Scams & Account Security
How can I spot crypto phishing and scams?
What are the clearest warning signs of a crypto scam?
Stop when an unsolicited contact promises profit, demands crypto, asks for a seed phrase or remote access, pressures you to act, or requires more money to unlock a withdrawal. Verify the firm, domain and contact independently. Read every wallet signature; report quickly and preserve addresses, messages and transaction records.
By: Sherpa Desk
Review status: Source-checked by the CryptoSherpa Editorial Desk; this guide is not law-enforcement or recovery advice.
Scope: United States; general scam prevention and reporting.
- Guaranteed profit
- No legitimate promoter can guarantee a crypto return
- Unlock fee
- More tax or fees demanded to release a fake balance are a common escalation
- Seed phrase
- Anyone asking for it should be treated as attempting to take control
- Recovery scam
- Victims may be targeted again by people promising to recover lost funds for payment
- 1Stop the conversation and do not send, sign, install or share anything else.
- 2Navigate independently to the official firm or project domain and regulator record.
- 3Verify the requested action through contact details you obtained independently.
- 4If affected, secure accounts, preserve evidence and report promptly through local official channels.
The story changes; the pressure pattern repeats
Scams may begin through romance, employment, support, a wrong-number message, a celebrity advert or an investment group. The contact builds trust, shows a profitable-looking platform, then asks for crypto or access. The FBI warns that fake platforms may demand additional “taxes” or fees when a victim tries to withdraw.
No legitimate support agent needs your seed phrase or private key. Do not install remote-access software, share a one-time code or approve a wallet connection because an inbound caller asks. A regulator logo, company registration number or copied website text can be impersonated.
Verify outside the conversation
Close the message and navigate independently. Check the exact legal entity and domain on the official regulator register. Call a number obtained from the official website or statement—not the message. Search for the exact domain and app publisher, while remembering that search adverts and reviews can also be manipulated.
For wallet requests, read the transaction or signature in the wallet. A vague “verify”, “sync” or “claim” button can authorise token access. If the request cannot be explained in plain language, reject it.
After a suspected compromise
Stop further transfers. Change compromised account passwords from a clean device, revoke sessions, contact the relevant provider and preserve messages, addresses, transaction hashes, receipts and timestamps. If a seed phrase was exposed, create a new wallet in a trusted environment and move remaining assets carefully.
Report through the official route for your country. Be especially cautious after a loss: the FBI and FTC warn that recovery services can be another scam. Nobody can guarantee that an irreversible transfer will be recovered.
Sources
Primary and authoritative sources checked on the dates shown:
- Cryptocurrency Investment Fraud — Federal Bureau of Investigation; accessed .
- What To Know About Cryptocurrency and Scams — U.S. Federal Trade Commission; accessed .
- Crypto investment scams — Financial Conduct Authority; accessed .
- Warning signs of fraud and scams — CFPB; accessed .
Questions
Can a scam platform show a real-looking profit balance?
Yes. A website or app can display invented numbers. A balance is not evidence of custody or profit; independently verify the entity and whether a normal withdrawal reaches an address or bank account you control.
Can a crypto transaction be reversed after a scam?
Blockchain transfers are generally difficult or impossible for a sender to reverse. Contact the involved exchange or payment provider and law enforcement quickly, but distrust anyone guaranteeing recovery for an upfront fee.
Is a verified social-media account safe to trust?
No. Accounts can be compromised or impersonated, and verification does not validate an investment claim. Use independently obtained official contact details and never send funds based on a direct message alone.