Pause Before Sendwallet safety · scam watch

Newsletter issue #1: the bail kiosk, the fake Ledger update, and a scam that hides in plain sight

Published · Updated

Web version of the email sent Oct 24, 2026. Sources window: Oct 5–19, 2026; every item and link re-checked Oct 24, 2026.

I work in cybersecurity, and most crypto scams aren't clever one-offs: they follow patterns you can learn to spot. This is one short email a week with what's circulating right now and how to avoid it. — J

Three scams going around

1. "Your vote/your donation" scams are back for the midterms

On Oct 15 the FBI warned that scammers are using the 2026 midterm election to run fraud schemes:

The FBI's line worth remembering: "Campaign donations are not an investment and will not increase in value nor be returned." Check your registration only at vote.gov, and check PACs on the FEC's website. (FBI IC3, Oct 15, 2026)

2. The "we'll make it go away" company that allegedly didn't

On Oct 13 the FTC warned about paid "sextortion help" services. Its example is Digital Forensics, the company behind sites like BlackmailHelpline.com. The FTC's lawsuit alleges it charged thousands of dollars and failed to deliver on its promises. The FTC's advice:

Same lesson as crypto "recovery" services: anyone charging a desperate person up front to fix things deserves a hard look. (FTC, Oct 13, 2026)

3. A crypto-ATM operator agrees to leave the business

On Oct 8, Kansas's bank regulator and 33 other state regulators announced a $2.5 million settlement with kiosk operator Coinme over anti-money-laundering violations. Coinme agreed to end its crypto-kiosk operations by Jan 1, 2027, or pay another $4 million. (Kansas OSBC, Oct 8, 2026)

This matters because crypto ATMs are where phone scammers send people. The FBI's 2025 state figures, for example:

(FBI IC3; our breakdown: crypto ATM scams in Kansas and Missouri; all states: data page)

How it works: the phone call that walks you to a kiosk

The script barely changes:

  1. Someone calls claiming to be a deputy, a court, your bank or "Apple support."
  2. There's an urgent problem: a warrant, a hacked account, a frozen card.
  3. You're told not to tell anyone.
  4. The caller stays on the line while you withdraw cash and feed it into a "bail kiosk" or "federal bond kiosk." It's really a Bitcoin ATM.

Missouri law requires kiosks to show a warning before every purchase. It asks whether you got a call from "your bank, software provider, the police," or were told to pay "warrants, or bail money at this kiosk," and answers: "STOP." (RSMo 361.1100)

Kansas went further on July 1. New kiosk customers face lower limits and a 72-hour hold. If you report fraud within 30 days and give the operator a police report or sworn declaration, transactions in your first 14 days must be refunded. In September, that law got a Sedgwick County woman her money back by check. (Kansas HB 2591; Sedgwick County DA, Sep 9, 2026)

One thing to do tonight

Pick a family safe word, and tell the people you love this rule: no government agency, court or real company will ever ask you to pay at a crypto ATM, and anyone who keeps you on the phone while you move money is a scammer. Hang up and call back using a number you look up yourself. (FBI IC3)

Crypto corner

Fake "Ledger firmware update" pages. On Oct 16, security firm SlowMist flagged a phishing campaign riding on real news. Ledger devices sold through one Southeast Asian reseller, CryptoBilis, were found with hidden implants that steal the recovery phrase. The fake pages copy Ledger's "Genuine check" screen and add an "Update Now" button. What they collect is your 24 words. Since then, Ledger has asked all of its sellers in Southeast Asia and Hong Kong to pause sales while it investigates.

Ledger says it does not email firmware-update requests. Real updates happen only in the official app and are confirmed on the device. No website ever needs your recovery phrase. (SlowMist; Ledger; BleepingComputer, Oct 14, 2026; explainer: fake Ledger firmware update)

Address poisoning, still working. Scam Sniffer reported two more losses on Oct 6–7 (UTC): $30,004 in USDT and $12,000 in USDC. Both victims copied a lookalike address from their own transaction history; the real and fake addresses matched at the start and end. The fix: never copy a send address from history, and check the middle characters. (Scam Sniffer; Scam Sniffer; checklist: address poisoning)

About this email

Newsletter home