How to spot crypto scams and phishing before they cost you

The scale of the problem

The FBI's Internet Crime Complaint Center (IC3) collects reports from victims, most of them in the US. Its 2025 report, published in April 2026, shows how much of today's fraud runs through crypto.

These figures count only what victims reported. Phishing and spoofing were the most reported crimes of all, with 191,561 complaints. The FBI also notes that most crypto investment scams are run by organised groups in Southeast Asia, often using trafficked people forced to work in scam compounds.

The common schemes

The tricks change names quickly, but they fall into a few families.

Phishing sites and fake apps

A phishing site copies a real exchange or wallet to capture your password, sign-in code or seed phrase. Links arrive by email, text and social media, and criminals also buy search ads that appear above the real result; the FBI has warned that such ads impersonate crypto exchanges in particular. Fake apps work the same way, and scam investment apps display profits that don't exist.

Type the address of any site you use for money, or use a bookmark. Install apps only through links on the provider's own website.

Fake support staff

Scammers posing as support staff watch social media and chat forums for people asking for help, then contact them privately. They ask for your seed phrase, a sign-in code or remote access to your computer, or tell you to move funds to a "safe" wallet. Real support never does any of this. Tech- and customer-support scams involving crypto cost victims $1.23 billion in 2025, according to the FBI.

Address poisoning

Wallet addresses are long strings that few people check in full. A scammer creates an address whose first and last characters match one you use often, then sends a tiny or zero-value transfer from it so that it appears in your history, hoping you'll copy it next time. Carnegie Mellon researchers counted 270 million such attempts against 17 million victims on Ethereum and BNB Smart Chain between July 2022 and June 2024, with at least $83.8 million lost.

Copy addresses from your address book, not your transaction history, and compare every character.

"Pig butchering": investment and romance scams

It often starts with a wrong-number text, a dating match or a friendly contact on social media. Over weeks the stranger builds trust, then introduces an investment platform that shows your balance growing. When you try to withdraw, you're told to pay taxes or fees first, and then the scammer disappears. The FBI calls crypto investment fraud the biggest source of losses it saw in 2025.

The name comes from the scammers' own slang for fattening a victim before taking everything. INTERPOL has urged people to say "romance baiting" instead, because the old term shames victims and discourages them from coming forward.

Fake giveaways and impersonation

"Send 1 ETH, get 2 back" offers borrow the names and faces of celebrities or companies, sometimes in AI-generated video. Others pose as a government agency or your bank and claim your account is frozen. The US Federal Trade Commission's rule of thumb holds: only scammers promise free money or demand payment in crypto. The FBI logged 22,364 complaints involving AI in 2025, with $893 million in losses.

Malicious token approvals ("drainers")

On networks such as Ethereum, apps ask for permission to spend your tokens. A drainer site, often dressed up as an airdrop, a new NFT or a reward, asks for the same kind of permission, sometimes without limit, and then empties the wallet. The request can look routine.

Read what you're approving and connect only to sites you trust. Review old permissions with a token-approval checker, such as the one on a block explorer, and revoke those you don't need; revoking costs a small network fee.

Rug pulls

In a rug pull, the people behind a new token or NFT project collect buyers' money, then abandon the project and keep the funds, often by selling their own large holdings or pulling the money out of its trading pool. In a pump-and-dump, organisers hype a token they control and sell at the peak. Anonymous teams, heavy hype and pressure to buy now are all warning signs.

Red flags

Habits that protect you

The last habit matters more than it seems. When the FBI's Operation Level Up contacted 3,780 victims of crypto investment fraud in 2025, 78% didn't know they were being scammed.

If you hold your own keys, keep a separate wallet with small amounts for trying new apps, so that one bad approval can't reach your savings. Our guide to custodial and self-custody wallets covers account security in more depth.

If it happens: what to do

Act quickly, but don't panic. These five steps, in this order, limit the damage.

Stop. Don't send more money, whatever the scammer says about fees, taxes or penalties, and cut contact.

Secure. From a clean device, change the password of any account you exposed, reset two-step sign-in and sign out other sessions. If a seed phrase leaked or you signed a drainer's request, move your remaining coins to a new wallet with a new seed phrase and revoke old permissions.

Record. Save the transaction IDs (hashes), the addresses you sent to, amounts, dates and times, plus screenshots of chats, profiles and websites. The FBI calls transaction details some of the most important information a victim can give.

Report. Tell the exchange or wallet provider involved straight away; the sooner a platform knows, the better the chance of freezing funds. Then report to the police and your national body:

• In the US, file a complaint at ic3.gov, even if you lost nothing. People aged 60 or over can get help from the National Elder Fraud Hotline on 833-372-8311.
• In England, Wales and Northern Ireland, use Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101.
• Elsewhere, contact your local police and your country's fraud or cybercrime reporting service.

Beware. Victims are often contacted again by fake lawyers, investigators or even people posing as the FBI, promising to recover the money for a fee. The IC3 received 10,516 complaints about such recovery scams in 2025. It never charges to recover funds, and the FBI says no law firm is an officially authorised partner of US government agencies.

Being scammed is not a sign of foolishness. These are professional operations, and your report helps investigators and the next person they target.