0.51alertpay

ThePostmodernPonziScheme:EmpiricalAnalysisofHigh-YieldInvestmentProgramsTylerMoore1,JieHan2andRichardClayton31ComputerScienceDepartment,WellesleyCollege,USAtmoore@cs.
wellesley.
edu2ComputerScienceDepartment,WellesleyCollege,USAjhan@wellesley.
edu3ComputerLaboratory,UniversityofCambridge,UKrichard.
clayton@cl.
cam.
ac.
ukAbstract.
AHighYieldInvestmentProgram(HYIP)isanonlinePonzischeme,anancialfraudthatpaysoutrageouslevelsofinterestusingmoneyfromnewinvestors.
Wecallthisfraud'postmodern'inthatso-phisticatedinvestorsunderstandthefraud,buthopetoprotbyjoiningearly.
Theseinvestorssupport'aggregators'–reputationwebsitesthattrackthestatusofHYIPs.
Weexamine9monthsofaggregatordataandshowthatthereisnoevidenceofcollusionbetweendierentag-gregators.
WeusetheirdatatoassessHYIPtimetocollapse,nding–perhapsunsurprisingly–thatlongerlifetimesareassociatedwithlowerinterestpaymentsandlongermandatoryinvestmentterms.
WelookattheroleofdigitalcurrenciesinsupportingHYIPs,ndingthatahandfulofsystemsdominate.
Finally,weestimatethatthistypeofcriminalityisturningoveratleast$6million/monthandsetoutwaysinwhichitmightbedisrupted.
1IntroductionAHighYieldInvestmentProgram(HYIP)isanonlineversionofanancialscaminwhichinvestorsarepromisedextremelyhighratesofreturnontheirin-vestments.
Paymentsaremadetoexistinginvestorsfromthefundsdepositedbynewcomers,continuinguntilinsucientfundsremainandtheschemecollapses.
Similarschemeshaveoperatedintheoineworldfor150yearsormoreandareoftencalledPonzischemesafterafamousswindlerin1920'sBoston.
Despitebeingillegaltooperateinmostjurisdictions,thereareaconsiderablenumberofactiveHYIPwebsitesatanygiventime.
Wecallthem'postmodern'Ponzischemesbecausewebelievethatmanyoftheinvestorsarewellawareofthefraudulentnatureofthesites,butbelievethatbyinvestingatanearlystage–andwithdrawingtheirmoneybeforethescheme'scollapse–theywillbeabletomakeaprotattheexpenseoflesssavvyinvestors.
AnextensiveonlineecosystemhasdevelopedinsupportofHYIPs,involvingdiscussionwebsites,digitalcurrencies,andthird-party'aggregator'websitesthattrackHYIPperformance.
TheseaggregatorslistdozensofactiveHYIPs,trackingcorefeaturessuchasinterestrates,minimuminvestmenttermsandfundingoptions.
Theyoperateforumsinwhichindividualscanreporttheirexperiences;2TylerMoore,JieHanandRichardClaytonFig.
1.
ScreenshotofHYIPmacrotrade.
comandthecorrespondingentryontheag-gregatorhyip.
com.
butmoresignicantly,theaggregatorsappeartomaketheirowninvestmentsinsomeoftheHYIPsandreportonwheninterestpaymentscease.
Asanillustrativeexample,Figure1showsascreenshotoftheHYIPmacrotrade.
com,alongwithitsentryontheaggregatorwebsitehyip.
com.
WehavespentmanymonthscollectingdatafromHYIPwebsitesandag-gregatorstomeasuretheextentofHYIPactivity,sothatwecanimproveourunderstandingofthisparticulartypeofonlinecriminality.
InSection2weexplainourdatacollectionandmeasurementmethodology.
InSection3wediscussourevidenceastowhethertheaggregatorsitesaremakingtruthful1reports.
InSection4weexamineHYIPlifetimesandinvestigatetheextenttowhichitispossibletopredicttheircollapse.
InSection5wediscusstheroleof'digitalcurrencies'inthisecosystemandtheninSection6weestimatethescaleofthisparticulartypeofonlinecriminalityanddiscussvariouswaysthatitmightbediscouraged,ifnotentirelystampedout.
InSection7wesurveyrelatedworkandnallyinSection8wesummarizewhatwehavelearnedsofarandconsiderwhatfurtherworkmightreveal.
1Weavoidtheword'honest'becausethisisnotanappropriatewordtouseincon-junctionwithcriminalactivity.
EmpiricalAnalysisofHigh-YieldInvestmentPrograms32DataCollectionMethodologyWetermthewebsitesthatprovidereputationservicesforHYIPprograms'aggre-gators'.
GiventhatHYIPsarecondencegamesthatkeepgrowingsolongasnewinvestorscanberecruited,theseratingsarepotentiallyverypowerfulindicatorsofHYIPsuccessorfailure.
FromaGooglesearchfor"HYIP"issuedinNovember2010,weidentied9aggregatorwebsitestomonitor(myhyip.
com,maxhyip.
com,iehyip.
com,hyipranks.
com,hyipmonitor.
com,hyipinvestment.
com,hyip.
com,hothyips.
com,andeveryhyip.
com).
BetweenNovember17,2010andAugust21,2011wemadedailyvisitstoeachaggregatorwebsite(withtheexceptionoffourdaysinNovemberandDecember2010duetoabuginourcrawler).
WeparsedthepageswefetchedtoextractthekeycharacteristicsoftheHYIPstheylisted:interestrate,investmentterm(s),userandaggregatorratings,alongwithpaymentstatus(i.
e.
,paying,notpaying).
Thenamesaggregatorsuseforeachoftheseeldsvariedslightly,sowemanuallyuniedtheterminologyandstoredeachobservationinadatabase.
Atotalof141014observationsweremade.
AlltheaggregatorwebsitesprovidelinkstotheHYIPs,thoughsomeoftheselinkspassviaaninterstitialpage.
FromJanuary2011onwards,wedeterminedtheURLofeachoftheHYIPsandcapturedtheWHOISrecordforeachHYIPdomain.
OurautomatedsystemalsovisitedeachHYIPwebsite,andstoredthesourceleslinkedtoorloadedfromthehomepage.
ThesedailyvisitstotheHYIPwebsitesweremadeoverTor2;itsanonymitypropertieshelpensurethatthewebsitewouldnotbeabletoidentifyusortriviallyconnectourvisits.
2.
1MeasuringHYIPactivityWehaveusedthecollecteddatatoderiveseveralkeymeasurements,whosecalculationwenowdescribe.
LinkingHYIPrecordsacrossaggregators.
Unfortunately,itcanbediculttodeterminewhentwoaggregatorsarereportingonthesameHYIP.
WeusethewebsiteaddressoftheHYIPasacanonicalidentier,butwhenwefailedtoascertainthis(e.
g.
,theHYIPwebsitewasshutdownbeforewefollowedthelink),wehavecomparedthenamesthattheaggregatorgavetoHYIPs–strippingoutwhitespaceandpunctuationanddoingacaselessmatch.
The9aggregatorslisted1576distinctHYIPs–ofthese,211didnotresolvetoawebsiteandcouldnotbeidentiedasanHYIPwhichhadeverbeenresolved.
595HYIPsappearedonmorethanoneaggregatorwebsite,whiletheother981appearedonlyonce.
Itislikelythatsomeofthe981uniqueHYIPsareduplicatesthatwefailedtolinkup;however,wetreatthemasdistinctinourstudy.
2http://www.
torproject.
org/4TylerMoore,JieHanandRichardClaytonMeasuringHYIPlifetimes.
OnekeymeasureofHYIPperformanceishowlongafterinitialcreationtheschemecollapses.
Identifyingwhenawebsiteisreadyforbusinessisimpracticable,sowedeemtheHYIPlifetimetobetheelapsedtimebetweentheHYIP'srstappearanceasreportedbyanaggregatorsite(whichwebelievewillbecontemporaneouswiththerstaccountsbeingcreated)anditseventualdisappearancefromthataggregator(invariablybecausetheHYIPhascollapsedandisnolongerpaying).
Normalizingprotrates,investmentterms,andexpectedpayouts.
Thereisenor-mousvariationintheinterestratespromisedbyHYIPs,fromtheoutrageous440%in10minutesoeredbytop-capital.
comtothecomparativelymodest1–2%perdayoeredbymacrotrade.
com.
ManyHYIPsoeramenuofinvest-mentchoicesthatvarybyinvestmentlevelandterm,justasalegitimatebankdoesfortheircerticatesofdeposit(CDs).
Forthispaper,westartbynormalizingthepublishedinterestratesandinvestmenttermstoadailyrate.
WethencomputeanexpectedpayoutvaluethatisstandardizedacrossHYIPs.
Toarriveattheexpectedpayout,wehadtoinferamodelofhowinvestmentsgrowovertime.
Subtlydierentphrasingmustbeinterpreteddierently,asindicatedinthefollowingtable:PhraseInterestRateInvestmentTermExpectedPayoutx%forydaysx%yx*y*principalx%inydaysxy%yx*principalx%afterydaysxy%yx*principalx%dailyx%--Ineverycasewedonotcompounddailyonthecurrentvalue,butcompoundontheoriginalprincipal.
Inotherwords,wedonotassumethatanyoftheinterestthatispaidoutwillbereinvested.
Wetakethisapproachbecauseitisconsistentwiththereturnsoninvestment(ROI)reportedbythevastmajorityofaggregators.
Additionally,ifHYIPinvestorsareindeed'postmodern'andknowtotakeprotsasrapidlyaspossible,thentheirstrategywillbetobeavoidkeepingmoneyinanysingleschemefortoolong.
3CantheReportsofHYIPAggregatorsbeTrustedGiventhatallHYIPsarefraudulent,itisnaturaltoaskwhetherthereportsfromaggregatorsshouldbetrusted.
Whileascertaininggroundtruthisimpossible,wehavedevisedanumberofmeasurementstoassesstherelativeaccuracyofdatareportedonHYIPs.
Inparticular,595ofthe1576HYIPs(38%)aretrackedbyatleasttwoaggregatorsandsowecancomparethereportsaboutthesameHYIPacrossdierentaggregators.
Ifthereisroughconsensusthen,eithertheaggregationsitesareinauniversalconspiracy,ortheyareindependentlyassessingtheHYIPsinatruthfulmanner.
EmpiricalAnalysisofHigh-YieldInvestmentPrograms53.
1ReportingofHYIPAttributesWedeterminedwhattheaggregatorsreportedtobethemaximumandminimuminvestmentlevelsallowedbytheHYIP,thereferralratesoeredtoaliatesforsigningupnewinvestors,andthewithdrawalmethodoered(automatic,manual,orinstant).
Whenwecollatethisinformationandlookforsimilaritywegettheseresults:InvestmentReferralRateWithdrawalmaxminhighlowtypePerfectAgreement0.
400.
870.
440.
43-DiversityIndex0.
720.
940.
770.
750.
88TherstrowofthistablereportsthefractionofHYIPswhereallaggregatorreportsareinperfectagreement.
Ascanbeseen,for40%ofHYIPs,themaximumallowedinvestmentvaluesareinagreement,while87%ofthetimetheminimuminvestmentvalueisreportedtobethesamebydierentaggregators.
Ofcoursetheseattributesareallmattersoffact,whichtheaggregatorwillhaveobtainedfromtheHYIPwebsites(orperhapsfromthellinginofaform).
However,theaggregatorsareimperfectanderrorsarebeingmade.
IftherewascollusionbetweenaggregatorsandHYIPsthenwewouldhaveexpectedtoseeperfectagreement–eitherfrombetterchannelsofcommunication,orfromaconsistentsetofmistakesbeingmade.
Bycontrast,whenweconsidertheamountofmoneythattheaggregatorsreportthattheyhaveininvestedintoparticularHYIPs,weseeverylittleagree-mentatall:AggregatorInvestmentPerfectAgreement0.
10DiversityIndex0.
51AnyinvestmentatallallowstheaggregatorstoassesswhethertheHYIPispaying,andwehavejustnotedthereisreasonableagreementaboutwhattheminimumvaluemightbe.
Therefore,wepresumethattheamountsbeinginvestedreecttheinitialopinionoftheaggregatorabouttheprospectsfortheHYIP.
Iftherewassomekindofuniversalconspiracythenwewouldexpecttoseeconsistencyhere,buttheaggregatorsinvestthesameamountofmoneyintoHYIPsinonly10%ofcases.
Naturally,evenwhenthereisn'tunanimousagreementacrossaggregators,itcouldstillbethecasethatalmostallofaggregatorsreportthesamevalues.
Consequently,thetwotablesalsoreportSimpson'sdiversityindex[1]foreachattribute.
Thismeasuresthesimilarityofasamplepopulationanditiscomputedasthesumofthesquaresofalltheprobabilitiesforeachattributevalue,witha0scoreshowingcompletediversityandcompleteuniformitygivingascoreof1.
Onceagain,usingthismeasure,weseeahigh,butimperfect,agreementonmattersoffact,butcontinuingdiversityintheinvestmentamount.
6TylerMoore,JieHanandRichardClayton3.
2ReportingofHYIPLifetimesWenowconsidertheelapsedtimebetweenwhenHYIPsarereportedtobecreated–oratleastwhentheaggregatorlearnsoftheirexistence–andwhentheHYIPscollapseandtheaggregatorisnolongerpreparedtotrackthem.
Figure2(left)plotstheCumulativeDistributionFunction(CDF)ofthestandarddeviationsofthereportedstartingandendingtimesofHYIPsacrossaggregators.
Foraround80%ofHYIPs,thestandarddeviationisverysmall,atmostafewdays.
However,fortheremaining20%ofHYIPs,thereissubstantialdisagreementbetweenaggregators.
Furthermore,thatdisagreementisgreaterforthelastobservedtimeforanHYIPthanforthestartingtime,asindicatedbytheslightlylowerbluedashedlinethansolidredlineinthegraph.
Thisisnotsurprising,giventhatdecidingwhentodropanHYIPfromresultsismoreofajudgementcallforanaggregatorthandecidingwhethertoreportitsexistence.
ThegreendottedlineplotsthestandarddeviationsforanalternativemeasureofHYIPcollapse.
AggregatorskeeptrackoftheirowninvestmentsinHYIPs,reportingeachdaythecumulativereturnoninvestment(ROI).
Often,theROIwill'at-line'–suddenlystopchanging–afewdaysbeforetheaggregatorstopstrackingtheprogram,becausetheHYIPisnolongerpayingout.
Hence,wecanviewthetimewhentheROIstopschangingasanalternativeindicatorofcollapse.
Asthegraphindicates,thereisevenmorevariationhere–someaggregatorsstopreceivingpaymentsbeforeothers.
Again,thisisnotsurprising,sinceHYIPsmaynotstopallpaymentsatonce.
Aggregatorsgenerallyagreeonlifetime,butwhentherearedierencestheycanbelarge,soforlifetimevalueweusethemedianoftheaggregatorreports.
Byusingthemedian(ratherthancomputingthemean),wearebetterprotectedagainstahighlydivergentaggregatorpollutingtheoverallmeasure.
Overall,ouranalysisofaggregatorreportsisthatthereisnoevidenceofcollusion,butthattheirmeasurementsaregenerallyconsistent,andthatourfurtheranalysisbasedonthemedianofaggregatorvalueswillberobust.
4TheCollapseofHYIPProgramsAnHYIPschemecollapseswhenitcannolongermaketheinterestpaymentsthatithaspromised.
Whileitmaynothavecompletelyrunoutofmoney,arationalHYIPoperatorwilleventuallyconcludethatpayingthenextroundofinterestpayments(orrefundingsomeone'scapital)islesslucrativethanshuttingtheschemedownandabsconding.
Thesecalculationsareslightlydierentincy-berspacethanforrealworldPonzischemesbecausetherewillbenobankruptcyandnoliquidatorscheckingtoseeifanyvaluecanbesalvagedfromtheruins.
4.
1HowLongdoHYIPsSurviveOnesubtletyinmeasuringHYIPlifetimesisthatsomeschemesremainedviableattheendofourstudy,makingitimpossibletoobservewhentheseschemesEmpiricalAnalysisofHigh-YieldInvestmentPrograms70204060801000.
00.
20.
40.
60.
81.
0CDFofStd.
DeviationofHYIPLifetimeMeasuresStd.
Deviation(Days)FractionofHYIPswithStd.
Dev.
tDaysLifetime(LastObseved)Lifetime(LastObseved)(95%CI)Lifetime(ROIFlat-Line)Fig.
2.
CDFofthestandarddeviationsofHYIPlifetimes(left);thegraphindicatesthataggregatorsassesssimilarlifetimesforaround80%ofHYIPs.
SurvivalfunctionofHYIPlifetime(right);thegraphshowsthatmostHYIPscollapsewithinafewweeks,butthatasmallfractioncanremainopenforseveralyears.
ultimatelycollapsed.
Thiscanbesolvedusingsurvivalanalysis:the187(12%ofthe1576total)HYIPsthatwerestilloperationalattheendofourinvestigationaresaidtobe'right-censored'.
AsurvivalfunctionS(t)measurestheprobabilitythatanHYIP'slifetimeisgreaterthantimet.
Thisissimilartoacomplementarycumulativedistributionfunction,exceptthatthecensoreddatapointsmustbetakenintoaccountandtheprobabilitiesestimated.
WeusethestandardKaplan-Meierestimator[2]tocalculateasurvivalfunctionforHYIPlifetimes.
Figure2(right),hasalogarithmicx-axisandplotstheobservedsurvivalfunctionforHYIPs(usingthemedianobservedlifetimesacrossallaggregators).
ThesolidbluelineindicatesthesurvivalfunctioncomputedusingtheHYIP'slastobservedtime,whilethegreendottedlineplotsthesurvivalfunctionusingtheROIat-linemethoddescribedintheprevioussection.
Forveryshort-livedHYIPs(i.
e.
,lessthanoneweek),thelifetimemeasuredusingtheROIat-linemethodisconsiderablyshorter.
However,forlonger-livedschemes,thelifetimesarenearlyindistinguishable,soweignoretheROIat-linemethodforsubsequentanalysis,andjustusethemedianofthelifetimevalues.
ThesurvivalfunctiondatashowsusthatthewhilethemedianlifetimeofHYIPsisjust28days,oneinfourwilllastmorethanthreemonths,andoneintenformorethantenmonths.
Thatis,althoughmanyHYIPscollapsealmostimmediately,asubstantialminoritypersistforaverylongtime.
8TylerMoore,JieHanandRichardClayton1stdecile(164)0100200300HYIPLifetimevs.
DailyInterestRate(pct)Lifetime(Days)1stdecile(100)0100200300400HYIPLifetimevs.
InvestmentTerm(Days)Lifetime(Days)Fig.
3.
HYIPswithlowerdailyinterestratestendtolastlongerbeforecollapsing(left);HYIPswithlongermandatoryinvestmentperiodstendtosurvivelonger(right).
4.
2WhatFactorsAectHYIPTime-to-CollapseGivensuchregularturnoverandwidevariationinlifetimes,itisnaturaltowonderwhatmightprolongortriggercollapse.
Figure3examineshowthegenerosityoftheHYIPinvestmenttermsaectstheobservedlifetimes.
Ontheleft,boxplotsforHYIPlifetimesaregiventhatspandierentprotrates.
WhenanHYIPoersalessgenerousprotrate(lessthanafewpercentdaily),thereisagreaterchancethattheHYIPwillsurviveforlonger.
Oncetheprotratesbecomemoreoutlandish(suchasthehalfofHYIPsoeringmorethan10%dailyreturns),HYIPlifetimesaremoreconsistentlyshort.
Weconcludethattheoeringofhigherratesofreturndoesnotbringinsucientinvestmenttoosetthecostofservicingexistingcommitments.
AnotherfactoristheminimuminvestmentperiodrequiredbytheHYIP.
Figure3(right)plotsHYIPlifetimessortedbyinvestmentterm.
Asexpected,HYIPsthatrequirelongerinvestmenttermstendtobemorestable.
However,wenotethatthereisstillsubstantialvariationinlifetimeevenforlessgener-ousinterestratesandlongerinvestmentterms.
Evidently,someHYIPscannotattractenoughinvestmenttosustaineventhesemoremodestprograms.
4.
3CanUsersorAggregatorsPredictCollapseSeveralaggregatorsrateHYIP'quality',oftenonascaleofzerotovestars.
Theratingcanvaryconsiderablyovertime,ostensiblyaccordingtotherisklevelassociatedwiththescheme.
Someaggregatorsalsocompileuserratings,typicallycollectedintheformofpositive(andsometimesnegative)votes.
Wenowexaminehowthecrowd'sratingcomparestothatofthecurator's.
Wefocusonthefouraggregatorsthatreportbothuserandaggregatorratingsonanitescale.
Someaggregatorssimplytallythetotalnumberofuservotes,EmpiricalAnalysisofHigh-YieldInvestmentPrograms9whileothersreporttheabsolutedierencebetweenpositiveandnegativevotes.
Weexcludethesereportsfromouranalysistoeasecomparisons.
Theratingswestudyarebasedonascoreofzerotove,zerototen,oroutof100;wenormalizeallratingstoapercentage.
WhiletheratingshavebeencollectedthroughoutanHYIP'slifespan,wehavedecidedtotakeacloserlookattheratinggiven7dayspriortoeachHYIP'scollapse.
Alowratingissuedatthispointwouldindicatetoprospectiveinvestorsthatthebottomwillsoonfallout(ifithasnotalready).
Theresultsaregiveninthefollowingtable.
UserRatingAggregatorRatingAggregator#HYIPsAvg.
≤50%≥80%Avg.
≤50%≥80%everyhyip.
com4687%13%85%20%83%9%hyip.
com26552%45%47%8%94%3%hyipranks.
com10796%4%96%35%89%7%hothyips.
com29250%48%46%32%92%0.
3%Average-60%38%57%22%92%3%Overall,userratingsareconsistentlymuchmorepositivethanaggregatorratings.
Considertheratingsforhyipranks.
com:theaverageuserratingoneweekpriortocollapseis96%.
AcrossallHYIPs,96%wereawardedauserscoreof80%orhigher,butonly4%hadascorebelow50%.
Bycontrast,theaverageassessmentdirectlyissuedbyhyipranks.
comisonly35%.
Moreover,89%ofHYIPsaregivenalowscore,comparedtojust7%thatreceiveascoreover80%.
WhydoweseesuchdivergenceinratingsThosewhohavealreadyinvestedinanHYIPhaveaverystrongincentivetoattractnewinvestors.
Consequently,theyarehighlymotivatedtovoteearlyandofteninsupportoftheirinvestment.
Theaggregators,ontheotherhand,fullyexpectHYIPstocollapseandmustprovidemoreaccurateassessmentsinordertogainthetrustofvisitors.
Viewedinthisway,itisnotsurprisingthatthecrowdwillnotaccuratelypredictcollapse.
5TheRoleofDigitalCurrenciesDigitalcurrenciesareanessentialcomponentofafunctioningHYIPecosystem.
Theyallowinvestorstoconvertlocalhardcurrencyintoamulti-nationalformthatissuitablefortransferstoandfromtheHYIP.
OccasionallyanHYIPwilldirectlyacceptwiretransfersorcreditcardpayments.
However,thisisunusualbecauseiftheHYIPoperatorworkswithinthetraditionalnancialsystem,thentheyriskbeingidentiedwhenthefraudcollapses,andtheywillbelesssurethattheywillbeabletohangontoanyprots.
Wefoundthat22currencieswereacceptedforuseattheHYIPswetracked.
MostofthesewereonlyoeredbyahandfulofHYIPs(including14HYIPsthattookPayPal,7Moneybookersand1WesternUnion).
Welistthesixmostcommoncurrenciesbelowandnotethatthemostcommon,byfar,wereLiberty10TylerMoore,JieHanandRichardClaytonReserveandPerfectMoney,acceptedby83%and70%ofHYIPs,respectively.
BothcurrenciesarebasedinCentralAmerica.
HYIPsCurrency#%Country%HYIPBacklinksLibertyReserve130983%CostaRica33%PerfectMoney109570%Panama72%AlertPay39725%Canada10%SolidTrustPay513.
2%Canada60%Pecunix211.
3%Panama81%GlobalDigitalPay201.
3%HongKong71%DigitalcurrenciesareriskierthantraditionalcurrenciesforboththeinvestorandtheHYIPoperator.
Whenthetimecomestocashinandconvertbacktohardcurrency,theexchangeratemayhavechangedsignicantly,ortheremaybenoliquidity–ifmanyofthecustomersofadigitalcurrencysimultaneouslyasktocashintheirholdings,thenthecurrency'soperatorsmaynotbeabletopayup(e.
g.
,theHYIP-associatedStrictPaycurrencyappearstohavecollapsedinthisway[3]).
ThedigitalcurrenciesthatHYIPsaccepthavetermsandconditionsthatforbidtheirusewithHYIPs.
Thiscreatestheadditionalriskthatassetscouldbefrozenorconscatedforviolatingtherules.
Furthermore,anydigitalcurrencythatfacilitateswidespreadcriminalityrunstheriskofbeingshutdownbylawenforcement,ashappenedtoe-gold[4].
LibertyReservehasawarningonitswebsiteadvisingagainstinvestinginHYIPs,notingthatpaymentsare'non-revocable'andthattheycannotbeheldliableforfraudulentactivitiesbyitsusers.
Suchadmonishmentsraisetheques-tion:howmuchofthesecurrencies'protscomefromHYIPactivityWeattempttoshedlightonthisbyexaminingthebacklinksfromotherwebsitesintothecurrencywebsites.
WeusedYahooSiteExplorer3togather1000backlinksforeachofthemostcommoncurrenciesandcalculatedwhatproportionoftheincominglinkscamefromHYIP-relatedwebsites.
Theresultsarelistedintheright-mostcolumnofthetable.
72%ofthebacklinkstoPerfectMoneyarefromHYIP-relatedwebsites,asare33%ofthebacklinkstoLibertyReserve.
ThisleadsustoconcludethatasubstantialproportionoftherevenuetothesecurrenciescomesfromHYIPs.
NotethatforAlertPay,thethird-mostpopularcurrency,only10%oftheincom-inglinksarefromHYIPs.
Indeed,manyofAlertPay'sotherincominglinksarefromlegitimatebusinesses,suchastheweb-hostingcompanyprodhosting.
net,whichusesAlertPaytoprocesspayments.
AlertPayisbasedinCanada,andthatmaymeanthattheyaremoreeasilypressuredbyrstworldregulators,thanthecurrenciesbasedinPanamaandCostaRica.
3http://siteexplorer.
search.
yahoo.
comEmpiricalAnalysisofHigh-YieldInvestmentPrograms116PolicyOptionsforDisruptingtheHYIPEcosystemOneoftherstquestionstoaskwhenconsideringpolicyinterventionsintoonlinescamsishowprevalentthescamis.
Ifonlyafewpeopleareaected,thenthecriminalitymaynotbeworthpursuing,especiallywhen–asinthiscase–manyoftheinvestorsareawarethatthesitesarefundamentallyfraudulent.
ItisdiculttodirectlymeasurehowmanypeopleandhowmuchmoneyareinvestedinHYIPs.
However,wecanusesomepubliclyavailableproxiestoderiveanorder-of-magnitudeestimateofHYIPimpact.
AspartofitsAdwordsprogram,GoogleoersaKeywordToolthatreturnssimilarsearchphrasestothosegivenasinput.
4Weenteredthephrases"hyip"and"highyieldinvestmentprogram",andwerereturned100closelyrelatedphrases.
GooglealsooersarelatedservicecalledTracEstimatorthatesti-matesforanyphrasethenumberofglobalmonthlysearches.
Wepluggedall102HYIP-relatedphrasesintothetooltoarriveatanestimateof441000monthlysearchesforthesetermsonGoogle.
WecanusethisvaluetocreatearoughestimateofthemonthlyinvestmentlevelstoHYIPsusingthefollowingformula:$HYIPinvestmonth=#Googlemo.
searchesGooglemarketshare*%invest*investamountGoogle'sglobalmarketshareinsearchisknowntobe64.
4%buttheothertermsinthisequationaremuchhardertoestimate.
WedonothavereliabledataonthefractionofuserswholearnaboutHYIPsthatultimatelyinvest,orhowmuchmoneytheyputin.
Aplausible,conservative,guessisthatatleast1%ofpeoplewhosearchforHYIPsgoontoinvestinanHYIP.
Researchersinvestigatingspam-advertisedpharmaceuticalsfoundthat0.
5%ofsitevisitorsaddeditemstotheirshoppingcarts[5],whileinanearlierstudytheyfoundanapproximately8%conversionratefornon-pharmaceuticalgoods[6].
Leontiadisetal.
estimatedthatbetween0.
3%and3%ofpeoplelookingfordrugsviawebsearchultimatelypurchasedthegoodsfromillicitretailers[7].
Whiletheinvest-mentrateforHYIPscouldundoubtedlydierfromthatforpharmaceuticals,thesedatapointsdosuggestthata1%conversionrateforHYIPsisplausible.
Fromobservationofthestatisticalinformationthatsomesitesprovide,wewillguessthattheaverageinvestmentis$1000.
PluggingthesenumbersintotheaboveformulaweestimatethatHYIPsattractatleast$6millionpermonthinrevenue.
Giventhataround600000peoplesearchforHYIPseachmonth,weconcludethatHYIPsareindeedasubstantialscamworthyofpolicymakers'attention.
SowhatshouldbedoneWenowconsiderarangeofinterventionsandassesstheirlikelyimpact.
Option1:EngageLawEnforcement.
GiventhatHYIPsareillegalinnearlyalljurisdictions,itislogicaltoseekthesupportoflawenforcement.
IntheUS,the4https://adwords.
google.
com/select/TrafficEstimatorSandbox12TylerMoore,JieHanandRichardClaytonCommodityFuturesExchangeCommission(CFTC)hasbeengiventhepowertoenforceviolationsoftheCommoditiesExchangeActof1936.
TheCFTCregularlyuncoversPonzischemeswhoseperpetratorsandvictimsarebasedintheUS.
Internationalcooperationispossible:theCFTCrecentlyarrestedJereyLowranceandextraditedhimfromPeruforallegedlyrunningaPonzischemethatsolicitedinvestorsviatheInternet[8].
Consequently,engagingtheCFTCcouldleadtosuccessfulcriminalprosecution.
However,theusualwarningsaboutprosecutingonlinecrime[9]apply:col-lectingevidenceacrossinternationalbordersisdicult,slowandexpensive;theperpetratorsmaybelocatedincountriesunwillingtocooperate.
Google'sdatashowsthatthat85%ofHYIP-relatedsearchesaremadefromoutsidetheUS,sovictimswillbespreadacrosstheglobe,necessitatinganinternationalresponse.
Policyinterventionsthatapplypressuretokeyintermediarieshavehistori-callybeenoneofthemostsuccessfulwaystoaddressillicitactivityonline.
Forexample,theUSUnlawfulInternetEnforcementActof2006haslargelyelimi-natedonlinegamblingbyUSresidentsbyrequiringpaymentprocessorstoblockcredit-cardpaymentstooshoregamblingsites.
TheDigitalMilleniumCopy-rightActof1998createdanotice-and-takedownregimewherebyonlineserviceprovidersreceiveimmunityforcomplyingwithtake-downrequestsissuedbycopyrightholders.
SowenowturntoconsideringpotentialintermediariesthatmightbeenlistedtodisrupttheHYIPecosystem.
Option2:TargetDigitalCurrencies.
ThedigitalcurrenciesthatHYIPsrelyonforcustomeraccountsarealogicaltarget.
AsshowninSection5,ahandfulofcurrenciesfacilitatemostHYIPtransactions.
Thebiggestoenders(LibertyReserveandPerfectMoney)areundoubtedlyawareoftheirroleinfundingHYIPs,sobringingittotheirattentionisunlikelytomakeanydierence.
Thebankingregulatorsintheirclaimedhomecountries(CostaRicaandPanama)mightbepersuadedtocooperatewithanoutsidecrackdown.
However,eveniftheystoppedprocessingHYIPpayments,itislikelythatalternativecurrencieswouldcometothefore.
Option3:SqueezeCredit-CardPayments.
Anotheroptionistoblockthefundingofdigitalcurrenciesbycreditcards.
Atpresent,acreditcardcanbeusedtofundthemostpopulardigitalcurrencies,includingLibertyReserveandPerfectMoney.
Althoughthisisanobviousopportunitytoapplypressure,itmightprovediculttoidentifyalltheintermediariesthatcansupplythecurrency,andultimatelythetracwouldshifttowiretransfersinstead.
Option4:UndermineAggregators.
Amorepromisingapproachistodisrupttheaggregators,sincetheyareessentialforestablishingtrustinHYIPtransactions.
Forexample,onecouldtargettheregistrarsthathaveregisteredthedomainsinuse.
Persistentwebsitesareessentialforestablishingthereputationoftheaggregators,sotheyaremorelikelytobeadverselyaectedbyadomainnameseizurethan,say,malware-distributingsites.
ManyaggregatorsarecurrentlyservedbyNorthAmericancompanies(e.
g.
,hyip.
comandhyipranks.
comareEmpiricalAnalysisofHigh-YieldInvestmentPrograms13registeredthroughGoDaddy,maxhyip.
comisonTucows,andhyip.
comisforsalebyAmericandomain-parkingrmSedo).
However,thisislikelytorequirenewlegislation,sincetheaggregatorsaremerelydescribingandlinkingtotheHYIPsites.
ItcouldbesometimebeforesuchlegislationwasinplaceintheUSA,letaloneinallthejurisdictionstowhichthesitescouldmove.
Alternatively,theaggregators'incomestreamcouldbedisrupted.
Fourofthenineaggregatorswestudied–hyip.
com,iehyip.
com,hyipranks.
comandhyipinvestment.
com–aremembersoftheGoogleDisplayNetwork.
Google,andtheotheradvertisingnetworks,mightchoosenottoworkwithsitesthatknowinglylinktofraudulentsites.
Whetherstoppingthissourceofincomewouldcauseallthesitestoclosecannotbeknownforcertain,butitisrelativelystraightforward,andarguablyinthebestinterestsoftheadvertisingnetworkstoceasetheirnancialassociationwithcriminalitycomparisonsites.
Option5:TargetmostthesuccessfulHYIPs.
AnaloptionistoattempttoexpeditethedemiseofHYIPwebsites.
Whilethismightappearahopelesslydif-culttaskgiventhatwehaveobservedaround1600HYIPsinjustninemonthsofdatacollection,targetingthesmallnumberoflong-livedHYIPscouldbeeec-tive.
Along-livedHYIPisboundtobecontinuingtoattractmanyvictims,sincenewrecruitsareneededtoprolongthelifeofthescam.
Consequently,eortstodisrupttheseprogramsareverylikelytoreapsubstantialrewards.
Overonethird(49)ofthe141HYIPsthathavebeenonlineformorethansixmonthsareregisteredviaeNom,aUS-basedregistrar.
26areregisteredthroughIndian-basedDirecti,alongwithanother14onUS-basedGoDaddy.
Consequently,makingregistrarsawareofthecriminalbehaviorbeingfacilitatedbythesewebsitescouldtriggerashort-termdisruption.
Onbalance,whileeachofthediscussedoptionsmayhelp,weexpectthatoptions4and5arelikelytobemosthelpfulfordisruptingthecurrentHYIPecosystem.
Wealsobelievethatactionbylawenforcement(option1)coulddoalotofgoodinthelongerterm.
7RelatedWorkDuringthepastdecade,onlinecriminalityhasproliferated[9].
Inresponse,anumberofmeasurementstudieshavequantiedvariousfraudsandrecommendedsuitableinterventions.
Ofparticularrelevancearestudiesthatexamineusersusceptibilitytovariousscams,suchasfakeantivirus[10,11]andextortionatesocial-engineeringscams[12].
StajanoandWilsonidentifysevenprinciplescom-montooinescamsthatoftentranslateintoonlinescams[13].
AtleastveoftheseprinciplesapplytoHYIPinvestment:theherdprinciple(falsesafetyinnumbers),thedishonestyprinciple(victim'sownillegalbehaviorheldagainsthim),deceptionprinciple(thingsarenotwhattheyseem),needandgreedprin-ciple(desperationincreasesvulnerability),andthetimeprinciple(timepressuresincreasebadchoices).
Consequently,whilewebelievethatmanyHYIPinvestorsarelikelytobeawareofthefraudulentnatureoftheirinvestment,theyare14TylerMoore,JieHanandRichardClaytonnonethelessbeingmasterfullydeceivedbyconartists.
Furthermore,itisentirelyplausiblethatsomevictimsfullybelieveinthelegitimacyoftheirinvestment.
TheuseandabuseofdigitalcurrencieshasbeenexaminedsincetheinceptionoftheFinancialCryptographyconference.
Optimistspointedtothepotentialtoenhancerevenue[14]orfreedomthroughanonymity[15].
However,evenintheseearlydays,othersfrettedaboutthepotentialforabuseofdigitalcash,suchasmoneylaundering[16].
Morerecently,Andersonidentiednon-revocabilityasthekeyfeatureofdigitalpaymentsthatappealsmosttoonlinecriminals[17].
Indeed,thenon-revocabilityofpaymentsissuedinthecurrenciesunderpinningtheHYIPecosystemisessentialforitssuccessfuloperation.
Thesecurityandreliabilityofcrowdsourcingininformationsecurityappli-cationshasbeeninvestigatedbyMooreandClayton[18](phishing)andChiaandKnapskog[19](websecurity).
Thesepapersdiscussthedistinctchallengesofcrowdsourcingapplicationswhenparticipantsmaybemotivatedtolie,aswehavefoundforuserspromotingaggingHYIPs.
Analareaofrelevantworkisintheexaminationofinterventionstocom-batonlinecrime.
Inanexpansivestudyofgoodsadvertisedbyemailspam,Levchenkoetal.
[20]foundsubstantialconcentrationintheregistrarsusedbyspam-advertisedwebsites.
Theyalsofoundthatonly3banksprocessedthebulkofpayments.
WereportsimilarlevelsofconcentrationintheHYIPecosystem.
Claytonfoundthatshuttingdownhostingprovidersthatfacilitatespamtrans-missioncanhaveadisruptiveshorttermeect[21].
Finally,Liuetal.
[22]ex-aminetheprospectsofenlistingregistrarstosuspend'knownbad'domains,concludingthatthecriminalsaremoreadeptatshiftingtonewdomainsfasterthantheoendingdomainscanbesuspended.
Whilethismaybetruefordo-mainsusedinemailspam,wearemoreoptimisticforregistrar-levelinterventionincombatingHYIPsduetothepersistenceofsuccessfulschemes.
8ConclusionsandFutureWorkWehavepresentedtherstdetailedanalysisofHYIPs–fraudulentonlinePonzischemes.
Wehaveprovidedsomebaselinemeasurementsbyleveragingdatafromtheaggregatorsitesthatexisttohelpinvestorspickwheretoplacetheirmoney.
Wehaveshownthattheaggregatorsarebasicallytruthful,andusedtheirdatatoshowthatHYIPslastlongerwithlowerinterestratesdelaysbeforepaymentsaremade.
Wehavealsoshownthattheaggregatorsarebetterthan'thecrowd'inwarningofHYIPcollapse,whichwebelieveisdirectlyrelatedtothecrowdactivelywishingtohypetheprospectsoftheHYIPtheyareinvestedin.
Nontheless,thispaperhasonlyscrapedthesurfaceinmeasuringandun-derstandingHYIPs,andthereismuchmoredatatocollectandprocess.
ItisalreadycleartousthatmanyofthesitesarerelatedtoeachotherascriminalscreatenewinstancestoreplaceHYIPsthathavecollapsed.
Wehavebeenun-able,sofar,touseWHOISdatatoidentifyserialoendersbutweexpecttomakeheadwaywhenweconsiderthestructureandcontentofthewebsites.
EmpiricalAnalysisofHigh-YieldInvestmentPrograms15WeareparticularlyinterestedinthesubsetofHYIPsthatprovidearunningcommentaryonthenumberofaccountsopened,andthesumsofmoneybeinginvested,withdrawnandpaidoutasinterest.
WehopetousethesetobuildabettermodelofHYIPcollapse,andprovidebetterestimatesofthesumsofmoneypassingthroughthesecriminalenterprises.
Asweextendouranalysisandmeasurementofharm,weintendtoensurethatthispaper'sotherkeycontribution–adetailedanalysisofhowthiscriminalitymightbedisrupted–maybeofevengreaterrelevancetopolicymakers.
References1.
Simpson,E.
H.
:Measurementofdiversity.
Nature163(1949)6882.
Kaplan,E.
,Meier,P.
:Nonparametricestimationfromincompleteobservations.
JournaloftheAmericanStatisticalAssociation53(1958)457–4813.
Lorenzini,M.
:Strictpayscam:Thoughtsbeforestrictpayshutdown.
HYIPNews(June2010)http://www.
hyipnews.
com/news/17190/STRICTPAY-SCAM-THOUGHTS-BEFORE-STRICTPAY-SHUTDOWN/.
4.
Zetter,K.
:Bullionandbandits:Theimprobableriseandfallofe-gold.
Wired(June2009)http://www.
wired.
com/threatlevel/2009/06/e-gold/.
5.
Kanich,C.
,Weaver,N.
,McCoy,D.
,Halvorson,T.
,Kreibich,C.
,Levchenko,K.
,Paxson,V.
,Voelker,G.
M.
,Savage,S.
:Showmethemoney:Characterizingspam-advertisedrevenue.
In:ProceedingsofUSENIXSecurity2011,SanFrancisco,CA(August2011)6.
Kanich,C.
,Kreibich,C.
,Levchenko,K.
,Enright,B.
,Voelker,G.
,Paxson,V.
,Savage,S.
:Spamalytics:Anempiricalanalysisofspammarketingconversion.
In:ConferenceonComputerandCommunicationsSecurity(CCS),Alexandria,VA(October2008)7.
Leontiadis,N.
,Moore,T.
,Christin,N.
:Measuringandanalyzingsearch-redirectionattacksintheillicitonlineprescriptiondrugtrade.
In:ProceedingsofUSENIXSecurity2011,SanFrancisco,CA(August2011)8.
Commission,C.
F.
E.
:PressReleasePR6074-11:CFTCchargesJeeryA.
Lowranceandhiscompany,FirstCapitalSavingsandLoan,withoperatingamilliondol-larforeigncurrencyPonzischeme(July2011)http://www.
cftc.
gov/PressRoom/PressReleases/pr6074-11.
html.
9.
Moore,T.
,Clayton,R.
,Anderson,R.
:Theeconomicsofonlinecrime.
JournalofEconomicPerspectives23(3)(Summer2009)3–2010.
Cova,M.
,Leita,C.
,Thonnard,O.
,Keromytis,A.
,Dacier,M.
:AnanalysisofrogueAVcampaigns.
In:Proc.
RAID2010,Ottawa,ON,Canada(September2010)11.
Stone-Gross,B.
,Abman,R.
,Kemmerer,R.
A.
,Kruegel,C.
,Steigerwald,D.
G.
,Vigna,G.
:Theundergroundeconomyoffakeantivirussoftware.
In:10thWorkshopontheEconomicsofInformationSecurity,Fairfax,VA(June2011)12.
Christin,N.
,Yanagihara,S.
,Kamataki,K.
:Dissectingoneclickfrauds.
In:ACMConferenceonComputerandCommunicationsSecurity(CCS),Chicago,IL(Oc-tober2010)15–2613.
Stajano,F.
,Wilson,P.
:Understandingscamvictims:sevenprinciplesforsystemssecurity.
Commun.
ACM54(March2011)70–7514.
Birch,D.
G.
W.
,McEvoy,N.
A.
:Electroniccash-technologywilldenationalisemoney.
InHirschfeld,R.
,ed.
:FinancialCryptography.
Volume1318ofLectureNotesinComputerScience.
,Springer(1997)95–10816TylerMoore,JieHanandRichardClayton15.
Chaum,D.
:Achievingelectronicprivacy.
ScienticAmerican(August1992)96–10116.
Wayner,P.
C.
:Moneylaundering:Past,presentandfuture.
InHirschfeld,R.
,ed.
:FinancialCryptography.
Volume1318ofLectureNotesinComputerScience.
,Springer(1997)301–30617.
Anderson,R.
:Closingthephishinghole:Fraud,riskandnonbanks.
In:FederalReserveBankofKansasCity–PaymentSystemResearchConferences.
(2007)18.
Moore,T.
,Clayton,R.
:Evaluatingthewisdomofcrowdsinassessingphishingwebsites.
InTsudik,G.
,ed.
:FinancialCryptographyandDataSecurity.
Volume5143ofLectureNotesinComputerScience.
,Springer(2008)16–3019.
Chia,P.
H.
,Knapskog,S.
J.
:Re-evaluatingthewisdomofcrowdsinassessingwebsecurity.
In:FinancialCryptographyandDataSecurity.
(2011)20.
Levchenko,K.
,Chachra,N.
,Enright,B.
,Felegyhazi,M.
,Grier,C.
,Halvorson,T.
,Kanich,C.
,Kreibich,C.
,Liu,H.
,McCoy,D.
,Pitsillidis,A.
,Weaver,N.
,Paxson,V.
,Voelker,G.
,Savage,S.
:Clicktrajectories:End-to-endanalysisofthespamvaluechain.
In:IEEESymposiumonSecurityandPrivacy,Oakland,CA(May2011)431–44621.
Clayton,R.
:HowmuchdidshuttingdownMcColohelpIn:SixthConferenceonEmailandAntispam(CEAS).
(July2009)22.
Liu,H.
,Levchenko,K.
,Felegyhazi,M.
,Kreibich,C.
,Maier,G.
,Voelker,G.
M.
,Savage,S.
:Ontheeectsofregistrar-levelintervention.
In:USENIXWorkshoponLarge-scaleExploitsandEmergentThreats(LEET),Boston,MA(March2011)