Crypto scams: the main types and how to check a platform

Why crypto attracts scammers

Crypto transfers cannot be called back once they are confirmed, which is exactly what fraudsters want. The EU’s financial supervisors warn that scammers use phishing emails, social engineering and malicious links, “promising unrealistically high returns or claiming to be authorised or regulated when they are not.” Below are the main types that regulators and police describe, in their own words, followed by the checks that stop most of them.

1. Fake trading platforms

The site or app looks like a real exchange, showing trades and a growing balance. Australia’s securities regulator ASIC describes it: “These fake platforms show profits and trades, but in fact, there is no real trading, and the site contains fake data. Any money deposited into these platforms goes straight to the scammers.” When you try to withdraw, “The fake platforms ask for fees to release assets or proceeds. These fees go straight to the scammers and no assets are released.” ASIC says victims are invited into messaging-app groups where scammers impersonate well-known figures.

The US FBI tells investors to watch for web addresses that imitate real financial institutions and for suspicious investing apps: “Misspelled URLs, often with a slight deviation from the actual financial institutions’ website, may be fake.”

2. Romance and “friend” investment scams

The FBI calls this scheme “Pig Butchering”. Fraudsters make contact “on various social media or dating applications (either spoofing long lost contacts known to the victim or posing as a potential friend or romantic partner) and often spend time gaining the victim’s confidence and trust.” They then coach the victim into a fake platform. “When the victims attempt to cash out their investments, they are told they need to pay income taxes or additional fees, causing them to lose additional funds.”

3. Pump and dumps and fraudulent tokens

In a pump and dump, promoters push a token’s price up and sell to the people they attracted. ASIC has warned about “coordinated pump and dump schemes targeting retail investors” run through messaging apps such as WhatsApp, and adds: “These schemes are illegal.” The National Bank of Slovakia notes that creating a token can take less than 10 minutes and that the issuer is often its largest holder; the endings it lists include “Rug pull – the issuer disappears with investors’ funds”, or a dump in which insiders sell and the project is abandoned. Singapore Police describe fake “official” fan tokens whose value “is artificially inflated before scammers sell off their holdings, causing prices to collapse.”

4. Fake giveaways

A hacked or fake account of a celebrity or company promises to send back double whatever you send. The National Bank of Slovakia quotes the typical line — “Send 1 ETH and get 2 ETH back.” — and says that any offer that promises to instantly double your deposit is almost certainly a scam. Fake comments under the post claim it worked. Singapore Police report that “AI-generated deepfake content featuring athletes or celebrities has been used to promote such fraudulent platforms”.

5. Impersonation of exchanges and authorities

Messages that seem to come from your exchange report a suspicious login and send you to a fake support line. In cases reported to Singapore Police, victims were told to set up a new wallet, “transfer their virtual assets to this newly created wallet for security purposes and to disclose their login details”. The police reminder: licensed platforms in Singapore “will never instruct users to transfer their virtual assets to another crypto wallet/account for security or investigation purposes, nor request for their login credentials, two-factor authentication codes, or seed/recovery phrases.” Tax authorities are copied too: the US IRS warns about letters with a QR code asking people to register their crypto on a “compliance portal”, and states: “We don’t require registration of digital assets and are not sending these letters.”

6. Recovery scams

After a loss, a “lawyer”, “ethical hacker” or “agency” offers to get the money back for a fee. The FBI describes “fraudsters posing as lawyers representing fictitious law firms” who claim they can investigate recovery cases, and reminds victims: “Law enforcement does not charge victims a fee for investigating crimes.” The National Bank of Slovakia lists the disguises: “Scammers often pose as lawyers, ethical hackers, police officers, or tax authorities.” Its advice: “Do not trust unknown entities that demand advance payments.”

Warning signs that run through all of them

• Guaranteed, fixed or very high returns, and pressure to act fast.
• Contact you did not ask for, then a move to a private chat.
• A request to pay in crypto to a personal wallet, or to move your crypto to another wallet for its supposed safety.
• A fee, tax or “verification” payment before you can withdraw.
• Anyone asking for your password, two-factor codes or seed phrase.

How to check a platform before you send money

1. Find the company behind it — its legal name and country — and look it up in the regulator’s own register, not on the platform’s website. Our guide on checking a broker’s licence shows the method; beware of a clone firm copying a real one’s name.
2. Use the right register. Examples from the regulators themselves: in the EU, the ESMA register of authorised crypto-asset service providers; in Canada, the Canadian Securities Administrators’ list of crypto trading platforms authorised to deal with Canadians; in Australia, the Virtual Asset Service Provider Register kept by AUSTRAC — ASIC says businesses providing virtual asset services, “such as exchanging money for virtual assets (such as crypto), must be registered with AUSTRAC”.
3. Check what the registration covers. Canada’s Financial Consumer Agency warns: “Some CTPs claim to be registered businesses, but this isn’t the same as being registered with a securities regulator.” The EU supervisors add that a firm may be authorised for only some of its services.
4. Search warning lists. National regulators publish lists of unauthorised firms, and the EU supervisors also point to I-SCAN, the warning list of IOSCO, the international organisation of securities regulators. ASIC keeps an investor alert list. A clean result does not prove a platform is safe, because a scam site can be too new to be listed, but a hit is a clear stop.
5. Test the exit. Expect identity checks from a regulated platform, and make a small withdrawal to an account in your own name before you deposit more.

If you have been scammed

Stop sending money, keep every message, address and transaction record, and report to the police and to the platform you paid through; Singapore Police advise victims to “Contact your cryptocurrency exchange to halt further transactions or freeze your account, if possible.” Then expect recovery offers — and refuse them.

Crypto is risky even on legitimate platforms, and what is allowed differs by country; our “is crypto legal” pages quote what each country’s regulators say.