Key Takeaways
- Scammers in Venezuela use zero-value cloned USDT at checkout, tricking merchants out of valuable goods.
- Cloned USDT tokens mimic real contracts, appearing valid in wallets and causing losses for merchants.
- Experts advise merchants to verify Tether contract addresses or use Binance to avoid fake USDT scams.
Fake USDT Tokens Surge for Payments in Venezuela
Threat actors are leveraging the high level of adoption of stablecoins in Venezuela to implement a criminal method involving “fake” USDT tokens.
Juan Kassabji, a Venezuelan tech enthusiast, has reported this scheme happening at a store checkout, when scammers asked merchants to use external, self-custodial wallets that display these tokens, with smart contracts mimicking real USDT stablecoins.
The cloned token used for these payments is also referred to as USDT but has no value, and it doesn’t share the same smart contract address as the official USDT token.
Nonetheless, the scheme does work as criminals use these tokens to execute the settlement, showing the payment as completed and leaving the store with the goods purchased.
Kassabji stressed that he knew of at least one case where a merchant accepted these fake tokens in an exchange involving over $5,500.
These so-called fake tokens aren’t new, as other cryptocurrency holders have also reported their use for P2P exchanges before. Some wallets do include security implementations that flag these fake tokens to protect users, but this feature is not generalized and depends on the wallet used.
Nonetheless, using them for physical purchases is innovative in itself.
Kassabji recommended using Binance, which hosts most of the country’s P2P exchanges, to receive these payments, as it credits only valid USDT tokens into its customers’ balances.
In addition, he also called on merchants and users receiving stablecoins in self-custody wallets to check the total balance in dollars after each payment. If the token is fake, the payment balance will be zero.
Finally, he stressed that the tokens received must have the same contract address as the one used by Tether, the official USDT issuer.
