Cybercriminals Turn Official Cyber Tool into Trojan Horse for Crypto Heists

Australian authorities have issued urgent warnings as cybercriminals exploit the nation's official cybercrime reporting system to deceive cryptocurrency holders into surrendering their digital assets. The Australian Federal Police (AFP) and its Joint Policing Cybercrime Coordination Centre (JPC3) disclosed that scammers are leveraging the government's ReportCyber platform to impersonate law enforcement officers, creating a sophisticated fraud scheme that preys on victims' trust in legitimate processes.

The scam unfolds in two stages. First, fraudsters steal personal information - such as email addresses and phone numbers - to file fraudulent reports on the ReportCyber portal, a tool designed for citizens to report cybercrimes. Shortly after, the victims receive calls from individuals posing as AFP officers, who claim their names appear in a cryptocurrency-related data breach and provide a fabricated reference number tied to the false ReportCyber submission according to AFP. This reference number, often displayed on the official platform, lends credibility to the scam, pressuring victims to act quickly.

A second caller, impersonating a cryptocurrency platform representative, then urges the victim to transfer funds to a "secure" cold storage wallet. In one documented case, a victim recognized the deception and hung up before losing money.

AFP Detective Superintendent Marie Andersson emphasized that these scams exploit the platform's design, which allows third-party reporting on behalf of victims. "The scammers verify personal information in ways that match common expectations and act quickly to create a sense of urgency," she explained. The AFP warned that similar schemes have also used spoofed phone numbers mimicking official lines to further deceive targets.

Authorities stress that legitimate law enforcement officials will never request access to cryptocurrency wallets, seed phrases, or banking details. The AFP advises Australians to terminate any call about a ReportCyber report they did not file and to contact the official hotline at 1300 CYBER1 immediately. The JPC3 reiterated that ReportCyber remains a secure tool for reporting cybercrime but urged the public to remain vigilant against tactics that misuse the platform's legitimacy.

This warning arrives amid broader efforts to combat crypto-related fraud. In October, Home Affairs Minister Tony Burke announced legislation targeting crypto ATMs, which he labeled "high-risk products" linked to money laundering and exploitation. The Australian Securities and Investments Commission (ASIC) has also intensified its crackdown, removing over 14,000 scam sites since July 2023, with 20% tied to cryptocurrency fraud.

The AFP's alert highlights a growing trend of increasingly sophisticated cybercrime, where criminals exploit regulatory tools to erode public trust. As Australia's crypto market expands, officials are urging both individuals and institutions to adopt robust security measures and report suspicious activity promptly.