Did SDNY Enter A Recovery Scam's Documents Into Evidence?
We obtained exclusive access to documents from a company called "Payback" that tied the Government's first victim to Tornado Cash – and it doesn't look good.
Update: Fox5 San Diego reports that Payback LTD had its seized website returned, but that an FBI investigation into the service remains ongoing.
In the criminal case against Tornado Cash developer Roman Storm, the defense has floated the possibility of a mistrial over what appears to be a major evidentiary dispute.
Yesterday, the defense called into question whether the Government's first witnesses Hanfeng "Katie" Lin's funds did indeed disappear into the Tornado Cash service after falling victim to a pig-butchering scam.
In cross-examination, FBI Agent Joseph DeCapua testified that he was not tasked with investigating Lin's funds specifically. The Government countered that IRS Agent Stephan George, whose testimony is expected today, would prove that Lin's funds did indeed go through Tornado Cash – much to the surprise of involved parties, as Agent George was actually set to testify to other things. For now, the only piece of evidence tying Storm to Lin appears to be an email Lin was asked to send to the Tornado Cash developers on recommendation of a fund recovery firm called "Payback", which told her that her funds had been sent to Storm's service.
What follows is a wild account of search results, FBI alerts, and emails to victims obtained exclusively by The Rage of cryptocurrency recovery firms operating under the Payback brand; one of which may have somehow made it into SDNY's evidence.
David Z. Morris
Payback Seized By FBI?
Last week, Lin testified that she had hired the private recovery firm Payback to help retrieve her life savings she lost to scammers. A quick search for Payback recovery leads us to payback[.]com, operated by the Israeli firm Money Back LTD, which offers fraud investigation reports meant to equip victims with the means to get their money back, according to their website. For this service, Payback charges $3,500 plus $750 per transaction.
After public discussions on yesterday's proceedings, Bitcoin Policy Institute national security fellow William J. Jones was quick to point out that the FBI's San Diego field office had issued a press release on the seizure of three cryptocurrency recovery websites, including domains belonging to a service called Payback LTD. The alert is the second search result for the terms Payback recovery on Google, right below payback[.]com. According to the FBI, these cryptocurrency recovery sites "charge an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report," and "reference actual financial institutions and money exchanges to build credibility and further their schemes." FBI San Diego did not respond to a request for comment to identify the exact domains seized, but it appears that the site payback[.]com was not affected.
The UK's Financial Conduct Authority issued a warning on an entity called "Pay Back LTD," as well as on an entity called "Money Back", which it identifies as clones of the FCA authorized firm MONEYBACK LTD. The FCA did not include payback[.]com or payback-ltd[.]com – which redirects to payback[.]com – in its list of fraudulent domains, but the UK's MONEYBACK LTD appears to be an organization wholly unrelated to the Payback service in question.
The Australian Securities and Investment Commission (ASIC) warns of a domain called payback-recovery[.]com, which it states is using fake documents to associate itself with the commission. ASIC notes that payback-recovery[.]com is not affiliated with the Israeli company Money Back Ltd, trading as payback[.]com. Similarly, the German financial authority BaFin warns of a service called PayBack LTD, operating under the domain paybackltd[.]com. BaFin states that the Israeli company Money Back Ltd, which acts under the Payback brand name and operates the payback-ltd.com website, is in no relation to the paybackltd.com website and the operators named there. All of the aforementioned alerts appear on the first page of search results.
Speaking to Payback LTD's legitimacy, the cryptocurrency bank Xapo Bank has published a blog post on the "'Payback LTD' Impersonation Scam," claiming that "Payback LTD [...] and Money Back are organizations dedicated to assisting individuals in recovering funds they've lost to scams," adding that "their commitment to their clients is evident." The firm's Trustpilot page also appears promising, with an average rating of 3.2 stars.
All good then. Or is it?
David Z. Morris
A Series of Unfortunate Marketing Practices
Xapo has not responded to a request for comment on whether it has ever conducted business with payback[.]com, or how it verified that Payback's commitment to assisting customers in fund recovery is indeed evident. Meanwhile, comments on Payback's X (formerly Twitter) profile, which links to payback[.]com and operates under the @payback_ltd handle, appear to tell a very different story.
"Don't ever trust this company," one user comments under a post of a Payback client review on X. "They just sent me an email after I paid them saying that they cannot do anything and they closed the case." "Not true @ all," another user comments under a post discussing business scams, describing how he allegedly paid Payback 800 GBP in fees for "0 outcome". "Scam 1000%," another comment reads "coming from someone who tried to use them. They will just lead you on and rinse you again! FUCK PAYBACK!!!" "DO NOT trust these guys," another commenter writes. "Better get scammed once than twice." Over the course of the past year, there seems to be not a single positive comment left on any of Payback's posts on X.
Documents shared with The Rage now show that payback[.]com's business practices may indeed not be all too kosher.
David Richards of the cryptocurrency fraud analysis service BlockchainUnmasked says he began investigating Payback when former payback[.]com customers turned to him for help after sending the recovery service over $90,000 in fees for what Richards describes as "fraudulent tracing reports." Posing as a victim himself, Richards inquired whether Payback would actually be able to help recover his funds.
"While no recovery case is guaranteed, our method has proven effective in similar situations – especially when the right data and pressure is applied," a Payback representative operating under a payback[.]com email address told Richards, attaching a link to Forbes coverage of Binance's $4.3 Billion settlement with the Department of Justice over anti-money laundering violations. "You were involved in the Binance case?" Richards followed up. "We've helped many clients recover funds from Binance and smiliar platforms through entirely different means – nothing to do with that headline case," the representative clarified.
In another email, the Payback representative shared a link to Yahoo Finance coverage detailing how "Payback Ltd Reimbursed Over $5,000,000 To Victims Of Financial Fraud in 2023." But the article is really a republishing of a PR Newswire submission – a pay for publication public relations service to which anyone with a paid account may submit press releases, which often get picked up by PR Newswire partners. The article has since been removed from Yahoo Finance.
Soon after contacting Payback, Richards says he was contacted by a service called Blockchain Integrity & Securities Division, writing to solicit Richards as a client to recover and withdraw his assets from US and Canadian cryptocurrency exchanges, referencing apparent legal requirements on dormant assets. Emails show that the firm wanted Richards to invest his funds in Bitcoin and Ethereum ETFs. But Richards says he had setup an email specifically to contact Payback – telling The Rage that no one had that email address, except Payback's representatives. When confronting Payback with this apparent sharing of his personal information, Payback denied all involvement.
Richards believes that payback[.]com may be part of a network of recovery scams, but notes that this is a determination ultimately to be made by the authorities. All evidence collected on Payback was turned over to the FBI in May of this year, he says. The agency is still seeking victim statements on Payback LTD. It continues to be unclear which "Payback" service Lin utilized.
Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation. If you would like to note a correction to this article, please email corrections@therage.co
