Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.
A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files.
Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers.
TL;DR: New York’s attorney general is seeking $1.3 billion in monetary relief in the NovaTech case and has announced nearly $6 million in promoter settlements. The larger sum is a request to the court, not money recovered for investors.
New York’s effort to recover losses from the NovaTech cryptocurrency scheme has reached a new stage, with Attorney General Letitia James asking a court to impose roughly $1.3 billion in damages and disgorgement.
The October 22 announcement also disclosed nearly $6 million in settlements with four promoters. Those are separate from the much larger claim involving founders Cynthia and Eddy Petion. The announcement does not establish that either amount has already reached victims.
The case concerns investment packages sold through NovaTech and an earlier business, AWS Mining. According to the attorney general, the schemes targeted Haitian and other immigrant communities through religious networks, social media and messaging groups.
The New Filing Follows An Earlier Judgment
An affirmation filed on October 22 supports the request for monetary relief. It records that New York sued in June 2024 and that the defaulting defendants did not respond or appear. The court entered a default order and judgment on August 4, 2025.
The latest motion asks the court to determine the financial consequences. It should not be confused with a new criminal conviction, a completed recovery or a guarantee that a judgment can be collected. Those distinctions are particularly important when the sums sought are much larger than the settlements announced alongside them.
The promoter figures listed by the attorney general are $2.9 million from Martin Zizi, $2.05 million from Frantz Ciceron, $750,000 from James Corbett and $275,861 from Ricardo Roy Sr. All four face permanent bans from the securities, commodities and cryptocurrency industries.
The timing also needs care: the Zizi consent papers were filed in November 2025. This week’s announcement brings the settlement figures together; it does not mean every agreement was signed this week.
Recruitment Promises Outran The Trading Business
The original mining operation offered high returns and recruiting bonuses, according to the court affirmation. NovaTech later marketed cryptocurrency trading packages. The cryptocurrency label described how investors supplied money, but the underlying issue was what operators actually did with it.
That is a useful distinction for readers assessing similar pitches. An account balance on a website does not establish that assets exist, that trades occurred or that withdrawals can be honored. Nor does a familiar community connection answer questions about custody and control of funds.
For affected investors, the next substantive development will be the court’s decision on monetary relief and any subsequent recovery process. The announced settlements and the requested award address different defendants and different steps in that process; combining them into a headline recovery figure would overstate what has happened.
Chinese authorities are working to seize nearly 62,000 bitcoins — worth around $5 billion at today’s prices — linked to one of the country’s largest-ever fraud cases.
Prosecutors allege that Qian Zhimin, the alleged controller of Tianjin Lantian Gerui Electronic Technology, recruited associates to sell fake wealth management products nationwide from 2014 to 2017 without financial regulatory approval, promising guaranteed returns to investors, according to a report last week from Shanghai’s The Paper.
The scheme raised some RMB 40.3 billion ($2.8 billion). Qian allegedly used investors’ cash to pay off earlier participants — Ponzi-style — while channeling funds into the bitcoin holdings, property, cars, and jewelry. Little of the money went toward legitimate business operations.
In July 2017, as the scheme unraveled, Qian fled to the UK carrying computers holding the bitcoin wallets. British authorities later seized the crypto assets and other property, including roughly 61,900 BTC along with cash, jewelry, and other cryptocurrencies.
The case took a significant turn recently when the UK High Court ruled that Chinese law — not UK law — applies to ownership disputes over the seized bitcoin.
The coins have appreciated enormously since 2017, and the applicable law determines whether victims share in those gains. The UK’s Crown Prosecution Service says victims may recover losses through China’s compensation mechanism, but representatives from Fieldfisher law firm, acting for some victims, are considering an appeal. Further hearings will determine whether victims can prove their entitlement to the assets.
Meanwhile, the Second Intermediate People’s Court of Tianjin announced it accepted the prosecution’s application on September 28 to confiscate Qian’s illicit assets.
Victims can register to participate in asset recovery proceedings through a WeChat platform, with a six-month notice period before the formal trial begins.
China has some of the world’s strictest rules in regulating crypto. Its government banned digital asset trading and bitcoin mining back in 2021.
Japanese police arrested a Chinese couple accused of hiding a computer in a Kobe hotel to send phishing emails and using stolen credit card details for purchases.
Crackdown on North Korean Remote IT Fraud Network On October 13, 2026, the U.S. Department of Justice announced coordinated enforcement actions targeting North Korean remote IT worker schemes that generated...
If you got a DM from an unverified Jon Bon Jovi account after commenting on one of his official Instagram posts, what would it take to make you believe it was really the rock star hoping to connect? And at what point when he starts asking you to send money—like lose-your-house kind of money—would you snap out of the fantasy and stop draining your bank account?
In a documentary premiering Saturday—Super Scam Me—investigative journalist Mariana van Zeller goes deep into this toxic love-bombing terrain. In a clip that Ars is exclusively debuting below, you can see how van Zeller worked with an ethical hacker, Arman the Cyber, to use a fake bitcoin receipt and bait the fake Bon Jovi, giving the victim some much-needed closure.
Sneak peek at National Geographic's Super Scam Me.
Scamming a romance scammer
Broadcasting on National Geographic at 9 pm ET and available to stream on Disney+ and Hulu, the documentary takes viewers on an empathetic quest to understand how the line between “lover” and “fraud victim” gets blurred in romance scams that the Federal Trade Commission says cost Americans nearly $1.5 billion in losses each year.
An Amazon Prime phishing campaign is using fake payment alerts to steal account logins, personal data and complete credit or debit card details from unsuspecting customers.
If you’ve worked in an office, you’ve seen those phones on every desk. Some are wireless with a station, others look like regular landline phones. SIP is the language office phones use to sign in and start a call over the network. A phone call over the internet has two parts. First the two sides have to find each other and agree to talk, then the actual voice moves. SIP only handles the first part. The voices themselves travel on a separate path. That’s how most VoIP systems set up calls.
That’s why a stolen SIP password can be an issue. They are stealing the system’s belief that they are that desk phone. Once the handshake accepts them as an extension, say 1000, the phone system treats their laptop like that employee’s handset. They can place calls as other people and in many setups receive their incoming calls too.
Today we’re going to use SIPVicious against SIP and show you how it can be compromised.
Asterisk
Asterisk is a program that understands SIP and runs the office switchboard. It decides who can sign in, what numbers exist, and who can call whom. It’s one of the most popular programs for SIP.
We set it up in our lab with Docker.
SIPVicious
Next thing we need to have installed is SIPVicious. The installation is pretty simple.
The tool comes with 5 different commands: svmap, svwar, svcrack, svreport, svcrash.
Each of these commands has a help menu
ubuntu > sipvicious_svmap -h
We’ll use the first three commands for our test. The rest aren’t really important.
Identification
Using svmap we can find out what service the target is running.
ubuntu > sipvicious_svmap 127.0.0.1
Sometimes the results vary depending on whether you provide the extension. The extension is the phone’s account number.
ubuntu > sipvicious_svmap 127.0.0.1 -e 1000
You can look up the version and check whether it’s vulnerable to known exploits
Source: Cystack
Finding Account Numbers
Extensions are account numbers. They usually start at 1000. Old software will allow enumeration, but modern software ignores your requests, so you won’t be able to find out which accounts exist.
Still, it’s worth trying.
ubuntu > sipvicious_svwar 127.0.0.1 -e 1000-1010
You can also try –force and see what comes back. You’ll most likely see 401 Unauthorized, but that can vary depending on the software you’re testing.
This didn’t work in our case, because the password was not predictable.
We did have three contacts in our Asterisk setup though, and the tool successfully compromised all of them.
What Can Hackers Do
One of the biggest risks is toll fraud. Hackers can use compromised extension credentials to register to the system and place expensive international calls. That’s still the most common attack. Hackers can use compromised accounts to run vishing campaigns against other companies. If hackers are already inside and have the phonebook, they can convince employees and support teams to reset passwords, for example.
Summary
Modern software blocks enumeration of existing users, but it’s still possible given how much outdated software is out there. SIPVicious can identify the software in use and test common extensions for weak passwords. There are a few password attacks it can run with or without a wordlist. Sometimes knowing the version alone is enough to compromise a server and get into the network. Don’t overlook yours and regularly upgrade things.
Linkage analysis connects accounts, devices and infrastructure to detect coordinated fraud rings that traditional account-level risk controls may fail to identify.
Login
