Consumer complaint received 2025-05-07 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Foris DAX, Inc.
State: GA

Complaint narrative:
Between late XXXX and early XX/XX/year>, I was the victim of a sophisticated cybercrime scheme involving phishing-based deception and impersonation. Over {$41000.00} in unauthorized cryptocurrency transfers were executed through my Crypto.com account without my knowledge, intent, or consent. The individuals responsible impersonated a known digital marketing company, sent falsified onboarding documents, and redirected my browser to malicious domains ( including XXXX ) via deceptive links delivered through platforms like XXXX, XXXX, and email. 

At no point did I share my Crypto.com credentials, XXXX codes, XXXX tokens, or recovery phrases. My account was protected by multi-factor authentication, and I maintained exclusive control over my device. There is no indication that anyone else had authorized or physical access. The transactions occurred during a session that I did not initiate, approve, or engage with in any way. Upon discovering the unauthorized activity, I promptly reported the incident to Crypto.com and submitted extensive documentation, including wallet addresses, transaction hashes, timestamps, communications, and flagged domain reports from my antivirus software. 

Crypto.com ultimately denied my claim, stating that no credential change was detected and that the transactions occurred during a session authenticated with valid credentials. However, this explanation does not reasonably account for phishing-based session hijacking, remote exploit access, or injected malwarerecognized vectors in cases of digital financial fraud. 

Additionally, Crypto.com 's denial appears to rely on narrow interpretations of its Account Protection Program ( APP ) and Terms of Use. Their explanation does not clarify whether access gained through deception or exploit constitutes unauthorized use, nor does it define how users are protected in cases of non-consensual but credential-authenticated access. Their policy lacks transparency around protections for victims of phishing, malware, or remote session compromisedespite consumers following all standard security practices. 

In similar cases involving credential-authenticated but unauthorized transactions, other platforms have recognized the distinction between access via fraud and true user authorization. Denying recovery based solely on session authenticationwithout considering deceptive accesscreates precedent that undermines consumer trust and safety in digital financial ecosystems. 

Reports have been formally submitted to the FBIs Internet Crime Complaint Center ( IC3 ), the Federal Trade Commission ( FTC ), and I have attempted to file locally with law enforcement. All evidence has been preserved with metadata intact and is available upon request. Im requesting CFPB assistance to prompt a second-level review by Crypto.com and to highlight the broader consumer risk posed by current crypto platform policies in handling digital financial fraud.

Company response to consumer: Closed with explanation