Updated: Jan 3
Putting lipstick on the investment scam pig...
QWERTYIOP. No that wasn’t a typo – this was likely the phrase Ray Tomlinson typed into his keyboard when he sent the world’s very first email message back in 1971. You may be wondering what the phrase means, why it was all in capitals, or why he included every alpha key on the top row of his keyboard except the ‘U’. We may never know.
What we do know is that not too long after this ground breaking, world changing technology was first used, scammers saw this as an opportunity to move away from their paper-based fraud and electronically scale-up at speed. Fast forward 50 years and we can confidently say that their scaling operation was a success. In response to these online threat vectors, an entire industry was created with tools that specifically identify, block and protect people from cyber-attacks and email scams. Most businesses even simulate malicious scam emails in order to prepare their employees on how to avoid these threats.
With blockchain technology hitting the mainstream over the past 5 years, we have seen history repeating itself and scammers adapt to the new opportunities this tech can offer. Instead of a scam ‘investment opportunity’ being sent to you in an email, people are being drawn into the world of Non-Fungible Tokens (NFT’s) and the investment scam known as an ‘NFT rug pull’.
A rug pull in this context is a scammer using blockchain technology to fraudulently raise money for a project, with the intent of embezzling the funds for personal gain. This scam is nothing new, but the hype machine of social media has meant the scale of the scam can increase very quickly and with a shorter lifespan, it creates an earlier cash out for fraudsters. Alongside that, the inclusion of cryptocurrency has meant they’re less likely to get caught. Last year alone saw a variety of rug pulls rake in $2.8 billion, or nearly 40% of all cryptocurrency scam revenue. Something must be done.
The mission of Education Arcade is to create safer online spaces for people – so I felt that we could do something to help educate and protect the public from these types of short lived, high impact investment scams. Having seen the success of phishing email simulations, we decided to make our very own NFT rug pull simulation to show people how to identify these new-age investment scams. Here is our abridged version of how we made the world’s first NFT scam simulator.
Step 1: Let’s participate!
To really understand all aspects of this scam, I embedded myself within the community of NFT traders and scammers on Twitter, Discord and Instagram. To build an end-to-end picture I needed to learn the terminology, tools, marketplaces, and most importantly, experience the behaviour of the players in the community.
I had thousands of interactions with people, used the art generation and NFT minting tools, dodged hundreds of direct scam attempts, critically reviewed hundreds of up-coming NFT investment projects and when I finally left the space, I felt sad and disappointed. Primarily because the two things I absolutely love were being abused repeatedly as part of these investment scams: Art and games.
Step 2: Let’s simulate!
To simulate, I decided to emulate, and the best place to find something to emulate was NFT Calendar – a website commonly used by NFT rug pullers to promote their scams. I picked the most scammy looking project I could find which was called ‘Embers’ and I started to create an over the top, exaggerated version of their webpage. I decided to call my simulation the ‘Rainbow Rug Pull Warriors Club’ and made each claim wilder and more unbelievable than the last.
Peppered throughout the simulation is a trusted character, affectionately named Eddie, who analyses each claim, explains the scam tactics used to hook people and provides some helpful guidance on how to think critically.
Image: Education Arcade’s NFT Rug Pull Simulator
I was ready to launch our simulator when an interesting piece of news hit my inbox. The creators of the NFT project ‘Embers’ were arrested and charged with conspiracy to commit wire fraud and money laundering for repeat NFT scams. We picked the right project to emulate!
Step 3: Let’s educate!
Getting this website in front of those people new to the NFT marketplace was paramount. These are the people unknowingly stepping into an absolute scammer minefield. Using what I had learned, I created a range of ‘Rainbow Rug Pull’ tokens that directed people through to the scam simulator and educational material on the Education Arcade website.
One of our methods for targeting scam awareness to the people that would benefit from it the most was fairly unique. We identified vulnerable people active in the NFT marketplaces, social media and community groups. We ‘airdropped’ one of our tokens to them that links to our website and we monitored the interactions they have with our education. This was by far the most interesting and unique way we have ever provided free security awareness education to people.
Using a range of methods, our NFT investment scam education reached over 200,000 people, and with 24% positive engagement to date, we hope that ‘Rainbow Rug Pull’ will continue to make a difference in the personal security of people in these online spaces.