Guardian Papers 4: Beware the Impersonator

by GalaChain | May 10, 2024 | GalaChain, Guardian Papers

Congratulations hero, you’re ready for the second module of The Guardian Papers. In our introductory lessons, we discussed the absolute bedrock fundamentals for safely navigating the web3 frontier. Now that you’ve mastered the basics, it’s time to move on to the basics of digital self-defense in specific circumstances. 

If you feel like you need a refresher on any material covered in module 1, don’t hesitate to dive back in!

Prepare yourself to move on from simply scratching the surface. For module 2 we’re going to dive into the underbelly of digital villainy in the web3 world, and talk about some of the most common ways that the good people of the blockchain world are preyed upon.

To protect yourself, you must first understand the danger.

Scam Profile: The Impersonator

Imagine, noble citizen of the web3 world–

You’re minding your own business, heading over to GalaSwap to make a few small trades and maximize your May Mayhem experience.

You click a handy link off Discord to gaIaswap.gala.com. It loads a little slow and the layout looks to have changed very slightly… must’ve been an update. For some reason you aren’t logged in… that’s weird, you were just a little while ago. But that can be easily fixed! Then you notice something weird after you put in your transfer code… you can’t see your balances or accept any swaps! 

Suddenly panicking, you switch over to a new tab and open your inventory… oh no! Your wallet is drained! Looking back at that link… an upper-case ‘i’ sure looks a lot like a lowercase ‘L’ 😭

You’ve just fallen victim to an impersonator scam. This one may have been elegantly simple, but they come in all shapes and sizes. Even a small scam can mean total damage.

Did we even have to change the L to an i though? A link can be anything, the text that you see is just an anchor that the real URL is tied to. Case and point — where do you think this leads? Gala.com (I promise that L is not an i!)

This con relies on the scammer earning enough of your trust that you give them sensitive information before thinking twice. These types of scams get easier to recognize and rebuff as you become more experienced in the web3 world. They can also, however, almost always be prevented by maintaining normal security standards, no matter the situation.

The Personal Touch

We’re all humans and that means we’re instinctively social creatures. When a scammer is trying to gain your trust, they have two options. They can either set up an impersonal trap like we mentioned above, or they can reach out more directly to their victims. A wide-reaching trap may catch a few marks for them, but many scammers will target individuals knowing that it’s a faster way to generate the trust needed for the con to work.

Sometimes, even a simple misspelling or low effort fake name may be enough to trick someone.

In this example, someone in a hurry may not even notice that extra s before reaching out to their friendly, neighborhood Taco!

Since this scammer has Taco’s exact PFP, they are counting on the trust that people associate with that image making them let down their guard enough to get sensitive information.

Someone only has to trust the scammer for a few minutes to make a horrible mistake!

We all know to look out for scammers… and we’d all like to think that we’re far too observant for it EVER to happen to us. But it still happens. 

Just because someone is a scammer doesn’t mean they’re incompetent. They know what works and how often… after that it’s just a numbers game until we all wise up to their tactics.

Here’s one we’ve all likely seen before, but they’re almost always targeted at someone who needs help and isn’t aware of what proper steps to take next.

When we want help, we want to be helped. The scammers are counting on this. When you can’t figure out what to do to fix a problem, frustration will start to build. A good scammer sees how long you’ve been looking for answers, and understands how frustrated you must be getting with the situation.

After that, it’s just a matter of providing you what you want to see in that moment – someone offering a simple and quick solution. This is the kind of situation that arguably traps the most victims for the web3 bandits.

Humans tend to see what we want to see to some degree, particularly at elevated levels of stress. If you’ve ever fallen for these types of scams, you shouldn’t feel ashamed. Many scammers out there are very good at what they do… which is why we all have to know more so we can fight back better.

This particular scammer seems to have found the ideal mark… the victim announced that they are having trouble sending $GALA and that there’s a problem with their wallet connection. 

These are easy pickings for a scammer. Often when they are initiating the conversation, they’ll be attempting to extract very sensitive information, like your seed phase or transfer code. Since they know this person is having trouble connecting a wallet and sending $GALA, the bad guy wouldn’t have to gain full control over the wallet to make a buck off the poor mark.
Once they can grab you in DMs, they’ll start “tech support” on it, which will often end with you either sending $GALA to their address or linking your wallet to their dApp surprisingly quickly.

The key here is trust. Once someone has your trust, they can usually make you compromise one security measure or another using some tried and tested methods.

The phrase “con man” or “con artist” comes from “confidence man.” These are criminals that have always existed, though the term first came to prominence in the mid 19th century. Even back then, everyone understood that confidence alone can often be enough to win trust. These scammers sound convincing, because that’s their profession… to be confident and gain your trust.

Here we’ve got a closer look at the profile of one scammer on the prowl. They call themself a dev in their name. Well that settles that!

Notice that “Discord Owner” is in the profile description box, meaning they wrote it in themselves. Since you see it before the “Role” section when you scroll down, however, your mind can easily just associate that name with “Discord Owner” and then Admin and Mod underneath!

They have used emojis in the about me section to make their “Admin” and “Mod” text look more official, as if that were a standard tag to denote role.

As usual, it’s all very convincing until you get down to the stuff you can’t fake. This person has been a server member for a very short time… how likely is it that they are the server owner?

Finally, we come to their role and see a simple member role. Since this info is below the lies above… will a person be more likely to disregard the information they see first or second?

When taken in isolation like this, many of these tactics seem so obvious. A scammer doesn’t have to succeed every time to make off like a bandit though. During the hustle of everyday life, there’s surely a moment or two when you let your guard down. That’s payday for the scammers.

---

This scammer rolls a lot of the concepts we’ve discussed into one effort. Their name isn’t particularly impersonator, but they’ve included the hexadecimal ETH prefix for a small air of authority.

They see that the victim is having trouble connecting a wallet. As we discussed above, this is a prime moment for these predators to strike. 

Realistically, this scammer knows that this user is likely trying to connect the wrong address… time won’t help.

At first, the scammer is just helpful. They don’t try to immediately push too hard, even mentioning that it may just need more time.

After being given a moment to consider the helpful stranger’s advice, the mark comes straight back to the scammer and asks for their help directly. Here again, we see the scammer build trust… they don’t immediately jump on the opportunity to strike but instead tell them they should talk to an admin.

When an admin fails to respond untagged after a few minutes, the scammer is quick to jump in and mention that they’ll send the mark the right way if they’d only DM them. Once the victim has reached out via DM, they’ll likely be sent a link to another user… the impersonator admin. They could also be sent a fake help desk link as we’ve seen above.

---

We have to stress again… absolutely anyone can fall victim to these kinds of tactics!!! People have used these kinds of cons for generations because they work! The best way to make sure that they don’t work on you is to learn about them and know better.

Did You Know? Victor Lustig famously sold the Eiffel Tower to scrap dealers in 1925… despite not being affiliated with the French Government. Later, he pulled off the exact same swindle a second time. Don’t ever think you’re immune to a good scammer!

Staying Safe and Secure

We’re being a bit drastic because this is a serious issue. Realistically, are there scammers everywhere throughout the web3 world and you should just be suspicious of everyone all the time?

No. That’s not how this goes at all. Scammers are a part of life… wherever there is opportunity for them to make a buck at someone else’s expense, there they’ll be. Once you learn how they exploit people’s trust, however, their methods are much less likely to work on you.

It’s not just about protecting yourself though. These scammers continue to escalate and find new ways to trick unsuspecting people because there ARE people who are unsuspecting. No one should spend their entire existence paranoid that a scammer is coming to get them, but someone without any of the knowledge that we’ve discussed here probably should until they learn what they need to protect themselves.

When everyone knows how these people operate, they cease to operate. Scammers abound in web3 right now because people are not informed. New technology doesn’t only bring new opportunities for the world to culturally, economically and socially advance… it always brings an all you can eat feast to those willing to prey on the uninformed.

Guarding Yourself and Your Community

Education is the answer. There are so many assumptions people have become accustomed to making in the web2 world, where we surrender our trust to corporations in digital spaces.

In the web3 world, you maintain control over your own digital footprint. That responsibility means there’s no corporate office keeping you safe anymore… To some degree, everyone needs to be responsible for themselves and know what they are doing and why.

This is not cause to bemoan that the digital villains will always be around… this is a time to celebrate! All we have to do to get rid of this web3 riffraff is empower each other with knowledge and the tools to protect ourselves. Do your own research (more on that in a future edition!) and share what you learn with your community.

Community is important. Have people you can turn to and ask for a second opinion. Have people who will watch your back and share important information and knowledge. Have a community you trust… without having to trust some faceless corporation with ownership of all your stuff.