattern education with cited primary sources only.

Scam patterns currently in circulation

Pattern education, not accusations: each item describes a reproducible mechanism with a cited primary source — we never name and accuse an unproven entity.

Fake 'IC3 / FBI' contact offering to update your complaint or recover funds

How it works: Scammers pose as FBI agents over Facebook Messenger and Telegram and contact previous victims, often after a victim threatens to report the original scam. In one scheme the impersonator sends a link to 'update' a submitted IC3 report; the link may contain malicious code or be used to collect more financial data to revictimise the person.

The tell: A message on social media or a messaging app from someone claiming to be the FBI or IC3. IC3 says it does not maintain a social media presence, does not investigate crimes or recover funds through Facebook, Telegram or similar platforms, and will never directly communicate with individuals by phone, email or social media.

Verify like this: Type www.ic3.gov into your browser yourself (the address ends in .gov) and file reports only there. Never pay anyone for fund recovery.

Primary source: IC3 impersonation scam alert (I-072026-PSA, 20 July 2026) (FBI Internet Crime Complaint Center (IC3))

AI-generated videos promoting spoofed reporting websites

How it works: The same alert describes AI-generated videos, including deepfakes of FBI leaders, that promote fake IC3 websites. The spoofed site collects details such as name, phone number, email address, scam type and estimated loss, then gives a reference number and says someone will be in touch.

The tell: A video or ad pointing you to a 'reporting portal' that is not the .gov address you typed yourself. IC3 lists distorted hands or feet, unrealistic facial features and unnatural movements as things to look for in videos.

Verify like this: Do not follow a link from a video. Go to the official site by typing the address, and treat any unprompted 'follow-up' as suspect.

Primary source: IC3 impersonation scam alert (I-072026-PSA, 20 July 2026) (FBI Internet Crime Complaint Center (IC3))

The courier who collects cash for a fake crypto investment platform

How it works: Per the FBI, scammers build a public persona as a crypto investment expert, use 'love bombing' to build trust, and direct victims, usually seniors, to a fraudulent investment platform. Because legitimate financial institutions may deny suspicious transfers, they arrange couriers to collect cash at victims' homes or public locations. The courier is authenticated with a dollar-bill serial number or other code. The platform displays fake gains, and withdrawal attempts are met with demands for fraudulent taxes and penalties.

The tell: Any request to hand cash to a person in connection with a crypto investment platform, and any extra tax or penalty demanded before you can withdraw.

Verify like this: The FBI advises not disclosing your home address or agreeing to meet unknown individuals to deliver cash or other valuables, and verifying investment platforms through your own research before investing.

Primary source: Scammers Use Couriers to Collect Cash in Cryptocurrency Investment Scams (I-061526-PSA, 15 June 2026) (FBI Internet Crime Complaint Center (IC3))

One drainer / approval-exploit, dissected

Dissected: the cash-courier step in a crypto-investment scam (a real-world mechanism, not a contract drain)

Mechanism: After a victim has sent money to a fake crypto platform, the scammer arranges an in-person pickup. A courier meets the victim, confirms identity using an authentication code, and takes the cash. The platform keeps showing fake profits and demands fraudulent taxes and penalties when the victim tries to withdraw.

Why it works: Per the FBI, the courier route is arranged because legitimate institutions may deny suspicious transfers, and the code-checking ritual makes the handover feel official. A dashboard showing gains keeps hope alive.

Defense: Treat any request to hand cash to anyone in connection with a crypto platform as fraud. Stop contact, keep records, and report at ic3.gov (US) or to your national reporting body. Talk to family before sending anything further.

Primary source: Scammers Use Couriers to Collect Cash in Cryptocurrency Investment Scams (I-061526-PSA, 15 June 2026) (FBI Internet Crime Complaint Center (IC3))

One tool / venue, re-checked

Our 'Crypto Scam Recovery: The First Hour, and the Second Scam' guide

What we re-checked: On 2026-10-05 we re-read the guide (page dated 2026-06-20) against the IC3 alert of 20 July 2026.

Finding: The core advice still holds: never pay for recovery, report through official channels. In the text we extracted, the guide does not yet mention recovery lures that impersonate the reporting agency itself or AI-generated videos.

What changed: No change made in this issue. We logged a suggested paragraph for the guide: IC3 does not operate on social media, never initiates contact, and never charges for recovery.

Primary source: IC3 impersonation scam alert (I-072026-PSA, 20 July 2026) (FBI Internet Crime Complaint Center (IC3))

One myth, killed

"A government agency will message you on social media to help recover crypto you lost to a scam."

Reality: IC3 says it does not maintain a social media presence, does not recover funds through Facebook, Telegram or similar platforms, and will never ask for payment to recover lost funds. A contact like that is the second scam.

Why the myth persists: Victims want to hear that recovery is possible, and a message that uses an official name answers that wish at the moment of greatest vulnerability.

Primary source: IC3 impersonation scam alert (I-072026-PSA, 20 July 2026) (FBI Internet Crime Complaint Center (IC3))

Issue #3 · September 21, 2026

Frontier Watch #3 — The fake official: law-enforcement impersonation and why crypto is the payment they ask for

Built on the FBI IC3's 17 September 2026 alert on law-enforcement and government impersonation. Three patterns from the alert, one mechanism dissected, one of our own resources re-read, and one myth killed. Pattern education with a cited primary source, never an accusation against a named party.

Scam patterns currently in circulation

Pattern education, not accusations: each item describes a reproducible mechanism with a cited primary source — we never name and accuse an unproven entity.

Law-enforcement or government impersonation that demands payment

How it works: Scammers pose as law enforcement or government officials, usually by unsolicited phone call (texts and emails too), spoof legitimate contact details, and use an urgent, aggressive tone to extort money or personal information. Requested payment methods include prepaid cards, couriers, bank wires, cryptocurrency, and cash inserted into cryptocurrency kiosks.

The tell: Contact you did not start, an aggressive deadline, and a demand for payment of any kind. IC3 says law enforcement and government authorities will never contact members of the public by telephone or text message to demand any form of payment or to request personal or sensitive information.

Verify like this: End the call. Find the agency's number or .gov website yourself and ask whether the matter is real. Do not click links in the message.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

Fake court-date and jury-duty threats

How it works: A caller claims you missed jury duty or a court date and must pay a fine to avoid arrest. IC3 recorded 6,833 complaints of this type with nearly $36 million in losses between January 2025 and July 2026.

The tell: A legal consequence that can be 'fixed' immediately by a payment to the caller. IC3 says authorities never demand payment by phone or text.

Verify like this: Do not argue with the caller. Contact the court clerk's office using a number from the court's official site.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

Impersonation aimed at foreign nationals and ethnic communities

How it works: IC3 counted 1,809 complaints in which scammers targeted ethnic communities or foreign nationals, with losses exceeding $140 million between January 2025 and July 2026.

The tell: A threat of legal trouble, or a claim of official authority, that can be resolved by paying the caller. Authorities do not demand payment by phone or text.

Verify like this: Talk to a trusted friend or community organisation before paying anyone, and verify through the official government website you type in yourself. If you live outside the US, use your own country's official reporting channel.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

One drainer / approval-exploit, dissected

Dissected: the spoofed official call, step by step (a social-engineering mechanism, not a contract exploit)

Mechanism: Per the IC3 alert: an unsolicited call or message arrives from a spoofed number or address that looks official. The caller uses an urgent and aggressive tone, refuses to speak to or leave messages with anyone other than the targeted victim, and demands payment by methods such as prepaid cards, couriers, wires, cryptocurrency or kiosk cash.

Why it works: Copied phone numbers, names and credentials borrow credibility, urgency suppresses checking, and isolating the victim removes the person most likely to say 'this sounds wrong'.

Defense: Slow the script down. Hang up, verify through an official channel you look up yourself, tell someone you trust, and never pay anyone who contacted you first and demands a specific payment method.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

Open the read-only tool Related guide

One tool / venue, re-checked

Our scam reporting resources page

What we re-checked: On 2026-10-05 we re-read our Crypto Scam Reporting Resources page against the reporting guidance in the IC3 alert (report to IC3 and contact local law enforcement).

Finding: The page already tells readers to preserve evidence, report through official channels, and refuse recovery-fee promises. In the page text we extracted it does not name IC3 explicitly as a reporting destination for US readers.

What changed: No change made in this issue. We logged a suggestion to name IC3 and ReportFraud.ftc.gov for US readers and to point other readers to their own national reporting body.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

One myth, killed

"Police or a government agency can phone you and demand an immediate payment to clear a fine or warrant."

Reality: IC3 states that law enforcement and government authorities will never contact members of the public by telephone or text message to demand any form of payment.

Why the myth persists: A badge-and-uniform voice triggers obedience, and the demand arrives packaged with a plausible legal reason and a deadline.

Primary source: Scammers Impersonating Law Enforcement and Government Officials in Fraud Schemes (I-091726-PSA, 17 September 2026) (FBI Internet Crime Complaint Center (IC3))

Issue #2 · September 14, 2026

Frontier Watch #2 — The kiosk QR code, the 'move your money to protect it' call, and what the complaint data shows

Crypto-kiosk payment scams, read from three primary sources: the FTC's description of the mechanism, the CFTC's plain-language rule of thumb, and the FBI IC3's complaint data. Pattern education only, never an accusation against a named party. Sources checked 2026-10-05.

Scam patterns currently in circulation

Pattern education, not accusations: each item describes a reproducible mechanism with a cited primary source — we never name and accuse an unproven entity.

The 'stay on the line' call that ends at a crypto ATM

How it works: A caller posing as a government official, law enforcement, a utility company, or a romantic interest pressures you to withdraw cash and go to a store with a crypto ATM, staying on the phone throughout. At the kiosk you are told to scan a QR code that holds the scammer's wallet address. Crypto transfers are generally very hard to reverse once sent.

The tell: Someone you did not contact tells you to pay in cryptocurrency, through a kiosk, and keeps you on the phone while you do it. The FTC's rule: nobody from the government, law enforcement, a utility company, or a prize promoter will ever tell you to pay them with cryptocurrency.

Verify like this: Hang up. Look up the real organisation's number yourself and call it. Never scan a QR code a stranger gives you. Report it at ReportFraud.ftc.gov (US readers) or your own country's fraud reporting body.

Primary source: New crypto payment scam alert (Federal Trade Commission)

'Move your money to protect it' instructions

How it works: The caller says your account is compromised or your money is at risk and instructs you to move it somewhere 'safe': a crypto ATM, gift cards, or a courier who will collect cash. Urgency and secrecy are part of the script so that you do not stop to check with anyone.

The tell: Any instruction to protect money by sending it through a crypto ATM, buying gift cards, or handing cash to a courier. The CFTC states that no government agency, legitimate financial institution, or reputable company will instruct you to move money that way.

Verify like this: Pause before you withdraw or transfer. End the call, then contact your bank or the agency yourself using a number or website you looked up independently.

Primary source: Pause Before You Pay: Unusual Money Transfer Instructions May Signal Fraud (Commodity Futures Trading Commission (CFTC))

Unsolicited contact + a QR code + a large cash withdrawal

How it works: The FBI IC3's kiosk complaint data (2025: more than 13,400 complaints, losses over $388 million, a 23% rise in complaints and 58% rise in losses on 2024) lists red flags that tend to appear together: unsolicited digital contact offering cryptocurrency services, a QR code the person cannot explain, and a large cash withdrawal, especially a first one, requested in large bills.

The tell: You are carrying a QR code you did not generate and cannot explain, or you are withdrawing a large amount of cash, perhaps for the first time and in large bills, that you cannot comfortably explain to the teller. Per IC3, more than half of complaints involved people over 50 (losses over $302 million), so this is also a family-conversation topic.

Verify like this: If a kiosk operator or bank teller warns that a transaction looks fraudulent, stop immediately. Do not send funds to an online-only contact. Report with transaction IDs, wallet addresses and the kiosk location at ic3.gov (US).

Primary source: IC3 Cryptocurrency Kiosk Fraud Alert (I-051526-PSA, 15 May 2026) (FBI Internet Crime Complaint Center (IC3))

One drainer / approval-exploit, dissected

Dissected: how a kiosk QR code turns cash into an irreversible transfer (no wallet drainer needed)

Mechanism: This issue's mechanism is not a smart-contract drainer. The victim withdraws cash, feeds it to a crypto ATM, and scans a QR code supplied by the scammer. The code encodes the scammer's wallet address, so the kiosk sends the purchased crypto straight to it.

Why it works: The scammer stays on the phone, so the victim never gets the quiet minutes in which doubt would normally surface, and the final step looks like an ordinary transaction at a machine. Crypto transfers are generally hard to reverse, and the victim has already converted cash.

Defense: Break the script before the kiosk: end the call and verify independently. A QR code you did not create yourself is a stranger's wallet address. If you are already at the machine, stop; if you have sent funds, report immediately with the transaction details.

Primary source: New crypto payment scam alert (Federal Trade Commission)

One tool / venue, re-checked

Our crypto ATM scam guide

What we re-checked: On 2026-10-05 we compared the loss figures on our crypto-ATM scam guide (page dated 2026-07-23) with the FBI IC3's 15 May 2026 kiosk alert.

Finding: They agree: the guide cites 13,460 complaints and $388,981,267 in 2025 kiosk losses, a 58 percent jump, which is consistent with IC3's 'more than 13,400 complaints' and 'over $388 million'.

What changed: Nothing needed changing. We noted that the IC3 release adds the over-50 split (more than half of complaints, over $302 million), which is worth a mention in a future guide update.

Primary source: IC3 Cryptocurrency Kiosk Fraud Alert (I-051526-PSA, 15 May 2026) (FBI Internet Crime Complaint Center (IC3))

One myth, killed

"If an official-sounding caller says your money is at risk, moving it into crypto through a kiosk is a legitimate way to protect it."

Reality: No. The CFTC says no government agency, legitimate financial institution, or reputable company will instruct you to move money using crypto ATMs, gift cards, or couriers. The instruction itself is the red flag.

Why the myth persists: The script borrows authority and fear at the same moment, and the payment method sounds technical enough that a stressed person assumes the caller must know something they do not.

Primary source: Pause Before You Pay: Unusual Money Transfer Instructions May Signal Fraud (Commodity Futures Trading Commission (CFTC))

Issue #1 · June 25, 2026

Frontier Watch #1 — Drainer signatures, fake-support DMs, and the 'recovery' second hit

The first dated issue of the un-bought Frontier Watch. Patterns currently in circulation, one approval-exploit mechanism dissected, one tool re-checked, and one myth killed — all pattern education with cited primary sources, never accusations against named parties.

Scam patterns currently in circulation

Pattern education, not accusations: each item describes a reproducible mechanism with a cited primary source — we never name and accuse an unproven entity.

Wallet-drainer 'claim / migrate / verify' approval prompts

How it works: A lookalike site or pop-up tells you to 'claim an airdrop', 'migrate your tokens', or 'verify your wallet'. The button does not move funds — it asks you to sign an approval (an ERC-20 allowance or set-approval-for-all) that lets a stranger's contract pull your tokens later, at a time of their choosing.

The tell: The wallet pop-up is an approval/permission request, not a plain send. Legitimate 'claims' almost never need blanket approval over your existing tokens or NFTs.

Verify like this: Read the signature request. If it says approve, permit, or setApprovalForAll for an unfamiliar contract, reject it. Review and revoke existing approvals on a block explorer's token-approval tool before you ever interact with a new site.

Primary source: What To Know About Cryptocurrency and Scams (Federal Trade Commission)

Fake-support DMs after you post a problem in public

How it works: You post 'my transaction is stuck' or 'app won't load' in a public channel. Within minutes, an account using the project's logo direct-messages you 'support'. Real support is not a DM; the goal is to walk you toward a seed phrase, a remote-desktop session, or a 'validation' deposit.

The tell: Unsolicited DM, urgency, and at some point a request for your seed phrase, a screen-share, or a small 'unlock' payment. No legitimate support ever needs your seed phrase.

Verify like this: Never act on a DM. Close it, find the official support channel from the project's verified site, and start there yourself. Your seed phrase never leaves paper.

Primary source: Investor Alert: Fraudulent Digital Asset and Crypto Trading Websites (CFTC and SEC investor education offices)

'Recovery' offers that hit victims a second time

How it works: After a loss, an account or 'agency' promises to recover your stolen crypto for an up-front fee or by 'reconnecting' your wallet. The recovery is the second scam: pattern targets people who already lost funds and are desperate.

The tell: Up-front fee, guaranteed recovery, a request to connect or 'import' your wallet, or a demand for personal documents. Genuine recovery is rare and never guaranteed.

Verify like this: Report to official channels (your country's fraud reporting body; in the US, the FBI IC3). Do not pay anyone who guarantees recovery or asks you to connect a wallet.

Primary source: Public Service Announcement: Cryptocurrency Recovery Scams (FBI Internet Crime Complaint Center (IC3))

Long-game 'pig butchering' relationship-to-investment funnels

How it works: A friendly contact builds rapport over weeks (dating app, wrong-number text, social DM), then introduces a 'great' trading or yield platform. Early small withdrawals work to build trust; larger deposits cannot be withdrawn, and a 'tax' or 'fee' is demanded to release them.

The tell: A relationship that pivots to a specific investment platform, withdrawals that work small but fail large, and a release 'fee'. The platform exists only to take deposits.

Verify like this: Treat any investment introduced by a new online contact as a scam by default. A platform that demands a fee before letting you withdraw is the tell — your money is already gone.

Primary source: 2024 Internet Crime Report (FBI Internet Crime Complaint Center (IC3))

One drainer / approval-exploit, dissected

Dissected: how a 'set-approval-for-all' signature drains an NFT wallet

Mechanism: On EVM chains, setApprovalForAll(operator, true) grants one address blanket permission to transfer every token in a collection you hold. A drainer dApp presents a benign-looking action ('enable trading', 'verify ownership') whose underlying call is exactly this. Once signed, the operator contract can sweep the approved tokens whenever it likes — the drain transaction can come hours or days after you signed.

Why it works: Approval and transfer are separated in time, so nothing visibly leaves your wallet at signing. The prompt's plain action label hides the contract-level meaning, and most wallets show the function name, not its consequence in words a beginner reads.

Defense: Before signing, read the method: approve, permit, permit2, or setApprovalForAll over your assets means STOP unless you fully trust the contract. Periodically review and revoke approvals via a block-explorer token-approval tool. Keep high-value holdings in a wallet you never connect to dApps.

Primary source: Ethereum wallets (Ethereum.org)

Open the read-only tool Related guide

One tool / venue, re-checked

Our wallet-safety self-check and the approval-revocation guide

What we re-checked: We re-walked our own wallet-safety score and token-approval-revocation guide against the current crop of drainer prompts to confirm the steps still match what a beginner sees in 2026 wallets.

Finding: The guidance holds: the highest-leverage habit is still 'read the signature type, revoke stale approvals'. The drainer surface has shifted toward permit/permit2 gasless signatures, which our guide already flags.

What changed: We added emphasis that a gasless 'signature' (no network fee) can still authorize a drain — the absence of a fee is not proof an action is safe.

Primary source: Ethereum wallets (Ethereum.org)

One myth, killed

"A real recovery service can reverse a crypto theft if you pay them first."

Reality: On-chain transfers are final; there is no central operator who can claw them back. Services that guarantee recovery for an up-front fee are, in the pattern data, overwhelmingly a second scam aimed at people who already lost funds.

Why the myth persists: Loss makes people hopeful and rushed, and a confident 'we can get it back' answers exactly the wish a victim has. That emotional fit — not any technical reality — is what keeps the pattern profitable.

Primary source: Public Service Announcement: Cryptocurrency Recovery Scams (FBI Internet Crime Complaint Center (IC3))