Lesson Objective
Crypto rarely creates the deception
Most crypto scams use familiar forms of fraud: impersonation, false investments, romance manipulation, fake technical support, advance-fee demands and account takeover. Crypto can make the loss faster and harder to reverse because transactions may be final, addresses are pseudonymous and funds can move across services and borders quickly.
A polished website, visible blockchain transaction or wallet balance does not prove that an investment or service is legitimate. Scammers can fabricate dashboards, copy company branding and send small early withdrawals to build trust.
Pause Before Acting
The scammer's basic playbook
Contact. The approach arrives through an advertisement, social platform, dating app, text, email, phone call or compromised account.
Trust. The scammer impersonates authority, demonstrates apparent expertise or invests time in a relationship.
Pressure. A deadline, emergency, exclusive opportunity or fear of loss reduces the victim's time to verify.
Transaction. The victim buys crypto, sends it, connects a wallet, shares credentials or approves a malicious request.
Escalation. A fake profit, small withdrawal or invented problem leads to larger deposits, taxes or release fees.
Recovery fraud. After the loss, another impersonator promises recovery in exchange for more money or wallet access.
Common crypto scam patterns
| Pattern | How it appears | Central warning |
|---|---|---|
| Fake investment platform | A realistic dashboard shows increasing returns, but withdrawals fail or require more fees. | Displayed profits may be invented; do not pay to unlock your own funds. |
| Romance or relationship fraud | A trusted online contact gradually introduces a profitable crypto opportunity. | Emotional trust is used to bypass independent verification. |
| Impersonation | A government agency, bank, exchange, employer or celebrity demands action or payment. | Legitimate authorities do not demand crypto to protect funds or avoid arrest. |
| Tech-support scam | A caller or popup claims an account or device is compromised and requests remote access. | Do not install remote-access software or move funds on an unsolicited caller's instructions. |
| Wallet-draining site | A fake claim, airdrop, mint or verification page asks the user to connect and sign. | The signature may authorize token transfers or broad spending rights. |
| Recovery scam | A supposed investigator, lawyer or hacker guarantees stolen funds can be recovered. | Recovery is never guaranteed; upfront fees and requests for keys are serious warnings. |
Fake investment platforms
These schemes may begin with a social-media advertisement, wrong-number text, dating relationship, investment group or referral from a compromised friend. The victim is coached to open a legitimate exchange account, buy crypto and transfer it to a wallet or website controlled by the fraudster.
The dashboard displays profits that may have no connection to real assets.
A small withdrawal may be permitted to establish confidence.
The fraudster encourages progressively larger deposits or borrowing.
When withdrawal is requested, the platform invents taxes, insurance, verification deposits or liquidity fees.
Additional payment does not release the funds; it increases the loss.
A Genuine Tax Is Not Paid to Unlock a Private Dashboard
Impersonation and crypto ATM scams
A scammer may claim to represent a bank, police service, tax authority, courier, utility, technology company or crypto exchange. The victim is told that funds are at risk and must be moved into a "safe" wallet or sent through a crypto ATM using a supplied QR code.
End the call and use a verified number from an official statement, card or website.
Do not trust caller ID, email branding, badges, documents or video appearances by themselves.
No wallet address supplied by a stranger is a protected government or bank account.
Never keep a suspicious transaction secret because the caller claims it is part of an investigation.
Phishing and fake support
Phishing messages imitate exchanges, wallet providers and support teams. They may claim that an account is locked, a withdrawal is pending or a security upgrade is required. The link leads to a cloned sign-in page or wallet connection request.
| Request | Safe response |
|---|---|
| Password or authentication code | Do not provide it. Open the service independently through a saved bookmark or verified app. |
| Recovery phrase or private key | Never disclose it. Legitimate support does not need it. |
| Remote access to your screen | Decline and disconnect. Remote-control tools can expose accounts and signatures. |
| Move assets to a safe wallet | Do not use an address supplied by the caller or message. |
| Connect wallet to verify ownership | Do not connect through the link. Confirm the service and purpose independently. |
Wallet-draining approvals
A malicious website may not ask for a recovery phrase. Instead, it asks the wallet to sign a transaction or message that grants a smart contract permission to transfer tokens. The request may be disguised as a login, airdrop claim, NFT mint, account verification or cancellation.
Read the wallet's transaction interpretation and warnings before signing.
Treat unlimited token approvals as high risk unless they are necessary and the contract is verified.
Use a separate wallet with limited funds for unfamiliar applications.
Periodically review and revoke unnecessary approvals using a trusted tool.
Do not assume a signature is harmless merely because it sends no crypto immediately.
Signing Means Authorizing
Fake tokens, airdrops and giveaways
Look-alike tokens: A scammer can create a token with the name and symbol of a legitimate asset. Verify the contract or mint address.
Unsolicited tokens: Spam assets may appear in a wallet. Avoid visiting links embedded in token names or descriptions.
Giveaway multiplication: A message promises to return more crypto than the user sends. Legitimate promotions do not require this arrangement.
Airdrop claims: A fake claim page may request broad approvals or lead to malicious software.
Pump-and-dump groups: Promoters coordinate hype, sell their own holdings and leave later buyers with losses.
Job, task and business-opportunity scams
A fake employer may offer online work involving product ratings, app optimization or transaction tasks. The platform displays commissions but requires the worker to deposit increasing amounts of crypto to complete the next task or withdraw earnings.
A legitimate employer pays the worker; it does not require deposits to release wages.
A small early payment may be a confidence-building tactic rather than proof of legitimacy.
Verify the employer through independently located contact information and registered corporate records.
Be cautious when all communication moves quickly to encrypted messaging applications.
Recovery scams target victims twice
Fraudsters monitor social media, complaint forums and blockchain activity for people seeking help. They may impersonate investigators, law firms, regulators, cybersecurity specialists or asset-recovery companies.
No legitimate recovery professional needs your recovery phrase or private key.
A tracing report does not itself create the power to seize or return assets.
False legal documents and regulator branding can be manufactured.
Upfront crypto payments, guaranteed recovery and secrecy are major red flags.
Report through official law-enforcement and regulator channels before hiring anyone.
Red flags across many scams
Guaranteed returns, unusually consistent profits or claims of little or no risk.
Unsolicited contact from an expert, adviser, celebrity or government representative.
Pressure to act immediately or keep the transaction secret.
Instructions to buy crypto and send it to an address controlled by someone else.
A requirement to pay fees, taxes or deposits before a withdrawal can occur.
Requests for recovery phrases, private keys, authentication codes or remote access.
Communication limited to messaging apps with no verifiable business address or registration.
Testimonials, screenshots or profit dashboards offered instead of independently verifiable evidence.
Discouragement from speaking with family, a bank, an accountant or a regulator.
A five-minute verification routine
Stop. Do not transact while the other person is waiting or directing you.
Separate. Close the supplied link and locate the organization independently.
Search. Check regulator registration tools, investor alerts, domain history and credible reporting.
Confirm. Call the organization using verified contact information and describe the request.
Consult. Discuss the decision with a trusted person who is not emotionally invested in the opportunity.
Registration Is Necessary but Not Sufficient
Protective wallet habits
Keep recovery phrases and private keys offline and never disclose them.
Use unique passwords and strong multifactor authentication for custodial accounts.
Bookmark important services rather than following message or advertisement links.
Separate long-term holdings from a wallet used with applications.
Verify contract addresses through authoritative sources.
Review every transaction on the trusted wallet or hardware display.
Use transaction limits, allowlists and multiple approvals for organizational holdings.
Update devices and wallet software through verified channels.
If you suspect fraud: act quickly
Stop contact and payments. Do not send another fee, tax, deposit or recovery payment.
Preserve evidence. Save wallet addresses, transaction hashes, messages, emails, phone numbers, URLs, screenshots and payment records.
Protect accounts. From a clean device, change compromised passwords, revoke sessions and notify affected exchanges or financial institutions.
Protect the wallet. If a phrase or key was exposed, move remaining assets to a newly created secure wallet; if only approvals were granted, revoke them using a trusted method.
Report promptly. Contact local police and the appropriate national fraud-reporting service, securities regulator and platform.
Warn trusted contacts. A compromised email or social account may be used to target others.
Canadian reporting and verification
| Need | Official starting point |
|---|---|
| Report fraud or cybercrime | Canadian Anti-Fraud Centre and the federal Report Cyber and Fraud portal. |
| Check investment registration | Canadian Securities Administrators National Registration Search and provincial regulator. |
| Review warnings | CSA Investor Alerts and the applicable provincial securities commission. |
| Report theft or threats | Local police; call emergency services when there is immediate danger. |
| Notify a financial intermediary | The bank, exchange, custodian, payment provider or crypto ATM operator involved. |
Fraud controls for organizations
Require independent call-back verification for new payment instructions and wallet addresses.
Separate transaction preparation, approval and reconciliation.
Use allowlisted destinations, limits and multiple approvers.
Train staff to recognize executive, vendor, support and regulator impersonation.
Prohibit recovery-phrase entry into websites, email, chat or support tickets.
Maintain an incident plan covering account compromise, wallet approvals and mistaken transfers.
Record and escalate unusual urgency, secrecy or changes in payment method.
Accounting Perspective
Key takeaways
Crypto scams usually combine traditional manipulation with fast, difficult-to-reverse payments.
A polished platform, visible transaction or early withdrawal does not prove legitimacy.
No legitimate support representative needs a recovery phrase or private key.
A wallet signature may authorize future transfers even when no crypto moves immediately.
Never pay additional money to unlock fake profits or guarantee recovery.
Stopping, verifying independently and consulting another person are powerful controls.
Quick knowledge check
Why might a fake investment platform permit a small early withdrawal?
What should you do when a caller says your funds must be moved to a safe wallet?
How can a malicious signature cause loss without asking for a recovery phrase?
What are the warning signs of a recovery scam?
Which evidence should be preserved after suspected fraud?
Glossary
- Approval phishing
- Deception that induces a wallet user to authorize a malicious smart contract or spender.
- Impersonation
- Pretending to be a trusted person or organization to obtain money, information or access.
- Phishing
- A deceptive message or website intended to steal credentials or cause an unsafe action.
- Recovery scam
- A second fraud that promises to recover lost assets in exchange for payment or wallet access.
- Remote-access software
- A tool allowing another person to view or control a device over the internet.
- Rug pull
- A scheme in which project operators remove liquidity, abandon the project or otherwise leave buyers with severe losses.
- Wallet drainer
- Malicious software or contracts designed to obtain authorization and transfer assets from a wallet.
Sources and further reading
Editorial note: This lesson was independently written for Fichtner Digital and synthesizes the cited sources in original language. It does not reproduce substantial passages from them. Facts and links last reviewed 22 July 2026.
Educational purposes only. Not financial advice. No fraud-prevention procedure can eliminate all risk. If there is immediate danger, contact emergency services. Recovery of transferred crypto is not guaranteed. This material does not constitute financial, legal, cybersecurity, accounting, tax or investment advice.