Maritime Scam Alert: Fake Hormuz ‘Clearance’ Fees Demanded in Bitcoin and USDT

A new fraud vector is hitting one of the world’s most sensitive shipping lanes. Greek maritime risk firm MARISKS has warned that vessels transiting near the Strait of Hormuz are receiving fraudulent demands for “clearance” or transit fees payable in bitcoin or USDT. The ask is simple and urgent: send crypto to proceed. It preys on operational pressure, short decision windows, and the ambiguity that often surrounds local procedures in congested waters.

The core issue is not just the scam—it’s the rails. The choice of bitcoin and tether (USDT) shapes how these schemes work and how they can be stopped.

Why BTC and USDT are being targeted - Speed and perceived irreversibility: Criminals count on operations teams feeling that crypto payments clear fast and can’t be clawed back. That compresses verification time and nudges compliance out of the loop. - Cross-border neutrality: No correspondent banks, fewer obvious flags in trade finance workflows, and fewer human gatekeepers create an illusion of “official” urgency. - Liquidity and spendability: Both assets are liquid across centralized exchanges and peer-to-peer markets in the region, allowing quick off-ramps. - Psychological leverage: A wallet address with a seal or signature in an email looks “official” under time pressure. Crypto’s technical opacity to non-specialists amplifies that effect.

Ironically, these rails are traceable. Bitcoin is fully on-chain, and USDT can be frozen by the issuer when provided with sufficient evidence. That means paying on-chain does not erase the trail; it often creates one. Sophisticated operators use this asymmetry to recover faster—if they act immediately.

Operator playbook: prevent, verify, contain - Treat any demand for crypto-based “clearance” as a red flag. Legitimate Hormuz transit and port dues are arranged through established agents, banks, and charter party terms—not ad-hoc wallets. - Centralize verification. Require dual control and designated shoreside sign-off for any new payee, currency, or channel. Confirm through flag state, recognized agents, P&I, or your vetted risk advisor; never via the contact that made the demand. - Lock down comms. Standardize secure channels between vessel and ops. Train crews to escalate unusual payment requests instantly—no “just in case” transfers. - Implement crypto blocklists. Prohibit ad-hoc wallet payments from treasury. If your group holds crypto, whitelist only pre-approved counterparties; everything else auto-rejects. - Practice the drill. Run tabletop exercises mimicking an urgent “pay now or be delayed” scenario so masters and DPA/CSO know the escalation tree.

If a payment already went out - Move fast. Notify your exchange provider and, if USDT is involved, submit an urgent freeze request to the issuer with transaction hashes and evidence. - Preserve data. Capture emails, headers, phone/SMS logs, wallet addresses, TXIDs, and any on-chain metadata for investigators and insurers. - Run on-chain forensics. Map flows to exchanges or mixers; alert those venues’ compliance teams to flag or seize funds when they land. - Assess sanctions exposure. Improper payments near sensitive waterways can trigger regulatory scrutiny; engage counsel before further transfers. - Report internally and to relevant authorities. Many insurers and P&I clubs expect prompt notice for cyber or fraud incidents; coverage for extortion varies.

What this means for shipping and crypto markets - For shipowners and charterers: The cost of a false-positive payment dwarfs the time to verify. Build crypto-specific controls into your existing sanctions and payment policies rather than treating this as a niche risk. - For exchanges and stablecoin issuers: Rapid response workflows with maritime stakeholders will matter. The ability to freeze USDT is a deterrent if crews know how to trigger it. - For scammers: Asking for either BTC or USDT suggests they are optimizing for both speed and fungibility. That leaves on-chain footprints that specialized teams can exploit.

Scams thrive where time is short and authority seems murky. Clear playbooks, tight verification, and basic crypto hygiene close that gap without slowing legitimate transit.