Crypto Scam Warning Signs
The patterns behind most crypto scams, plus an interactive triage checklist that explains which of your answers raise concern and what to read next.
Crypto Security and Scam Protection
Start from the problem you are trying to solve: protecting a wallet, judging whether something is a scam, checking a request before you sign it, securing an account, verifying a token or contract, or responding to an incident that has already happened.
Crypto security is mostly a small number of habits applied consistently. Transfers are final and there is no fraud department, so prevention carries far more weight than response.
These guides describe how attacks actually work and what to do about them. We do not accuse named companies of fraud without evidence, we do not invent statistics, and we never refer anyone to paid recovery services.
Wallet protection
“How do I hold crypto without losing it to my own setup?” Keys, backups and the split between everyday and long-term storage.
Scam detection
“Is this offer, message or website a scam?” Recognising the patterns before anything is sent or signed.
Fake Support and Impersonation Scams
Why inbound 'support' is the most reliable red flag in crypto, and how to reach genuine support without ever trusting a contact that found you.
Wallet Drainers and Crypto Phishing
What a wallet drainer is, the approval or signature it needs from you, and the habits that stop it before the prompt appears.
Fake Airdrops and Giveaway Scams
Airdrop and giveaway scams rarely ask for a password. They ask for a signature, an approval, or a transfer first.
Social Engineering and Investment Scams
Long-form crypto fraud builds trust first and asks for money later. The platform is fake; the deposits are real.
Transaction and signing safety
“I am about to approve or sign something — what should I check?” The last point at which anything can be stopped.
How to Check a Transaction Before Signing
A practical pre-signing workflow: what to read in the prompt, what approval scope means, and why a signature request is not always a transaction.
Token Approvals and Revoking Access
An approval is standing permission for a contract to move your tokens. Understanding that one sentence prevents a large share of wallet losses.
Address Poisoning and Clipboard Malware
Two quiet attacks that redirect a transfer to an attacker's address, and the verification habit that defeats both.
Account security
“How do I stop someone taking over my exchange or email account?” Passkeys, second factors, SIM-swap defences and platform settings.
Account Security and SIM-Swap Risk
Passkeys, authenticator apps, security keys and SMS compared — plus SIM-swap defences and the account settings that limit damage.
Token and contract verification
“Is this the token, contract or site I think it is?” Checking identity and control before interacting.
How to Verify a Token Contract Address
A step-by-step procedure for confirming a contract address is the one you meant — and a clear account of what that does not prove.
Rug Pulls Explained
The different mechanisms behind rug pulls, what each warning signal can and cannot tell you, and an investigation workflow you can actually run.
How to Verify a Crypto Website, App or Address
A repeatable verification routine — domain, publisher, contract, address, link and signature checks — before any transfer or connection.
Incident response
“Something has already happened — what do I do in the next hour?” Containment, evidence and reporting.
What to Do After a Crypto Scam
A decision tree by what actually happened, then the ordered emergency checklist: contain, document, report.
Seed Phrase or Private Key Exposed
Treat an exposed recovery phrase as a wallet that is already compromised. Move funds to keys the attacker has never seen.
Crypto Recovery Scams
A second scam aimed at victims of the first. No private service can reverse a confirmed blockchain transaction.
How to Report a Crypto Scam in the United States
Where to file, what each agency covers, and the evidence to collect first. Reporting is a record, not a recovery service.
Current threats and security updates
“What is happening right now?” We do not run a news feed. Instead, the pages describing live attack techniques carry a review date and are revised when the technique changes.
If you are in the middle of an incident
Stop sending funds, stop talking to the other party, and work through the emergency checklist in order. Nobody can reverse a confirmed transfer, so the goal in the first hour is containment and evidence.
- Move any remaining funds to a newly created wallet on a device you trust.
- Change your email password from a clean device and revoke active sessions.
- Replace SMS two-factor authentication with an app or hardware key.
- Record transaction hashes, addresses, domains and message threads.
- Report to the FBI's Internet Crime Complaint Center and the FTC if you are in the US.
- Work through the full emergency checklist linked below.
The five habits that prevent most losses
- Never enter a recovery phrase anywhere except your own wallet during a deliberate restore.
- Reach important sites through your own bookmarks, never through advertisements or message links.
- Verify the destination address against the recipient's own deposit screen, including middle characters.
- Use app-based or hardware two-factor authentication, never SMS alone.
- Keep long-term holdings on a hardware wallet, separate from day-to-day activity.
Related tools
Related data
Keep going
Educational information only. Nothing here is financial, legal or tax advice. Read our data methodology for how our live figures are sourced.