A popular Instagram account with nearly 20,000 followers has been engaging in a crypto investment scam that involved the hijacking of accounts and bilked unknown amounts of money out of the Meta platform's users, a Snopes investigation has found.
We determined that Instagram user @miss_anna.fx, who went by the name "Anna," has been running a cryptocurrency scam for at least several months. The scammer, who describes himself or herself as a "crypto miner" and an "expert in binary option trading," gives false promises of a "100% payout" of funds. The account has also been engaging in what the Better Business Bureau referred to as "hijacking." This allows @miss_anna.fx to market the fake crypto business to friends of compromised accounts in an attempt to give the entire ruse a more trustworthy appearance.
The scammer's account features pictures of a successful-looking woman sitting in flashy cars, going to seminars, working on a laptop on the beach, and going on vacation in New York. With the exception of one photograph, all of the pictures on the account were posted on one day: Nov. 26, 2021. All signs pointed to the likelihood that these photographs had been stolen from another user without the user's knowledge in order to make the Instagram page appear more legitimate. We were able to find out where the scammer obtained the pictures by means of a search function in the Instagram app.
We contacted Meta's media relations team to notify it about @miss_anna.fx's Instagram scam. In response, a Meta company spokesperson said: "We looked into the account and have disabled it for violating our impersonation policies." We previously infiltrated a different crypto scam on Facebook and Messenger and reported it by email to Meta's media relations team. However, it was all still active weeks later. We never received an answer from the company, nor did it appear to take action on that prior scam.
How the Instagram Scam Is Marketed
The scam run by the @miss_anna.fx Instagram account involved two key components: marketing and execution.
In order to market @miss_anna.fx's fake crypto business, Instagram accounts are hijacked. Next, @miss_anna.fx requests that the owners of compromised accounts make a video promoting the fake crypto business in order to regain control of the account. That video is then shared with friends from the compromised account, giving the entire scam a legitimate appearance. The BBB reported that personal information is sometimes requested instead of a video:
It all starts with a direct message in Instagram from what looks like a person whom you follow. They may ask you to take a survey to help with a new job they just got, act friendly and see if you're interested in making a lot of money in cryptocurrency, or tell you to “check out this cool video,” or some other message. The message includes a link that they want you to click. At this point in the conversation, you may not realize your friend’s account has been compromised by a scammer who is looking to hijack your account as well.
If the link is clicked, your Instagram account will also be compromised. The scammer then notifies you that in order to regain access to your account, you must film a video or send photo proof stating you have invested in some type of cryptocurrency and encourage your followers to do the same. Recording the video for the scammer to post may, or may not, actually get your account back, and in the meantime, the scammer is reaching out to your followers and friends via direct message, pretending to be you, with a malicious link that is encouraging them to invest in cryptocurrency.
The BBB also published a library of tips for consumers to help protect them from becoming involved in these kinds of cryptocurrency investment scams on social media.
How the Instagram Scam Is Executed
The @miss_anna.fx account executes the ruse inside private messages on the social media platform in order to keep the fraud out of the public eye. We engaged with the scammer to document the methods.
The script used by the scammer began with the following message that was meant to educate potential victims:
Bitcoin mining is a fast growing online stock market where investors/ entrepreneurs trade in Gold, Currency, Crypto Currency Within 4hours of trading making huge profits.You don't need any experience or skill as we will setup, manage and trade for you in my company trading signal and it's the best regards of trading signals
English did not appear to be the scammer's primary language, despite the fact that "Anna" claimed to be from Texas. It's unclear where the person or people who operated the crypto scam on the @miss_anna.fx Instagram account were located. However, it was highly unlikely that it was being managed from within the U.S.
After "educating" potential victims, the @miss_anna.fx scammer account then asked users to visit Changelly.com, Crypto.com, or another website that provides a platform for exchanging crypto. "Clink on the link and send screenshot let me direct you on how to purchase bitcoin," the scammer said. "Just clink on the link Clink and send me screenshot."
Once users are on Changelly or Crypto.com, the scammer requests that they send $500 to be invested in Bitcoin. The recipient address given to us by the scammer was as follows: bc1q58ey2zmrjt7dqvq4aelhtgn2d9ayg77ape3725. "Clink on buy and send me screenshot," the scammer wrote. The person was repeatedly insistent that we send screenshots to show that we were following instructions every step of the way.
We sent no money to the scammer. The unsuspecting victims who engaged with @miss_anna.fx likely never saw their money again.
Tracking the Funds
According to blockchain.com, the address given to us by the scammer had taken in nearly $52,000 since November 2021. Once the money came in, it was transferred to a second address that showed nearly $1.7 million in exchanges. It's possible that this second address was a small crypto exchange. (For readers unfamiliar with cryptocurrency terms, an exchange is kind of like a bank.) However, if the second address wasn't the address for a small exchange, it could also have been the main place where a network of scammers all drop off their funds, showing that the first address given by @miss_anna.fx may have been a small part of a larger operation.
Most of the close to $1.7 million in funds in the second address was then sent to a third address that showed hundreds of billions in received funds.
We searched Google for any reporting about the third address (bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h) in order to find out more. That search led to reporting on BitcoinMagazine.com by Mike Ermolaev, the head of public relations at the crypto exchange ChangeNOW. All signs pointed to the third address belonging to a large exchange known as Binance.
According to our research, sending the money to Binance would then perhaps allow the scammed funds to be laundered into a different currency that the scammers could use themselves.
While the methods used by the scammer appeared to be clear, we were left wondering about the woman in the pictures. We wanted to be able to contact her to let her know her photographs were being used in a scam.
Restaurant Photograph
We attempted to reverse-image search several of the woman's pictures that had been posted on the @miss_anna.fx account. However, those searches on Google and TinEye turned up no helpful results.
One of the photographs showed the woman standing in front of a restaurant named Lions & Tigers & Squares Detroit Pizza. A Google search showed that it was located in New York City. We then searched the Instagram app for the pizzeria and tapped "Places" to find out if the woman in the picture tagged the restaurant when she originally posted the photograph.
After scrolling all the way back to 2019, we found the same picture:
The scammer, @miss_anna.fx, had stolen all of the photographs used by the account from @pattyapproves. The @pattyapproves user had nothing to do with the scam. (We reached out to notify @pattyapproves of what happened, but have yet to hear back.)
Reporting the Scammer
We reported the scammer to both Changelly and Binance. We also attempted to contact Crypto.com. In response, Changelly's security team said it had blocked the account from any further exchanges on the platform. "Every day, we’re striving to keep our customers and the crypto community safe against all kinds of scammers and hackers out there," the company said in a statement. "That’s why we highly appreciate your help and informing us! This wallet address has been added to our blacklist. Thank you for your cooperation, and stay vigilant!"
Binance sent the following statement: "At Binance, security is our priority. We work with law enforcement agents and security firms every day to help take down fraudsters. We are extremely proactive in combating scams and educating individuals on how to protect themselves from potential crypto scams. We have sophisticated tools and processes that allow us to automatically identify and thwart fraudulent activities."
Crypto.com provided answers to us and advised on what consumers should do should they become victims of fraud:
Crypto.com is committed to security and we take a proactive approach to external threats, including scam and phishing campaigns. Once we verify that a wallet address is linked to a scam it is taken down immediately to prevent further transfers.
As with all financial transactions, fiat or crypto, it is critical to ensure the account receiving funds is legitimate and its owner is identified and trustworthy prior to the transfer. Cryptocurrency transactions are recorded on the blockchain and thus irreversible, increasing the importance of establishing trust and legitimacy when transferring funds.
Security is a shared responsibility, and we encourage our users to verify the account where they are sending funds before completing transfers. We also offer our customers the ability to create anti-phishing passcodes so they are assured all emails from Crypto.com are authentic.
Crypto.com advises all victims of fraud to file a police report to initiate a law enforcement investigation. Knowledge is key to preventing fraud, and we will continue to do all we can to help protect our customers.
We later sent Changelly a second address that was provided by the scammer: bc1qg0cdxrghmywt6s7hx84yvlsh82jwvjnqx4au6s.
For further reading on recent reports of fraud, visit our dedicated page for scams.