Google is suing two Chinese app developers claiming they allegedly spent years creating fraudulent cryptocurrency investment apps that were downloaded from its Play Store.

According to a Google complaint filed earlier this week, Yunfeng Sun, AKA Alphonse Sun, and Hongnam Cheung, AKA Zhang Hongnim and Stanford Fischer, from Shenzhen and Hong Kong respectively, developed 87 scam apps between 2014 and 2019, causing financial harm to at least 100,000 people worldwide, or so the tech giant claims.

Sun and Cheung's apps purported to be either cryptocurrency exchanges or crypto investment platforms, all promising big returns on investment. Their approaches changed slightly with each app but what the tech giant claims via its lawsuit is the underlying crime remained the same.

Victims would deposit real money into these apps which would appear to show balances rising and falling in line with the fluctuating real-world crypto exchange rates, but the effects were "illusory," the complaint filed in the Southern District of New York [PDF] alleges.

"Frequently, the fraudsters will guarantee that the investments will yield high returns, and may give the victims doctored reports falsely depicting their investment as earning money. When victims attempt to withdraw funds, they cannot do so."

It's alleged that Sun and Cheung would instead withdraw all the deposits after they were made, and prohibit victims from withdrawing what they believed to be their account balances. This was after allowing them to withdraw small amounts in the early phases.

The complaint claims they would then double down on their scam, requesting additional funds for things such as further investments, taxes, and various other fees in exchange for access to victims' accounts.

"But no matter how much money the victim hands over or how many promises the fraudsters make, the moment the victims "invest" the money, it is gone," the lawsuit reads.

In addition to developing the apps, it's claimed the pair engaged in various marketing campaigns to promote the scams, and would also socially engineer victims into downloading and signing up to them.

Court documents detailed the alleged text message campaigns, claiming the app developers would use Google Voice to send messages such as: "I am Sophia, do you remember me?" - an attempt to get a response from victims saying they've got the wrong number. 

From there, the complaint claims, the scammers would strike up conversations and move the conversations to other messaging platforms like WhatsApp. Later, they would attempt to establish friendships and romantic relationships, building a degree of trust, before "guiding" them through the "investment opportunity."

Google's lawyers claim in the doc that Sun and Cheung also paid actors to appear as apparent leadership teams featured in online videos that promoted their scam apps. They would allegedly push the message that the apps were safe and would provide strong returns.

The filing describes affiliate marketing campaigns used to get victims to download and engage with the apps. Targets were allegedly recruited into fake affiliate campaigns in which they could earn a commission for signing up new members. The scammers even talked about holding an in-person conference to offer investment advice, the filing alleges.

Through the course of the alleged multi-year criminal operation, Google says the pair abused many of its services, including the Play Store, Google Voice, Google Workspace (to make their Google accounts), Gmail, and YouTube (where some of the video ads were hosted).

The tech giant brought claims under the Racketeer Influenced and Corrupt Organizations (RICO) Act and breaches of contract related to its various services. The company is seeking an injunction to prevent Sun and Cheung, and their employees, from ever accessing Google services again. 

Halimah DeLaine Prado, general counsel at Google, told CNBC that the Alphabet-owned company believes this is the first time a tech company has pursued legal action against crypto scammers.

Although the circa 100,000 Google users, including 8,700 in the US, have suffered financial harm as a result of Sun and Cheung's alleged activity, the lawsuit doesn't mention any estimated total sums. However, victims' losses are said to have ranged between a few thousand US dollars to $75,000.

Google also says it suffered damages in excess of $75,000, involving costs associated with investigating the pair and the resources spent on remediating the safety and integrity of its platforms.

The action taken by Google this week coincides with the news that investment fraud is now the top form of cybercrime in the US in terms of financial loss.

According to the FBI, the losses incurred from crypto scams like those Sun and Cheung are alleged to have carried out far exceed those related to ransomware attacks.

The FBI issued a warning about a rise in crypto scams as early as March 2023. Details supplied by the feds almost sound as though they were reading Google's lawsuit verbatim.

Social engineering often involved. Check. Sometimes romance scams play a role. Check. Victims strung along and forced to pay more money to regain their lost funds. Check.

If true, Sun and Cheung's alleged crimes followed the crypto scammers' playbook, it seems. ®

https://www.theregister.com//2024/04/05/google_sues_alleged_play_store/