How to Avoid Crypto Scams and Phishing (US-Focused)

Crypto’s combination of irreversible transactions and no central customer-service backstop makes it an attractive target for scammers. This guide covers the most common scam patterns targeting US crypto users and the practical habits that block most of them, along with where to report fraud if it happens to you.

Phishing: the most common entry point

Phishing attacks impersonate a legitimate service — an exchange, a wallet provider, even a government agency — to trick you into revealing login credentials or your seed phrase. Common vectors include fake emails or texts claiming urgent account problems, cloned websites with URLs that look almost identical to the real thing, and fake browser extensions or wallet apps distributed outside official app stores. The core defense, covered in more depth in our wallet security guide, is simple: never enter your seed phrase anywhere except your own wallet software during setup or recovery, and always navigate to services directly rather than clicking links in unsolicited messages.

Romance and “pig butchering” scams

This scam pattern, sometimes called pig butchering because victims are gradually cultivated before being financially fleeced, builds a long-term personal relationship, often starting on a dating app or social media, before introducing a supposedly lucrative crypto investment opportunity. The scammer typically directs the victim to a fake trading platform showing fabricated gains to encourage larger deposits, then blocks withdrawals once a significant sum has been deposited. The relationship-building element makes this scam pattern more effective than a cold approach, and it disproportionately targets people who haven’t previously used crypto, since the fake platform is often their first exposure to how a “normal” exchange interface looks.

Impersonation and fake support scams

Scammers frequently impersonate exchange support staff, wallet company employees, or even government regulators like the SEC or FinCEN, often reaching out proactively by phone, chat, or social media to offer “help” recovering funds or resolving a fake account problem. A key defensive fact: legitimate exchanges and government agencies do not proactively contact you asking for your seed phrase, remote access to your device, or a crypto payment to resolve a problem or “verify” your identity. If you’re unsure whether contact from your exchange is real, close the conversation and reach the platform directly through the contact information listed on its official website, not a number or link the contact gave you.

Fake giveaways and celebrity impersonation

“Send crypto to this address and receive double back” giveaway scams, often impersonating public figures or official-looking accounts on social media, remain common despite being widely publicized as fraudulent. No legitimate giveaway requires you to send funds first. Verified account badges and follower counts on social platforms can be faked or purchased and should not be treated as proof of legitimacy on their own. Compromised legitimate accounts are also sometimes used to post these scams, so even an account you recognize can be temporarily hijacked to spread one.

Rug pulls and fake projects

A rug pull is when a token’s creators abandon a project and abscond with invested funds, sometimes after artificially inflating the price, sometimes by exploiting a technical mechanism that lets them drain a liquidity pool. Warning signs include anonymous teams with no verifiable track record, aggressive promises of guaranteed or unusually high returns, and pressure to buy quickly before a supposed price increase. None of these signs are proof of fraud on their own, but their presence together is a reason for real caution rather than urgency, particularly when a project resists basic transparency questions about its team or its funding source.

SIM-swapping: a less obvious attack vector

SIM-swapping involves a scammer tricking or bribing a mobile carrier into transferring your phone number to a device they control, which can let them intercept SMS-based two-factor authentication codes and potentially take over exchange and email accounts. This is a strong argument for using an authenticator app or hardware security key instead of SMS for two-factor authentication wherever a platform allows it, since it removes phone-number-based verification as a single point of failure. If your carrier offers an account PIN or port-freeze feature to block unauthorized number transfers, enabling it adds another layer of protection against this specific attack.

Fake exchanges and cloned apps

Some scams involve building an entirely fake trading platform, complete with a professional-looking interface, fabricated account balances, and even fake customer support chat, designed purely to accept deposits that can never be withdrawn. These often surface through targeted advertising, unsolicited investment “opportunities” from new online contacts, or search results for misspelled versions of real exchange names. Before depositing meaningful funds anywhere new, verify the platform through independent, established sources rather than only the platform’s own marketing, and start with a small test transaction and a test withdrawal before committing more.

Recovery scams: a second scam layered on the first

A particularly cruel pattern targets people who already lost funds to a scam: a “recovery service” contacts the victim claiming it can retrieve the stolen crypto for an upfront fee. Legitimate law enforcement and consumer protection agencies do not charge victims a fee to investigate fraud, and any unsolicited recovery offer following a scam should be treated as a second scam attempt, not a legitimate lifeline.

Where to report crypto fraud

If you believe you’ve been targeted or victimized, report it to the FTC at reportfraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov. The FTC also publishes consumer-focused guidance specifically on crypto scams at consumer.ftc.gov, and the CFTC maintains its own fraud advisories at cftc.gov/LearnAndProtect. Reporting doesn’t guarantee fund recovery, but it helps investigators build cases and can support broader enforcement action, and it can help other people avoid the same scheme as patterns get identified across multiple reports.

Frequently asked questions

Can I get my crypto back after falling for a scam?

Recovery is uncommon because crypto transactions are generally irreversible and scammers typically move funds quickly through multiple wallets to obscure the trail. Report the incident promptly to the FTC and FBI anyway; it supports investigations even when individual recovery isn’t likely.

Is a “guaranteed return” offer always a scam?

Any offer guaranteeing specific investment returns, especially unusually high ones, should be treated with serious skepticism. Legitimate investments, crypto or otherwise, carry risk and cannot honestly guarantee returns.

How can I verify an exchange or platform is legitimate before using it?

Check whether it discloses its state licensing and federal MSB registration, look up independent reviews from established sources, and confirm you’re on the platform’s actual official website rather than a link from an unsolicited message or ad.

Should I trust a “recovery service” that contacts me after I’ve already been scammed?

Treat unsolicited recovery offers with serious skepticism. Legitimate law enforcement and consumer protection agencies do not charge victims a fee to investigate fraud, and this pattern often turns out to be a second scam targeting people who already lost funds once, sometimes by the same operation that ran the original scheme.