Somewhere in the Persian Gulf, roughly 2,000 ships and 20,000 seafarers are waiting. They’ve been stranded since Iran tightened its grip on the Strait of Hormuz amid its war with the US and Israel. Getting through means running a military gauntlet — or, if you believe the right message in your inbox, paying a fee in cryptocurrency.

That second option was a scam. At least one ship that fell for it was fired upon by Iranian forces.

On April 20, the Greek maritime risk management firm MARISKS issued an alert to shipowners: unknown actors had been sending messages to shipping companies, posing as Iranian authorities and demanding “transit fees” in bitcoin or tether. The messages instructed recipients to submit ship documents for assessment by Iranian Security Services, after which a crypto fee would be set and safe passage granted.

The exact wording, as cited by MARISKS and reported by Reuters: “After providing the documents and assessing your eligibility by the Iranian Security Services, we will be able to determine the fee to be paid in cryptocurrency (BTC or USDT). Only then will your vessel be able to transit the strait unimpeded at the pre-agreed time.”

“These specific messages are a scam,” MARISKS warned, confirming the messages did not originate from Iranian authorities.

A grain of truth

The scheme worked because it exploited a sliver of reality. Iran has, in fact, proposed charging cryptocurrency tolls for safe transit through Hormuz. Hamid Hosseini, spokesperson for Iran’s Oil, Gas and Petrochemical Products Exporters’ Union, said as much on April 9, according to CoinDesk. The strait, which normally carries roughly one-fifth of global oil and liquefied natural gas supply, has been largely closed since late February.

MARISKS identified at least one vessel that attempted transit on April 18 — during a brief window when Iran claimed it was allowing inspected ships through — and was fired upon by Iranian military forces. The firm believes that ship had been duped by the scam. Reuters was unable to independently confirm the connection.

The Epaminondas

On April 22, the Liberia-flagged, Greek-owned cargo ship Epaminondas — operated by MSC and owned by Technomar Shipping — was transiting the strait eastbound at approximately 0355 hours when an IRGC gunboat approached and opened fire with no prior radio contact, according to UK Maritime Trade Operations and maritime intelligence firm Vanguard.

The ship’s master reported that the vessel had been informed it had permission to transit. The bridge sustained heavy damage. Greek outlet Ekathimerini reported that authorities are now investigating whether that permission message was fraudulent.

Iran’s Islamic Revolutionary Guard Corps claimed the ship was seized for operating “without the necessary permits.” Greece’s Foreign Minister Giorgos Gerapetritis confirmed the attack to CNN but said he could not confirm the seizure. The Greek Ministry of Shipping stated the vessel had sustained “extensive damage.” All crew were reported safe.

Two other vessels — the MSC Francesca and the Euphoria — were also fired upon or seized in the same window, according to Lloyd’s List and the BBC. Four other ships in an MSC convoy reportedly crossed the strait with their transponders turned off.

Phishing in a war zone

What makes this scam viable is the information environment around Hormuz. Legitimate transit permissions, when they exist at all, arrive through fragmented, informal channels. There is no verified, cryptographically signed system for Iranian transit authorization. Into that vacuum stepped opportunists with a convincing email and a wallet address.

The threat model for a ship’s master now includes not just naval gunfire and mines but phishing. When your navigation risk landscape encompasses both the IRGC and cryptocurrency fraudsters, the operating assumptions have shifted beneath the waterline.

Iran has not commented publicly on the scam, according to Reuters. The shipping companies involved have not responded to press inquiries. The US blockade of Iranian ports, meanwhile, continues — Central Command said 28 vessels have so far been directed to turn around or return to port.

For the roughly 20,000 seafarers still stranded in the Gulf, the distinction between a real Iranian transit permit and a fake one is not abstract. It is the difference between safe passage and a gunboat.

Sources