Posted By ASEC , April 8, 2024

Online Scams: I Just Wanted to Make a Lot of Money Easily

Online investment scams these days are no longer an issue limited to specific nations, now becoming a social issue prevalent around the globe. Scammers (criminals) deceive their victims through illegal and immoral means, extorting financial assets including cash and virtual assets from them. They are usually a part of a structured criminal syndicate, where they devise sophisticated scenarios to commit “transnational” fraud crimes. Anyone can fall victim to their expertise and slick persuasion, regardless of age, income, or intelligence.

The root causes of online investment scams are people’s tendency nowadays to prioritize material value and their desire to accumulate wealth. In fact, most victims of such scams tried to amass wealth quickly and easily by investing the limited money they had. Scammers play into this desire with compelling words such as “guaranteed,” “high return,” and “short period” to stimulate their victims into investing, and they even impersonate professionals and celebrities or present falsified materials to make sure to earn their victims’ unwavering trust.

AhnLab SEcurity intelligence Center (ASEC) regards such online scams targeting the general public as a serious cyber threat and aims to reduce damage by illustrating their characteristics and the current trend. Some types of fraud were found simultaneously in Asian countries, such as South Korea, Japan, Thailand, and Singapore.

The content of this post is valid as of currently, and the screenshots and messages were all from actual fraud schemes. Fraudulent websites that are still accessible and the victims’ identity information have been masked.

AhnLab ENDPOINT PLUS protects its customers by blocking the fraudulent websites, mobile apps, and messages explained in this post.

Details

I Trusted Them
- Impersonation and Fabrication
- Platform Ads Impersonating Celebrities in Each Country
- Messenger App Chat Rooms
- Out of the Loop
- Fraudulent Websites and Mobile Apps
It Seemed Like a Reliable, Lucrative Side Job
- Illegal Casino Betting
- Marketing Fraud
- Group Buying
I Thought It Was a Special Opportunity
- Lottery Number Recommendations
- Purchasing IPO Stocks
Follow-up Scams Causing Further Damage

Definition

Scams and frauds are crimes that aim to generate financial gain, steal intellectual properties, or gain unauthorized access to the victims’ assets by deceiving them through illegal and immoral means. Although scams and frauds are similar concepts, scams use direct channels such as calls, messages, emails, messengers, social media, and websites to prompt victims to voluntarily perform the scammer’s intended actions. On the other hand, fraud focuses more on financial losses and includes criminal acts that occur without the victim’s realization, such as illegitimate transactions or identity theft. In this article, both terms were used interchangeably, depending on the context.

I Trusted Them

Impersonation and Fabrication

Unauthorized use of photos of celebrities is one of the tactics employed by scammers. The original photos were fabricated to look like the celebrities themselves had written messages that convinced readers to invest, and these fabricated photos were used for advertisements on fraudulent websites. Screenshots of transaction histories and messages that were meant to be “proof” of investment also turned out to be falsified.

On some websites designed for investment scams, there are links that redirect users to mobile messengers. Scammers directly communicated with their victims through such messengers and convinced them to make a deposit to a fake virtual asset service provider. Some scammers were fluent in Korean.

Below is a fraudulent website that has perfectly imitated the original online news article, including its layout, color, and font. The article is about a celebrity who has made a profit using an investment platform, but this is completely fake news. Websites and fake articles impersonating the celebrity have been found since January 2024, but the same content was still found on March 26th as well.

To note, the investment platform mentioned in the article is also fraudulent. Depending on the route taken to access the website, the language and impersonated celebrities changed. Aside from South Korea, the targeted countries (languages) were identified to be Singapore, Japan, and China. The case seems to be a global investment scam that is not limited to specific countries.

Platform Ads Impersonating Celebrities in Each Country

Recently, there has been a rise in the number of advertisements on platforms with content related investment scams impersonating celebrities. These ads are frequently exposed on digital platforms with numerous users such as Google, YouTube, Instagram, and Facebook. The celebrities in the ads claim that they amassed wealth using a special method and investment information and that they will reveal that secret. Victims click the link because they either trust the celebrities’ claims or out of sheer curiosity invoked by the intriguing thumbnails.

Platform ads that impersonate celebrities are not a problem that is happening only in Korea. Countries in Asia such as Thailand and Japan are also seeing investment scam ads that impersonate others. Below is a case where the same advertiser is providing different scam ads depending on the country. The people in the ads are all well-known financial experts or celebrities with social influence in each country. Regardless of the country or celebrity, clicking the ad redirects the user to a website designed for an investment scam.

Such scam ads are found when searching on Google or YouTube as well. Even just searching keywords related to investment showed multiple scam websites at the top. Clicking any of the ad links takes the user to a scam website that impersonates celebrities. This resulted in a lot of damage, as users did not doubt the celebrities and the ads on such well-known platforms.

The screenshot below shows the results of searching keywords related to investment such as “soaring stocks” or “investing in stocks” on Google and YouTube on March 25th. Websites and YouTube videos in the search results were all fraudulent.

The platform industry is, of course, trying to address this issue. In addition to deleting and blocking ads that violate their policies, they are also putting effort into preventing the abuse of ads on platforms.^[1] When we searched again on March 29th, we noticed that a considerable number of illegally impersonating ads had been deleted. However, that does not mean they have all disappeared—ads impersonating celebrities are still prevalent on Meta platforms such as Instagram and Facebook.

Such ads cause a great deal of damage to the celebrities’ images. Celebrities in Korea recently held a press conference along with a statement, demanding a solution to this problem.^[2] The Korean government also announced that it will block illegal online ads and conduct a thorough investigation into illegal investment scams.^[3] Even in Japan, there have been multiple press articles about the damage caused by impersonation since last year.^[4]

Messenger App Chat Rooms

Scammers communicate with potential victims through mobile messenger apps, such as Telegram, Line, KakaoTalk, and Band. Victims end up in these chat rooms through ads on platforms that impersonate celebrities or messenger app links on fraudulent websites. They also join the chat rooms through text messages that are sent to random individuals. The actual investment scamming happens in these group chats.

Out of the Loop

Scammers were clever in making use of the fact that people are heavily influenced by the words and behaviors of others when investing. These scammers invited their victims to a group chat with a dozen and possibly up to hundreds of users. On the surface, this chat room is an illegal “leading room” (a Korean term that refers to such chat rooms, also known as “reading room”) where users share information on stocks and investments and also recommend items. In Korea, recommending investment items or advising to invest without being registered as a quasi-investment advisory business is illegal.

However, the real identity of such chat rooms is a well-planned scheme, with its majority comprised of scammers and the victims in the minority. In this group chat, there is one investment “expert” who shares investment information and recommends items, and there is a supporter who supports this expert and acts as a bridge between them and other users. There are also multiple “investors” who respond and endorse the two. These “investors” claim that they made a profit by listening to the expert and will continue to invest with their full trust in the expert. All of them are actually a part of the same scammer syndicate and are only playing their roles in a big fraud scheme.

In reality, besides the paid actors mentioned above, there is only a small number of potential victims in such chat rooms. After seeing “proof” of profit from other investors and other various materials that prove that the expert is trustworthy, this minority also decides to invest as well.

This whole process does not happen in a short period of time. In fact, it takes at least 2 to 3 weeks or even several months. The long process is supposed to be a screen that picks out innocent victims who are likely to actually invest. During this period, when a victim doubts the expert or says something that ruins the scheme, the message gets deleted instantly and the victim is kicked out of the chat.

Each chat room has its own fraud scenario including the expert’s identity and method of investing. The important thing to note is that all of this seems very natural and quite trustworthy. In fact, one group of scammers impersonated an existing investment company and built an actual office. Their website was also made to look identical to the original and it included a video where they acted out their “play.” They were not hesitant in showing their faces as well.

Scammers put in a lot of effort to earn the investors’ trust and interest by sending them fake press releases, links to live lectures on investment, gift cards, and even asking them how their day was every day. Scammers who acted as experts on politically-themed stocks showed vast knowledge of the current state of Korea’s stock market. Although some scammers could speak fluent Korean, most sounded somewhat awkward.

Fraudulent Websites and Mobile Apps

Scammers send links to websites or mobile apps that allow the management of investment funds to the targets who wish to invest. This information is sent individually and not through the group chat. As the mobile apps are registered on official app stores such as Google Play or Apple,^[5] victims do not raise doubts. These apps actually only have a web viewing feature, so the website and app both show the same screen.

Although they have an interface that displays investment-related information and asset status, the real purpose is to receive investments. Victims must send pictures of the front and back of their identity cards for screening to be able to deposit their money for investment. This means that victims of investment scams have their identification data stolen in addition to losing money. Such tricks can cause secondary damage.

The screenshots below are the websites and apps used for investment scams in and outside of Korea. To note, they can all be accessed currently. Only the authorized users targeted by the scammers can log in and invest.

It Seemed Like a Reliable, Lucrative Side Job

Illegal Casino Betting

Scammers typically use Instagram to approach multiple housewives or women by following their accounts or through DM. The scammers’ Instagram accounts have a lot of pictures of expensive goods and other pictures that suggest they are affluent. The pictures do not actually belong to the scammers and were used without the owners’ consent. However, reading that they could also live an affluent life as depicted in the fake Instagram accounts through a quick, easy way, victims message first.

When they are contacted, the scammers reveal that their secret to success is a simple online game and ask the victims to “add funds” on websites that are all illegal casinos. They promise principal protection and actually return the profit in the initial stages of investment. However, when the investment amount grows larger, they do not return the investor’s money citing various reasons and rather ask for additional investment.

Marketing Fraud

Marketing fraud can happen in a legitimate marketing company. At first, the company recruits people who are looking for side jobs and provides them with a marketing platform and some work for a price. A victim has to pay thousands of dollars in advance as an admission fee (lesson fee) at the initial stage of the side job. Victims may actually be able to make a bit of profit by posting ads on blogs, writing product tester reviews, or running an online store.

The problem is that the marketing company does not manage these resources itself and instead relies on the individuals. Such marketing side jobs are structured so that an individual recruits other people online and provides them with lessons and work. Recruiting new people is what returns a high profit, and the profit from actual work is much lower than that. As such, there are many cases where these individuals recruit new people but do not keep contact or even cut off contact with them.

If one fails to attract other people into their marketing side job and only does the actual work, it takes a considerable period of time to recover the initial investment. This means that marketing side jobs can be a kind of pyramid scheme, while also being an actually decent side job for a minority.

Group Buying

Scammers send text messages to random individuals, advising them to take on a side job. Just like other side job frauds, they say it is an easy job that anyone can do and ask their victims to contact them through a messenger. The job here is package forwarding service, where the victim purchases a product with their funds and receives a fixed profit.

When a scammer earns the victim’s trust after giving the profit multiple times, they raise the price of the product. In order to make even more profit, the victim invests thousands to tens of thousands of dollars. This process leads to group buying where several individuals gather to purchase a product, but the other members in the group are actually scammers. On the pretext of cooperation and achieving a common goal, they make the victim put down even more money.

Even when the victim quits the side job and tries to retrieve the bare minimum of their funds, the scammer uses all kinds of tricks such as commission and tax to extort even more money from them.^[6]

I Thought It Was a Special Opportunity

Lottery Number Recommendations

These scams are usually distributed to random individuals through text messages, and they prompt the readers to pay a lesson fee for lottery number predictions or to play illegal gambling games. Lottery number scams have been widely used since a long time ago, but it is still prevalent today. All the licenses, certificates, and proof of profit are fabricated.

Purchasing IPO Stocks

Scammers impersonate companies that are expected to be listed to offer a “special” IPO that does not actually exist. The fraudulent website is identical to the original, and the only difference is that the former has fields where victims enter their personal information to apply for the shares. When the scammer receives the subscription price from the victim, they disappear.

Follow-up Scams Causing Further Damage

When a person becomes a victim of fraud, they tend to search for information on damage relief in online communities. There are scammers who see this as an opportunity, and this leads to follow-up scams. With the victim already in a state of panic, they easily trust the scammer who claims that they can recover the lost funds. The scammer extorts money from them by ordering the victim to do things they would not normally do, such as raising a temporary fund and sending it to the scammer. Follow-up scams use victims’ anxious and desperate state of mind.