FYI.

This story is over 5 years old.

Tech

Cybercriminals Are Taking Advantage of Venezuela's Economic Crisis

Facebook, Instagram, and WhatsApp social engineering scams have become common in the country.
Cybercriminals target Venezuelans through social media

A version of this article originally appeared on VICE en Español.

Venezuela is currently home to one of the worst economies in the world. The inflation rate, which hit 1,000,000 percent by the end of 2018, has forced Venezuelans to adopt survival methods. One of these is called foreign remittances. An old Cuban friend of mine described this mode of surviving as "Fe," the Spanish word for faith. But she wasn’t referring to one’s belief in God, nature, or a politician. Fe was just an abbreviation for familiares en el extranjero, or “relatives abroad” who earn wages in stronger currencies and transfer funds to their loved ones who still live in the country.

Advertisement

Sending money through social media is a fairly routine practice in 2018: in Venezuela, when you go on Facebook, you can see advertisements for USD or euro sales at the current exchange rate in bolívars and people negotiating in the comments about the exchange rates. Generally the transaction is fast: one person offers a quantity of a foreign currency for a certain price, the interested buyer sends a transfer in bolívars, and the seller sends them the dollars in return.

This virtual process is so simple that it presented an attractive opportunity to people who steal for a living to quickly scam someone without much effort or resorting to violence. Previously, in order to successfully steal money or ransom from someone, they had to kidnap them, which required pulling off a large intelligence job beforehand: Follow the person for months, work out their schedule, where they live, who they hang out with. Today, social media makes it easier.

How do thieves steal when there’s nothing there?

While it may seem that there is little to nothing to steal in Venezuela, the $50, $100, or $300 USD that a person sends to their relatives at home can make the difference between life and death for many Venezuelans.

Criminals prey upon their target’s social media in one of two different ways. First, they’ll monitor the account to get any information necessary for pulling off a heist; second, they’ll fake or steal their identity. By disguising themselves or hacking the account, they trick that person’s friends and convince them to send money. Their key targets are the elderly, who are generally less tech-savvy than younger people, but they also prey upon Venezuelan expats who’ve left their guard down because they’ve moved to safer territories. Social media makes it easy for criminals to create a false air of trust, and by the time the buyer realizes they’ve been scammed, it’s too late: the money has gone through several accounts and the trail is lost.

Advertisement

This is what happened to Luis Dascoli, a Venezuelan man who’s lived in the United States for several years now and who—like many of those who left in the mass exodus of the last few years—still has friends and family in the country. A few weeks ago, he received a strange late-night message on WhatsApp from a childhood friend with whom he’s frequently in contact. In the text, his friend told him that he would make a transfer for $400 USD the following day. Dascoli realized something was wrong and later discovered that his account in Facebook had been hacked by someone who’d tricked his friends and other contacts into a currency transfer that wasn’t actually going to happen.

"When I received the message I didn’t understand at all. I asked him to send me the screenshots of the conversation and had to explain to him that I hadn’t been the one offering anything," Dascoli recalled. "Fortunately, he had the thought to contact me [off of Facebook] because he was being asked for $400 [USD] and was about to make the transfer.” Dascoli also learned of another case in which one of his mother’s friends was hacked on Instagram and her followers accused her of trying to scam, when in reality a third party had discovered her password and attempted to scam her.

Lucía Ramírez, who lives in Caracas, had a similar experience. She saves everything she earns from her graphic design business in the hopes of emigrating to Chile. “The truth is that I don’t earn so much when I exchange bolívars for dollars. In a good month, I can make $100 or $120, but everything depends on whether I exchange the money quickly because inflation eats it up,” she explained. "I was having a hard time [financially], so when I saw that a ex-boyfriend from school who lives in the United States was [offering] to exchange [bolívars for USD], I didn’t hesitate before writing to him.”

Advertisement

Ramírez asked him the price of each dollar. When she learned he was charging below the black market offer, she decided to take him up on it. “I transferred 15,000 bolívars to a current account that wasn’t actually his, but I didn’t stop at that because if I closed the deal I’d have about $111 USD in my Paypal account." Unlike Dascoli’s friend, Ramírez didn’t verify via telephone if it was actually her ex who was offering the money. “I did ask him why he wasn’t using his own account—he told me it was to pay a debt in Venezuela, and that this was a quicker way of getting out of it. I fell right into the trap because I wanted to get more out of my money and I got screwed over.”

The frequency of these instances has prompted questions about what measures should be taken to combat this new wave of cybercrime. But those questions rarely lead to actionable results: there’s a general lack of confidence in Venezuelan institutions, and—as human rights organizations have previously demonstrated—such institutions are partly to blame for the complex complex humanitarian crisis in the country.

I talked to a spokesperson for the Body of Investigation, Science and Crime (CICPC, or Cuerpo de Investigaciones Científicas, Penales y Criminalísticas in Spanish). This person said that Venezuelan police departments are inundated with reports from people whose Facebook or Instagram accounts have been hacked, as well as from people who have fallen for the scam.

Advertisement

“These scams are sometimes carried out by lone wolves, but usually they’re organizations comprised of people who are imprisoned and who have contacts on the outside who are able to conduct the scam,” he explained.

The CICPC officer insists that these cyber attacks don’t require great technological advancement to execute. “[Thieves] use social engineering to get easy clues about the victims,” he said. “We receive these reports all the time, but there’s not much we can do because these people are already imprisoned and have a blanket of impunity."

He added that they’ve arrested several individuals, but many of the scammers are in the 905 area, a neighborhood that overlaps with one of the "peace zones" imposed by President Nicolás Maduro in 2013. The zones were created with the objective of disarming gangs in the most dangerous places in Venezuela; the basic premise is that police aren’t allowed to enter these peace zones in the hopes that their absence will encourage criminal gangs to stop enacting violence on innocent civilians who live there.

But not all is lost. Rogelio López, who works for Access Now, a large Digital Rights organization, urges individuals to stay alert and learn to identify signals like suspicious inquiries for personal information, invitations to download files, or sketchy links. “These [phishing attempts] usually try to alarm us or create a sense of urgency for us to do things we wouldn’t normally do," López explains. These attempts prompt us to deliver sensitive information without realizing it to a third party who can use that data however they please.

López stresses the importance of having complex passwords and enabling two-factor authentication for any social accounts. While not 100 percent effective, both increase one’s chances of staying safe when a criminal entity is eyeing our information. There are a slew of ways you can protect yourself against getting hacked, and generally being more cautious online is one of them. The internet is more than a place to vent, comment on current events, or seek validation from likes—it’s also a fertile ground for crime, one where the concept of Fe has been weaponized for criminal gain.