Tom, Harry, Dick and your Aunt May can be easily deceived and led to send all their savings to cryptocurrency exchanges, and even take out loans to send more. Here are some of the very insidious social engineering that we think can reduce the pig-killing scams (using influence or persuasion to deceive others to obtain useful information, which is a hacking method that has caused great threats and losses to companies or individuals in recent years.), instead of simply naming it a pig-killing scam.

When a new customer registers:

Ask them how much money they plan to keep in the exchange or wallet.

Conduct a financial background check (asking about average annual income, total assets and cash, credit check, etc.).

These (self-reported) numbers can be used as a baseline for high-frequency trading monitoring.

Investigate why they opened an account for someone else or under their guidance (for trading, sending, learning, HODLing, etc?)

Take a short quiz on how cryptocurrencies work and even the terms and conditions, disclosures, and disclaimers of exchanges.

The banks did this, and the surprising result is that too many scam victims thought cryptocurrency exchanges were like credit card companies and could do chargebacks or only allow transactions with verified merchants.

Increase due diligence at higher levels, such as when a user exceeds a certain amount in their transaction history (e.g. $10,000) and/or a threshold they set themselves. Send prompts with leading questions, including open-ended questions:

“Are you planning to exceed your limit? Why?”

When sending cryptocurrencies - “If you have a problem with the recipient, how/where/who will you contact?”

"Did anyone teach you? If so, where did you meet this person? Only online?"

Would this be too onerous to implement? Perhaps it would make the customer experience too painful and introduce too much friction. But scams are a far more deadly pain than these cumbersome steps. Much of the above is not too far off from the customer due diligence recommendations in the latest FATF guidance for cryptocurrency exchanges.

Aftermath

When a scam occurs, here are the actions that exchanges can (and must) take after confirming a reported scam to facilitate the next steps for victims and law enforcement. It can reduce the pain of victims.

Immediately freeze all outgoing transactions and reported addresses.

By default, a list of all of the victim's transaction IDs (TXIDs) is sent or indicated to the victim.

Regardless, TXID is always and every time asked by investigators, but many exchanges make it difficult for their users to find or understand TXID. (Note: The full name of TxID is Transaction ID, also known as transaction hash, which is used to query the transfer process, transaction status, and other information of asset recharge or withdrawal.)

Provide basic tracking or data-driven attribution models for wallets (attribution models that analyze traffic data), especially if there is a wallet hosted by an exchange.

Information on the blockchain is not confidential with many public attribute data already public, and in any case this comes at no cost to exchanges who all have transaction monitoring (so-called Know-Your-Transaction or KYT).

Insurance isn’t just for businesses

There may not be a business case for offering fraud insurance to customers, and this may have to come from the top. The irreversibility of payments is a feature of cryptocurrency transactions, but some insurance could go a long way in boosting consumer confidence. Here are some ideas that deserve serious consideration if there is hope for mainstream adoption of cryptocurrency:

Fraud insurance for victims of new fraud schemes – “honest mistakes” and “blameless” situations.

Sharing costs with recognised fraud victims, similar to the UK's emergency reimbursement model code.

Victims of fraud come from all walks of life or are in vulnerable mental states, and fraudsters can be as patient, innovative, and clever as anyone you may know. Without these facilitating “assistances” from online and financial service providers, today’s most destructive scams would not be possible, yet victims bear the brunt of the process. For these companies, investing in adequate fraud detection capabilities gives them little incentive to implement them until it’s too late. Social media technology and telecommunications companies should also contribute to this insurance fund. What if their contributions could be inversely proportional to the number of people who were scammed through their platforms in the previous year?