Hot-ticket tokens

Non-fungible tokens are all the rage in the crypto world, potentially revolutionizing the sale of everything from art to real estate. But their complexity and the public’s poor understanding of the new technology make NFTs perfect vehicles for fraudsters.

What do robot-generated art, baseball cards, video games, pet rocks, music albums, a tweet from Twitter CEO Jack Dorsey and an Anthony Hopkins film all have in common? They’ve all been sold as non-fungible tokens (NFTs), the latest hot trend in the crypto world. And their versatility as digital assets, abstruse nature and soaring value almost ensure that fraud examiners will be encountering them in coming years.

What exactly is an NFT? In simple terms, it’s digital proof of ownership of an authentic one-of-a-kind asset — much like a deed to a house — but it’s stored digitally on blockchain. It’s not a cryptocurrency such as bitcoin, which like paper money is a fungible asset. In other words, a dollar is worth the same as another dollar and can always be replaced with another dollar. In contrast, assets that are non-fungible like NFTs are unique and can’t be swapped or interchanged this way. And, as a result, the value people place on them varies and can sometimes reach dizzying heights. What makes NFTs similar to bitcoin is that they’re both digitally stored on blockchain ledgers. (See “NFTs, explained,” by Mitchell Clark, The Verge, Aug. 18, 2021, and “Are NFTs The New Crypto? A Guide To Understanding Non-Fungible Tokens,” by Sylvia Jablonski, Forbes, June 9, 2021.)

This example of how they work may explain why NFTs have captured the public’s imagination for their peculiarity and the high prices they’re fetching. In March, Twitter CEO Jack Dorsey sold an autographed tweet as an NFT through a digital auction for a stunning $2.9 million, an amount he pledged to donate to Africans impacted by the COVID-19 pandemic. The five-word tweet, written on March 21, 2006, said, “just setting up my twttr” and was Dorsey’s first ever message on the now-famous social media platform. The winning bidder was Sina Estavi, the CEO of blockchain company Bridge Oracle who paid for the purchase in a cryptocurrency called Ether. Anyone can see the tweet; here is a link. And like prints of famous artworks, it can be replicated many times over. But it’s the ownership of that unique or “original” asset through the NFT where investors and collectors believe they can derive some value. (See “Twitter boss Jack Dorsey’s first tweet sold for $2.9 million as an NFT,” by Elizabeth Howcroft, Reuters, March 22, 2021.)

Is this all just a passing fad or a revolutionary technology that will transform our lives? Are NFTs worth the crazy sums people have paid? It’s certainly not the first time that investor enthusiasm for the next new thing has pushed asset prices to astronomical heights. Think of tulipmania or the Mississippi land bubble, which occurred in the 17th and 18th centuries, or more recently — and perhaps more akin to NFTs for their complexity — the collateralized debt obligations (CDOs) blamed for the 2007-2008 financial crisis. (See “Dutch Tulip Bulb Market Bubble,” by Adam Hayes, Investopedia, Aug. 6, 2021 and “Mississippi Bubble,” Britannica.)

All three of those past examples ended in tears, and asset prices crashed with a thud. It’s uncertain whether this time NFTs will be any different. But what’s clear is that the public’s confusion over the much-hyped technology creates opportunities for fraudsters. “Everything just gets muddied up around the technology and people don’t understand it, and it does create some actual problems,” says David Utzke, Sr., Ph.D., CFE, a professor who teaches advanced blockchain architecture and works with the U.S. Internal Revenue Service’s Cyber Crimes Unit. “It’s unfortunate that the fraudsters are smarter than the consumer.”

When consumers are interested in a new product but understand little about it, fraudsters will follow, and NFTs are no exception. Nick Furneaux, CFE, managing director at CSITech, a British firm that specializes in digital investigations, suggests that scams related to NFTs will follow the same blueprint fraudsters have used for cryptocurrency scams.

“Most frauds that are perpetrated around cryptocurrencies are traditional crimes with new methods,” says Furneaux. “The blockchain environments themselves are pretty solid, but phishing, investment scams, etc. are easy to pull on a public where interest and excitement are high, but comprehension of the technology is low. NFTs will have the same type of frauds designed and implemented by scammers.”

Revolutionizing digital art through NFTs

Thus far, attention on NFTs has been firmly focused on some of the eye-popping purchases of digital art or collectibles, most notably a collage by Mike Winkelmann, aka the digital artist Beeple, that sold for a record $69 million earlier this year through an NFT and was paid for in cryptocurrency. NFTs tied to digital or physical works of art — one of the most common and straightforward applications of the technology — are vulnerable to fraud.

Kirby Plessas, CFE, an open-source-intelligence investigator and artist, describes the appeal of the technology for artists. “As an artist, an NFT is a non-fungible token, meaning something unique that you can sell, specifically via cryptocurrency,” she says. “And that will be generally artwork, or maybe original music, or something that can be considered rare and individual, but yet digital, or also have at least a digital cross-section.” [See ACFE’s Fraud Talk podcast, “An Introduction to Non-Fungible Tokens (NFTs) and Fraud,” May 21, 2021.]

NFTs have many appealing qualities for artists. For example, they allow creators to specify the rights of the buyer and seller, including requiring that the creator or first seller of an NFT receive a percentage of the NFT’s resale each time the work is resold.

By minting NFTs and offering them for sale, artists also create opportunities for their loyal fans to support them directly by purchasing the NFTs. Minting is the term used for the creation of an NFT by putting the file on a public blockchain ledger that can’t be edited or deleted and that everyone can verify as authentic. It requires having a digital wallet, uploading the file containing the art onto the blockchain and finding a suitable NFT marketplace. (See “Jeremy Deller mints his first NFT: here is his advice for other artists,” by Tom Seymour, The Art Newspaper, March 24, 2021.)

This is important for artists because NFTs verify the authenticity of a digital artwork and are designed to prevent forgeries, which helps maintain the value of the work (at a time when art fraud is on the rise) and helps artists monetize their efforts. The buyer of the NFT, in turn, has the right to show and resell the art tied to the token, but the artist keeps intellectual rights to replicate it for commercial purposes. However, this hasn’t stopped people from minting NFTs of artworks without the artist’s permission, which experts say is an infringement of copyright laws. (See “How Non-Fungible Tokens are Revolutionizing the Art World,” By Yonatan Ben Shimon, Nasdaq, May 3, 2021; “NFTs help protect digital art’s value,” by Christophe Verdot, Medium, Oct. 6, 2020; and “Minting, distributing and selling NFTs must involve copyright law,” by Harsch Khandelwal, Cointelegraph.com, Aug. 22, 2021.)

Far from foolproof

Indeed, the system is far from foolproof; fraudsters have been scamming artists and collectors and even those who are relatively cyber-literate. One even had her artwork sold as NFTs a year after she died, although the platform hosting the NFTs deleted the listings after being notified of her death by her family and fans. (See “An artist died. Then thieves made NFTs of her work,” by Jacklin Kwan, Wired UK, July 28, 2021.)

In another case earlier this year, a collector, who trades digital art and goes by the moniker Pransky, bought a fake work of art by street artist Banksy through an NFT for more than $335,000. The collector thought the sale was genuine because it was advertised on Banksy’s official site with a link to OpenSea, a marketplace for NFTs. When his first bid was so quickly accepted, the collector knew he’d been scammed. Luckily for him, the fraudster returned the money for no apparent reason.

A publicity stunt or an ethical hacker? No one knows. But the incident underscored the weakness in the new technology. NFTs may have a secure digital signature to prove the authenticity of the art being purchased, but a fraudulent seller can clearly find a loophole in those defenses. (See “Collector buys ‘fake’ Banksy NFT for over $335K after alleged website hack,” by Oscar Holland and Megan C. Hills, CNN, Sept. 2, 2021.)

It’s digital proof of ownership of an authentic one-of-a-kind asset.

As with any activity exposed to potential fraud, due diligence is of utmost importance. That means checking that any NFT you purchase was created on a distributed ledger — either on blockchain or on a blockless ledger that ensures “immutability,” says Utzke. In other words, the NFT can’t be changed or deleted. However, there have been reports of people who have bought NFTs only to see them disappear without explanation or recourse.

“What many people don’t understand about smart contracts, and crypto contracts [like NFTs] really in general, is that they don’t need a distributed ledger to be created,” says Utzke. “So the fraudster sells this [fake] NFT from the centralized server, they get their money and then they can delete it.”

The technology of genuine NFTs that have been created on a distributed ledger has both an upside and a downside for CFEs investigating fraud in this corner of the market, Utzke explains. Like an asset such as a house, a cryptocurrency stays where it was built, in this case its original ledgers. NFTs, on the other hand, are minted through smart contracts that assign ownership but can also be transferred to other platforms or off the public ledger entirely. That makes tracking the contract difficult during an investigation.

Even so, the fact that somebody created that digital contract means prosecutors in fraud cases can issue subpoenas. “Somebody created that contract. Somebody is managing it,” he says. “You now take technology and have to go old school and start, for example with art, going to the auction houses and saying, ‘OK, who was the buyer? Who was the seller?’ And trying to break some of that anonymity.”

Back to basics

Creators and collectors have also reported account takeovers or unauthorized access of their accounts on NFT marketplaces, which have led to the theft of their NFT collections or charges to credit cards linked to their accounts. Another reported scam involves tweeting out artists’ works, then selling the tweet as an NFT. (See “People are stealing over $10,000 in NFTs, and victims can’t do anything about it,” by Julia Gray and Ivan de Luce, B2B, March 15, 2021.)

“Something that few people talk about are the number of ATOs [account takeovers] in both the virtual currency and the cryptocurrency world,” says Utzke. “It’s more in the virtual-currency side, but it’s off the charts right now. I mean, you know Atari had 300,000 accounts taken over by a foreign actor. Nobody was reading about that in any of the major media streams.”

Joshua Nash, CFE, is a financial crimes technology expert. He agrees that the digital wallets needed to mint, purchase or possess NFTs give fraudsters the opportunity to execute these attacks. “Unless you keep the NFT in cold storage of some sort, it’s going to be vulnerable to account-takeover-type attacks or frauds,” Nash says.

Mr. Nobody and the great NFT hack

The vulnerability of NFTs and digital wallets to fraud proved all too true when in April the hacker artist Monsieur Personne (“Mr. Nobody”) effectively forged Beeple’s “Everydays: the first 5,000 days,” the artwork that was sold earlier this year for $69 million. By using a technique called “sleepminting” (a pun on the stealth attack while everyone is sleeping), he downloaded the file of “Everydays,” minted it in Beeple’s digital wallet and then transferred it back to himself unbeknownst to the artist. Monsieur Personne then listed it on NFT marketplaces Rarible and OpenSea through the name of Arsène Lupin, the fictional gentleman thief created by the writer Maurice Leblanc and now the basis for the Netflix series, “Lupin.” (See “The Gray Market: How a Brazen Hack of That $69 Million Beeple Revealed the True Vulnerability of the NFT Market (and Other Insights),” by Tim Schneider, Artnet, April 21, 2021, and “Can the Weakness of NFT Technology Be Fixed?” by Shanti Escalante-de Mattei, ARTnews, July 29, 2021.)

Monsieur Personne’s NFT is, at the end of the day, a fake. He still doesn’t own the original. Nor does the duplicate damage the authenticity of the original artwork. But the hack shows how fraudsters might manipulate the system to their advantage. (See “The Art of the Prank: How a Hacker Tried to Fake the World’s Most Expensive NFT,” by Christine Kim and Sebastian Sinclair, coindesk, April 27, 2021.)

For now, this hacker seemed satisfied in proving a point: NFTs aren’t as secure as the public thought. “Just wanted to say thank you to everybody talking about this. I am happy that these issues and contradictions are being discussed. Strongly believe that this will lead to better and safer NFT practices in the long run,” NFTheft, the hacker’s website, tweeted. (See NFTheft's tweet.)

Most frauds that are perpetrated around cryptocurrencies are traditional crimes with new methods.

More implications

Because NFTs are so new, the rules governing them have yet to be tested in the courts, or their values fully flushed out in markets. That could prove problematic in fraud investigations or engagements involving valuations of digital assets. And NFTs could provide avenues for illicit payments for contraband or bribes and kickbacks through what appears to be legitimate transactions. (See “NFTs: Legal Risks from ‘Minting’ Art and Collectibles on Blockchain,” Quinn Emanuel Urquhart & Sullivan, LLP, March 25, 2021.)

“There’s nothing to compare it against because [NFTs] are by definition unique. There’s not a Kelley Blue Book,” Nash says. “There’s not a Beckett magazine [for baseball cards] for NFTs that you can go look up. There is no sense of what fair market value is. That kind of opens it up to some dangers for bad actors.”

Fraudsters could launder proceeds of fraud or money from illicit transactions by purchasing NFTs at exorbitant prices in transactions that seemingly involve separate sellers and buyers. This scheme would need a platform or exchange that doesn’t employ know-your-customer or anti-money laundering controls that require users to disclose their identities, which is still a possibility because regulations haven’t caught up to cryptocurrency or NFT developments in many jurisdictions.

Keeping up with every NFT development is likely a futile task. Surely, news will render information in this article outdated upon publication. But fraudsters don’t need an advanced degree in blockchain architecture to pull off NFT scams. The public’s confusion over how the tokens work provides sufficient opportunities for fraud.

In the meantime, CFEs investigating fraud related to NFTs might be best advised to bring in an expert on the topic or enlist the services of a blockchain forensics company like CipherTrace. “I’m going to equate it to digital forensics,” Utzke says. “I have certification as a digital forensic examiner, which is different than a digital forensic investigator, so I know my limitations.”

“The same caution that we give to fraud examiners in the area of digital forensics is really the same caution that I would put here: When you come across it, engage the experts in the arena.”

The origins of NFTs and why they might be here to stay

Non-fungible tokens (NFTs) first came about in their current form in 2017 with a game called CryptoKitties, which allowed players to “breed” and trade digital cats. CryptoKitties used blockchain technology to create NFTs on the Ethereum network that identified the unique digital cats.

But it wasn’t until early 2021 that the popularity and profitability of NFTs skyrocketed, transforming the market into a multibillion-dollar industry. According to The Wall Street Journal, the total value of NFT sales on the Ethereum network (where most NFT transactions take place) went from $94 million in the fourth quarter of 2020 to $2 billion in the first quarter of 2021. (See “The NFT Origin Story, Starring Digital Cats,” by Caitlin Ostroff, The Wall Street Journal, May 8, 2021.)

And while a significant drop in NFT sales later in the year prompted some in the news media to declare that the market had collapsed, those proclamations might have been premature. By August 2021, the fever had returned. That month, OpenSea became the first NFT marketplace to see monthly volumes exceed $1 billion, while Google searches for “OpenSea” hit an all-time high. (See “OpenSea is first NFT marketplace to pass $1 billion in monthly trading volume,” by MK Manoylov, The Block, Aug. 22, 2021.)

As NFT sales volumes peaked again, major corporations showed increased interest in the technology, with purchases of NFTs, NFT-adjacent patent awards, investments into digital content management companies, or announcements of efforts to support customers’ use of NFTs. Facebook, Fox, Visa, Budweiser and Microsoft investments in NFTs suggest that the phenomenon is anything but a passing fad. (See “Corporate brands target NFTs, and adoption continues to skyrocket,” by Osato Avan-Nomayo, Cointelegraph, Aug. 30, 2021.)

Mason Wilder, CFE, is research director for the ACFE. Contact him at mwilder@ACFE.com.