OMH 2025: Adam Paciuszkiewicz

### Overview In this talk from OMH 2025, Adam Paciuszkiewicz (Bank Gospodarstwa Krajowego) provides a follow-up to his previous year's physical QR code experiment in Warsaw. He explores how physical QR stickers persist in public spaces and presents new hands-on investigations into real-world cyber fraud, including task-based phishing/money laundering schemes on Telegram and WhatsApp, and romance/investment scams originating on Tinder.

### Key Topics - **Physical QR Code Lifecycle & Tracking:** Observations on previously placed QR stickers across Warsaw, including stickers surviving on InPost Paczkomat parcel lockers and appearing on InPost's official website imagery, generating 20–30 scans weekly. - **New QR Campaign & Seasonal Impact:** Deploying posters and stickers (e.g., offering Telegram contacts for illicit substances or directing to WOŚP charity fundraisers) to test public scanning behavior. Paciuszkiewicz noted significantly lower engagement in winter compared to summer due to cold weather, collecting modest data into CSV files before stopping to avoid legal and personal data processing liabilities. - **Task Phishing & Money Muling (Telegram/WhatsApp):** An interactive dive into task scams where participants perform minor actions (liking videos, adding items to Allegro shopping carts, favoring Booking.com listings) for small payouts (40 PLN, 20 PLN). When transitioned into paying into the scheme to receive larger returns, he identified the broader money laundering and structuring mechanism. - **Romance & Investment Scams (Tinder to WhatsApp):** Creating a Tinder profile ("Michał") to track romance baiting leading to WhatsApp chats, TikTok shop investment offers, fashion arbitrage portals, and deceptive application installs.

### Technical Details - **Campaign Architecture:** QR codes linked to personal Telegram accounts (not bots) configured to reply with WOŚP donation links. Incoming user messages and metadata were logged into CSV files. - **Laundering via Task Scams:** The author earned over 100 PLN across multiple task groups ("świecące światło", VIP groups) managed by personas like "Alice" and "Małgorzata". Tasks involved sending screenshots back to managers for manual or pseudo-automated review. When required to deposit 70 PLN to receive 100 PLN, specific personal recipient bank account details were supplied, illustrating how fragmented funds circulate between participants across different service rings (Booking, Instagram, Allegro, YouTube). - **Testing Verification with Generative AI:** The speaker tested scam validation pipelines by asking ChatGPT to generate fake bank transfer confirmations. Low-quality transfer receipts received automated rejections ("payment not received"), while a realistic generated confirmation was rejected over metadata discrepancies (July vs. November dates). - **Bot vs. Human Operators:** When interacting with romance and investment scam profiles, prompt injection and logic tests suggested an AI or automated system operating initially, followed by a switch to manual human handling when unexpected prompts or broken links were introduced.

### Takeaways - **Environmental Factor in Physical Phishing:** Physical QR phishing campaigns depend heavily on seasonality and user physical comfort; freezing temperatures drastically reduce scan rates. - **Legal Boundaries in Security Research:** Taking active roles by transferring funds alters legal liability from passive research to active participation in money laundering; managing collected personal communication also risks data privacy violations. - **Scam Hygiene:** Financial and romance scams heavily mix automation with manual social engineering. Defense requires critical thinking ("heart and mind"), particularly before clicking unknown links or moving off dating apps to encrypted messengers.