Phishing: Fake lawyer letters promise crypto credits

The State Office of Criminal Investigation of Lower Saxony warns of a creative and convincing phishing scam. It starts with fake mail from a lawyer promising a credit note after an alleged crypto asset scam.

On the Polizei-Praevention.de portal of the Lower Saxony Criminal Police Office, the officers go into the details of the attack on unsuspecting recipients of the letters. The potential victims receive a letter in which a (false) law firm states that the recipients are entitled to compensation of 50.000 euros. They would only have to prove their identity for the account set up for this purpose. The LKA points out that both the law firm and the financial service providers named in the letter are fake.

The scam seems credible, as there is currently an increase in crypto fraud. Systematic raids are taking place from call centers, for example, and Europol has already found and closed down a number of them. There are many victims across Germany who have invested large sums in supposedly secure systems but have been defrauded in the process, according to the LKA in Hanover.

Real data contained in letters

Another factor that increases credibility is the provision of the recipient's personal details, such as their correct name, address, email address, telephone number, date of birth and bank name. The origin of the data is unknown, but it typically comes from hacked accounts at companies where the victims are customers, for example. Social media portals, lottery entries, copies of ID cards on classified ad portals or "normal" phishing are also possible sources, the officials write.

The letters also contain access data to access the alleged account for which victims are supposed to "legitimize" themselves. The letter also contains a QR code that leads to a WhatsApp contact.

The LKA has actually received two reports of this scam. Due to the effort involved with fake lawyer's letters and independent websites of fake financial service providers, the authority assumes that more of these letters are in circulation nationwide.

It is therefore not clear what the victims are actually being asked to pay, as the recipients did not take part in the scam. They also stated that they had not been taken in by other phishing or similar scams. The LKA suspects that "further personal data (copies of ID), bank details, access data for online banking, bank transfers to be paid as an advance fee/processing fee, activation of a bank account (which is later misused for money laundering)" are probably requested on the websites.

However, the LKA Lower Saxony recommends that recipients should not respond to such letters. They should also not disclose any other personal data or pictures of IDs via WhatsApp, email or telephone. The law enforcement agencies also recommend that recipients contact their local police authority. Anyone who has been taken in by this scam should report it to them immediately. If bank and access data has been transmitted, victims should also contact their financial institution.

(dmk)