The current banking restrictions in India on Cryptocurrency trading combined with the lower trade volumes on exchanges have pushed people to trade on Peer-to-Peer exchanges. One such popular, high volume P2P exchange is LocalBitcoins.
LocalBitcoins is one of the widely used Peer-to-Peer Bitcoin exchange in the world. It is also one of the most vulnerable platforms for users to be scammed. Despite all the security measures, people do get scammed on the exchange.
This particular story is from India. A user was scammed of almost 2 Bitcoins on LBC with sophisticated methods such as sms spoofing, evidence tampering and downright lying to the admins of localbitcoins. At the end, a keen observation helped the user when all hope seemed to have been lost.
As I write the story, I will add pointers on how the situation could have been avoided or can be avoided in future, for our readers to stay safe the next time they trade on LocalBitcoins.
Contents
Scammer Opens a Trade Request
The protagonist of the story is Arun. Arun, who often trades on LBC placed an ad to sell 2 BTC. Two BTC will roughly be about 9.5 lac INR or 13000 USD today. He received a trade request from a buyer Shoibsheikh786 (The user has now been suspended).
Arun was sceptical to trade with the buyer as the buyer was new and had no feedback score. However, as a limitation on LBC, once a buyer opens a trade request, the seller cannot cancel the trade. So Arun was stuck.
Safety Tip: While placing a trade ad, always setup the following fields:
Minimum Feedback Score
New Buyer Limit
Security options such as Identity verified people only (KYC), SMS verified people only and so on.
Seller Verifies Details
Arun, in his personal capacity asked for valid proofs from the buyer. He noticed that the buyer’s IP address is pointing to Indonesia, but his phone number is verified to be Canadian and he shared an Indian Passport as ID Proof.
The Passport was in the name of “Shamin Ahmad” from Uttar Pradesh. The signature of the passport holder was in Hindi. Coin Crunch has received the copy of the passport uploaded on LocalBitcoins.
A couple of red flags here are – the number being from out of India and a passport belonging to someone who has a signature in Hindi, doesn’t have the same name as the localbitcoin user ID and the buyer speaks fluent English. But, despite knowing all of these, you cannot cancel the trade, because those are the rules of Localbitcoins. Some Indian P2P exchanges allow you to cancel trade requests.
Read: Best P2P exchanges for India
The Scam Begins
After Arun verifies the buyer details, he asks the Buyer to send the money to his bank account. The buyer says he already transferred the money and sends a screenshot.
The amount of 8 lac INR was transferred from PayTM Savings Bank to an Axis Bank account of Suman Swami, someone with no relation to Arun. After sending the screenshot, the buyer opened a dispute with LocalBitcoins claiming that Arun wasn’t transferring the BTC despite receiving the money.
Coin Crunch has verified with Axis Bank that this account number is invalid and does not belong to anyone.
Raising a Dispute
On most Peer-to-Peer exchanges, the BTC of the seller is held in Escrow, so neither the seller nor the buyer can access it until both parties confirm the transfer of fiat (INR). Since Arun did not receive the money, he did not confirm receiving it on LocalBitcoins, which gave an opportunity to both Buyer and Seller to raise a dispute.
During the dispute, an admin from LBC will connect with both parties, verify the proofs and make a decision on who gets the BTC. So, what happened when an admin joined the conversation of Arun and the scammer? We will find out.
Safety Tip: IMPS transaction limit in India is INR 200000, UPI limit is INR 100000, the above screenshot shows a transfer of INR 800000 for which you need an RTGS transfer unless it is a transaction within the same bank. Arun would have saved a lot of time if he knew this and acted on it. He didn’t. But you guys can learn from here.
With Fake Proofs, Scammer was Winning the Battle
The LocalBitcoins Admin joined the conversation on the website to resolve the dispute. Now, the real game of the scammer began.
The scammer narrated a fake story of an Over-The-Counter deal made by Suman(the name of the bank account holder) and him over text messages where Suman gave the above referenced Axis bank account number to transfer the money and asked scammer to create a LocalBitcoins account to complete the trade.
To substantiate the story, he shared SMS conversation records. He shared a video of those SMS on his phone. The number belonged to Arun, stored as “Suman BTC”. The scammer was able to have a chat with Arun’s number without Arun ever finding out. Read on to know the twist in the story.
Here, have a look.
How was the scammer Chatting with Arun’s phone number?
This can be achieved by a widely used scamming technique called Spoofing. With spoofing, one can send an SMS or call any number, with a fake number/caller ID. So essentially the scammer had a fake conversation with Arun’s mobile by using a spoofing service. But he did make a small mistake, we will get to that in a minute.
In India, it is illegal to use spoofing and there are strict measures taken to block access to spoofing service providers. But it does not stop scammers, tele marketeers and some enthusiastic students from using the craft.
“I can send you an sms or call you from any number you want, it might be illegal but there are loopholes to achieve it in India”, says an engineering student who prefers to remain anonymous. Indeed, the student sent me SMS from random numbers to prove spoofing works in India.
Another Student Karthik Varma from Vizag, showed us a demo on how to send SMS that seems like they are coming from promotional IDs such as from banks, stores, etc.
Safety Tip: We tend to leave our numbers on LocalBitcoins to make it easy for the traders to contact us and quickly complete the deal. However, it is very risky as you can see now.
You are likely to receive a lot of messages on Whatsapp to negotiate a deal on BTC offline. Do not engage in such deals.
Seller on the Verge of Losing 2 BTC
Coming back to the story. Arun was definitely losing the battle here. Scammer shared a video and boasted that while screenshots can be faked, a video cannot. Arun asked for more time from admin. He asked the scammer to send statements. Meanwhile Arun removed his phone number from the LocalBitcoins profile as the cause of all the problems was that his phone number was exposed.
The scammer told LBC Admin Arun is lying and has also removed his phone number. The case got murkier. Scammer had the proofs, Arun didn’t. All he could say is that he doesn’t know who Suman Swami is and hence cannot produce a statement of Suman Swami’s bank account.
Fortunately the LBC admin postponed the decision to Monday, October 22. This was enough time for Arun to collect evidence and prove the scammer wrong. Coin Crunch has received the records of this conversation.
Soon, Arun discovered a tiny flaw in the scammer’s plan and that was the kryptonite he needed to take him down.
The Tide Turned
Arun noticed that the phone number in the sms records shown by Scammer, only looked similar to Arun’s actual phone number. But in reality, there was 1 digit incorrect in it. To protect Arun’s number, Coin Crunch will not reveal which digit was wrong.
Arun reported this to the LBC admin and confronted the scammer. The scammer cancelled the trading request and apologised to Arun.
The scammer then revealed that he can spoof him with any number, even his own. He demonstrated it by calling Arun from Arun’s number, call redirection was active.
Safety Tip: While someone tries to pull an SMS spoof, you are at an advantage. Had the scammer actually used Arun’s correct number, all the replies that are shown in the video would go to Arun, who will know that he is being scammed and will have the record.
The scammer purposely changed one digit of the phone number and hoped that people will fall for his scam. Fortunately for Arun, he noticed it in time. You must be vigilant about it too.
Cryptocurrency is a largely unregulated market and scammers are trying to take advantage of innocent traders everywhere. It comes down on you to keep your money safe. Stay safe while trading or trade on Indian P2P exchanges which are more secure and KYC compliant.
Note: The scam was first brought to light on Indian Crypto community Indiabits
Read More:
This Peer to Peer Exchange Offers Fraud Insurance upto One BTC
