Crypto Scams in Maryland: The Patterns and Your Rights

One crime pattern accounts for a large share of crypto losses in Maryland, and it is the reason the General Assembly passed a kiosk statute in 2025.

The script. The phone rings. The caller claims authority — a police department, the Sheriff's office, Social Security, the IRS, immigration enforcement, BGE or another utility, sometimes a grandchild in custody who "can't talk long". There is a warrant, an unpaid debt, a compromised account, a family emergency. The caller manufactures urgency and, crucially, instructs the victim to stay on the line. They direct them to a specific crypto kiosk — often naming the exact store — and walk them through the screens, supplying the QR code to scan. The transaction confirms and the money is gone.

Why it works. Three mechanisms, all deliberate. Authority makes the demand seem legitimate. Urgency prevents reflection. And staying on the line prevents the victim from doing the one thing that would end it — talking to someone else.

The single rule that defeats every version:

Local variants we see repeatedly. The "grandchild in jail" call has been reported heavily across eastern Baltimore County — Dundalk, Essex, Middle River. Immigration-status threats target the Silver Spring, Langley Park and Wheaton corridors, often switching into the victim's first language to build trust. Utility shut-off threats and fake warrant calls appear statewide.

Tell the older people in your life about this specifically. It is the highest-value conversation on this page.

The second major category, and the one that produces the largest individual losses in Maryland.

Affinity fraud is investment fraud that spreads through a community whose members already trust each other — a congregation, an alumni network, a fraternity or sorority, a professional association, a workplace, an extended family. It does not need to convince you of anything, because the person telling you about it is someone you already believe.

The mechanics. An early group of participants receives real payouts — funded not by trading but by later participants' deposits. Those early winners become the scheme's most effective recruiters, entirely sincerely, because their experience was genuine. It grows through real enthusiasm until deposits stop covering withdrawals, at which point it collapses and everyone who joined late loses everything.

The reliable tells, in order:

• Guaranteed, fixed or unusually smooth returns. Real crypto markets do not produce steady eight percent months. Anything that does is paying you with someone else's deposit.
• Your return improves if you recruit. That is a pyramid, whatever it is called.
• Withdrawals become difficult. A fee, a tax, a verification deposit, an unlock payment, "wait for the next cycle". There is always one more.
• Urgency and scarcity. Closing soon, limited allocation, price rising Friday.
• Money goes to a person or a private wallet rather than a licensed institution you can independently verify.
• Complexity used as reassurance. Arbitrage, market-making, AI trading, mining pools — vocabulary deployed to make questions feel unwelcome.

Our Bowie and Prince George's County guides cover this category in more depth, because it has hit those communities hard.

The most common online crypto fraud, and the one with a single reliable defence.

How it works. You are introduced to a trading platform — through a social media message, a dating app conversation, a group chat, or a friend's compromised account. You deposit a modest amount. The interface looks professional. Your balance grows, sometimes dramatically. You are encouraged to deposit more.

Then you try to withdraw. There is a fee. Then a tax. Then a "verification deposit" to prove the account is yours. Then an unlock payment, a compliance charge, a liquidity fee. Each one is presented as the last obstacle. The balance you can see was never real — it is a number in a database the scammer controls.

The defence, and it is close to foolproof: withdraw a small amount early. Before you deposit anything substantial, take fifty dollars out. A legitimate platform lets you do this without ceremony. A fraudulent one starts inventing obstacles immediately, and you have found out for fifty dollars instead of fifty thousand.

The romance variant deserves separate mention because it produces the largest individual losses in US crypto fraud statistics. A relationship forms on a dating app, moves to a private messaging app, develops over weeks or months, and eventually turns to investing. The tell is the pivot itself: the conversation was always heading there.

The recovery-service variant targets people who have already been defrauded. Someone contacts you claiming they can trace and recover your stolen crypto for an upfront fee. They cannot. Nobody can. This is a second fraud aimed at the same victim, and it is common enough that you should assume any unsolicited recovery offer is exactly that.

This one is different from the others because the consequence is not only financial.

The offer. Easy remote work. You receive payments into your bank account or crypto wallet and forward them on, keeping a percentage. It might be framed as payment processing, as a financial assistant role, as helping a company that "cannot open a US account", or as a favour for an online friend or partner.

What it actually is. Money laundering, and you are the launderer. The funds are proceeds of fraud — often from the very scams described above — and you are the layer that breaks the trail between the victim and the criminal.

The consequences are real. Bank accounts closed and reported. Names entered in fraud databases that follow you for years. And criminal charges: people are prosecuted for this in Maryland every year, and "I did not know" has never worked as a defence, because the arrangement is precisely designed so you could have known.

Who is targeted. Students overwhelmingly — new accounts, clean histories, limited experience of financial crime. Our Towson, Bowie and Salisbury guides all flag this, because every Maryland campus sees it. Also targeted: people in financial difficulty, and people in online relationships with someone they have never met.

The rule: never move money for anyone you do not know personally and completely, regardless of how the arrangement is described, how legitimate the company looks, or who introduced it. There is no version of this that is a real job.

Shorter descriptions, because the shapes repeat.

Phishing for recovery phrases. A fake wallet or exchange website, often reached through a search advertisement or a message about a "security issue", asking you to enter your recovery phrase to "validate", "restore" or "migrate" your wallet. No legitimate service has ever needed those words. Any request is theft.

SIM swapping. An attacker persuades your mobile carrier to port your number to their device, then uses SMS codes to reset your exchange password. Defeated entirely by moving to an authenticator app or hardware key. See our custody guide.

Fake support accounts. You post a problem on social media and are contacted within minutes by "support". Real exchange support does not proactively message you on social platforms and never asks for your seed phrase or remote access to your device.

Giveaway and airdrop scams. "Send 0.1 BTC and receive 0.2 back", usually attached to a hijacked or impersonated account. Also fake airdrop claim pages that ask you to connect a wallet and approve a transaction that drains it.

Clipboard hijacking. Malware that silently replaces a copied wallet address with the attacker's. Always check the first and last several characters of a pasted address before sending, and always send a small test first.

Pig butchering. The industry term for long-form investment fraud combining a romance or friendship approach with a fake platform, run at industrial scale. The name comes from "fattening" a victim before the final extraction. It is the pattern behind a large share of the biggest individual losses.

Rug pulls and token schemes. A new token promoted heavily, often through a paid group or influencer, that collapses once enough buyers are in. Distinguishable from an ordinary bad investment mainly by the promotion pattern.

Speed matters, and so does documentation. Work through this list in order.

1. Stop sending moneyThis sounds obvious. It is not — the withdrawal-fee spiral is specifically designed to extract one more payment from someone who has realised something is wrong. There is no payment that will release your funds.
2. Document everything nowScreenshots of every conversation, the platform, wallet addresses, transaction hashes, dates, amounts, phone numbers, names used. Do this before accounts and messages are deleted.
3. If a kiosk was involved, file a Notice of Fraud with the operatorMaryland gives you 90 days. The operator must investigate and resolve within 30 calendar days, may not require a police report as a precondition, and may not deny a fee refund because you were negligent or ignored the on-screen warnings. Use the receipt — it carries the transaction hash.
4. Report to Maryland authoritiesThe Attorney General's Consumer Protection Division for scams and deceptive practices; the Securities Division for investment fraud; the Office of Financial Regulation for kiosk and licensing issues.
5. Report to your county police or sheriffA local report matters even if the perpetrator is overseas. It creates a record and, occasionally, links to an existing investigation.
6. File with the FBI's IC3At ic3.gov. This feeds national pattern analysis and is how multi-victim cases get built. File it even if you doubt your case will be pursued individually.
7. Secure everything elseChange passwords, move off SMS two-factor, and move any remaining crypto to a new wallet with a new recovery phrase if you have any reason to think your existing one is compromised.
8. Ignore anyone offering to recover itRecovery services that contact you after a loss are, without meaningful exception, a second fraud aimed at the same victim.

Be honest with someone. Shame is the reason a great deal of this goes unreported, and unreported means uninvestigated. These schemes are run by organised, professional operations that defraud thousands of people. Being caught by one is not a character flaw.