How to Spot a Crypto Scam Before It Costs You

Crypto attracts fraud for three structural reasons: transactions are irreversible, anyone can create a token in minutes, and a large share of participants are new enough not to recognise a pattern they have never seen.

The good news is that the patterns are few, and they repeat.

The five shapes

1. The impersonation

Someone contacts you claiming to be support for an exchange, a wallet or a project. They are helpful, patient and technically fluent. Eventually they need your seed phrase, or ask you to “validate” your wallet on a site, or want remote access to your screen.

The rule that ends this entirely: real support never needs your seed phrase or private key. Not for verification, not for recovery, not for migration, not ever. There is no exception, so you never have to judge whether this particular case is the exception.

Also: legitimate companies do not DM you first. If someone messaged you, they are not support.

2. The guaranteed return

A platform, fund or individual offering a fixed return: 1% a day, 10% a month, “risk-free yield”. Early withdrawals work perfectly, which is what convinces people to add more.

The return is paid from new deposits. When deposits slow, withdrawals stop. This has been the same scheme for a century; only the wrapper changed.

Legitimate platforms do not work this way. A regulated exchange such as Collect & Exchange quotes a price and a fee, not a guaranteed return.\n\nThe test: ask where the yield comes from and keep asking until you get a mechanism, not an adjective. “Arbitrage”, “our trading algorithm” and “market making” are adjectives. A mechanism you can verify on-chain is an answer.

3. The token that only goes up

A new token, heavily promoted, price climbing steeply. You buy. The price keeps climbing. Then it is worth nothing in an afternoon.

Two variants. In a rug pull, the creators hold most of the supply and sell into the buying. In a honeypot, the contract itself prevents you from selling. You can buy all day and never exit.

Checks that take two minutes: how concentrated is the supply among the top holders; is liquidity locked; has the contract been audited; how old is the project. A block explorer shows the first two for free.

4. The approval drain

You connect your wallet to a site, perhaps a mint, an airdrop claim or a game, and sign what looks like a routine permission. Nothing happens. Days or weeks later your tokens are gone.

You were not hacked. You granted a contract permission to move your tokens, and it eventually did.

Defence: read what you are signing. Wallets show which contract is requesting what. Prefer limited approvals over unlimited. Periodically revoke old approvals. Every major explorer has a tool for it.

5. The romance or friendship build

Weeks of genuine-feeling conversation on a dating app or social platform, no mention of money. Eventually they mention an investment platform they use. The platform is real-looking, your balance grows, small withdrawals succeed. Then a large withdrawal requires a “tax” or “unlock fee”, and paying it leads to another fee.

This one is slow and expensive precisely because the trust is built before the ask. The signal is not the person; it is the private platform you had never heard of before they mentioned it.

Red flags worth memorising

Signal	Why it matters
They contacted you first	Real services do not cold-DM customers
Urgency, “offer ends today”	Pressure exists to prevent checking
Any request for a seed phrase	Automatic, no-exceptions theft
Guaranteed or fixed returns	Nothing in crypto is guaranteed
“Send 1 ETH, receive 2 back”	Never once been real
A support link sent in a DM	Type the address yourself instead
Pressure to pay a fee to unlock funds	Fees to release your own money are a scam structure

A thirty-second routine

Before sending anything anywhere:

1. Did they approach me? If yes, stop.
2. Is there urgency? Urgency is a tool; if a thing is real it will be real tomorrow.
3. Am I being asked for a phrase, key, or a fee to unlock my own money? Any of these ends it.
4. Did I type this address myself? Links in messages go where the sender chose, not where the text says.
5. Can I explain where the return comes from? If not, I do not understand what I am buying.

If it has already happened

Move remaining funds to a new wallet with a newly generated seed phrase. The old one must be treated as permanently compromised. Revoke token approvals from the compromised address. Report it to your local authorities and to the exchange involved if one was.

And one more thing: do not engage with anyone who offers to recover your funds. Recovery services that contact victims are the second scam, aimed at the people the first one already found.