Crypto scams: warning signs and what to do next

If someone tells you to send crypto immediately, reveal a recovery phrase, or pay again to release a balance, stop the interaction. Open the relevant service independently. A polished website, familiar logo, video call or busy group chat is not proof of identity.

Scams exploit trust and pressure. If you have already acted, focus on limiting further harm and preserving evidence rather than trying to win the money back.

A stranger, online friend or apparent adviser may direct you to an investment app, then coach you through buying crypto elsewhere and transferring it in. The app can display fictional trades and profits. Even an early successful withdrawal may be part of the deception.

Illustrative example: you deposit €500, the screen soon shows €3,000, and a €50 withdrawal works. Later, “support” demands €300 in tax before releasing the balance. None of those screen values establishes that an investment exists. Stop sending money and verify the operator independently; paying the demanded release fee can deepen the loss.

Fake support agents may approach after you post a problem publicly. Others impersonate employers, officials, friends or exchange staff. A real company’s name or copied registration number does not authenticate the person contacting you.

Find the organization’s website or app yourself and use its published support channel. Do not install remote-access software, share your screen during wallet recovery, or send funds to a “safe wallet” chosen by a caller. A legitimate-looking identity document sent by the caller is not a reason to trust them.

An unexpected token, NFT or airdrop message may advertise a claim website. Simply seeing an unfamiliar token in your wallet does not mean you must interact with it. Avoid links embedded in its name or description.

A claim can ask for permission to spend other tokens. Read the requested action, asset and allowance; if you cannot explain the permission, do not sign. Closing the website or disconnecting the wallet does not cancel existing token approvals. Use your wallet’s official allowance-revocation guidance if you authorized something suspicious.

A rug pull can involve an operator removing trading liquidity or abandoning a project with users’ funds. A token can also contain restrictions that allow buying but prevent ordinary holders from selling, or impose extreme sell fees.

Check who can change contract rules, mint tokens, restrict transfers or remove liquidity. An audit badge, liquidity-lock claim or successful small trade answers only a limited question; none guarantees that every route to abuse is closed. A falling price alone does not prove fraud. If you cannot verify the controls, leave the transaction unsigned.

Stop payments and contact your bank or exchange promptly through verified channels. Explain what happened and ask whether any pending transfer or account access can be restricted. Follow the security guide for exposed logins, approvals or recovery phrases; the right response depends on what was compromised.

Keep transaction hashes, network names, receiving addresses, dates, amounts, messages, URLs and support-ticket references. Preserve original records without putting private keys or recovery phrases into a report. Report to local police or your country’s cybercrime service. In the United States, the FBI’s IC3 accepts internet-crime reports.

Be wary of unsolicited “recovery experts” promising results for an upfront fee. Reporting helps an investigation but does not guarantee recovery. Verify anyone claiming to represent law enforcement through an independently found official contact.

Reviewed 15 October 2026. Check the linked primary sources for current provider instructions and applicable protections.