15 Common Crypto Scams and How to Recognize Them

Crypto scams target access as well as assets. They may seek a recovery phrase, an account login, a transaction signature or a token approval. Recognizing which permission is being requested helps explain the risk.

These nefarious tactics range from counterfeit endorsements by well-known figures to sophisticated phishing and ‘too-good-to-be-true’ giveaways, exploiting the trust and inquisitiveness of individuals. These ploys often coax victims into parting with their funds or confidential details, such as the keys to their cryptocurrency wallets.

Here are fifteen common scam patterns and the checks that can help recognize them.

Phishing Scams 

Phishing scams in the crypto world involve tricking individuals into revealing sensitive information, like private keys or login credentials, by pretending to be trustworthy entities. For example, you may receive an email that looks like it’s from a reputable crypto exchange asking you to reset your password, leading you to a fake website where your credentials are stolen. Defence: Verify websites and senders independently. Never disclose your recovery phrase or private keys to anyone, including support staff, or enter them into a claim, verification, or support website. Only enter them into a verified wallet application when deliberately restoring or importing your wallet.

Ponzi & Pyramid Schemes

These schemes promise high returns on investment but rely on the influx of new investors to pay earlier investors, eventually collapsing. An example is a crypto project that offers substantial profits for recruiting new investors, but the returns are paid from the new investor contributions, not actual profit. Defence: Be skeptical of any investment opportunity that offers unusually high returns with little to no risk and conduct thorough research before investing.

Rug Pulls 

Rug pulls occur when the developers of a cryptocurrency project suddenly withdraw all their funds, leaving investors with worthless tokens. For instance, a new token might be heavily promoted and then abruptly removed from exchanges, with developers disappearing. Defence: Research the project’s developers, their track record, and the project’s liquidity lock commitments before investing.

Fake ICOs (Initial Coin Offerings) 

Scammers launch fake ICOs to lure investors into buying nonexistent or worthless tokens. An example is a scammer creating a sophisticated website for a non-existent crypto project, complete with a whitepaper and fake team profiles. Defence: Conduct thorough research, including reviewing the whitepaper, understanding the team’s background, and looking for credible, independent reviews.

Pump and Dump Schemes 

In these schemes, scammers inflate the price of a lesser-known cryptocurrency and then sell off their holdings, causing prices to plummet. An example is a group spreading false information to drive up a crypto token’s price before selling their stake at the peak. Defence: Avoid investment decisions based solely on social media hype and seek out independent, reliable information.

Giveaway Scams 

These scams promise to multiply the cryptocurrency you send but return nothing. An example is a fake social media account of a celebrity promising to double any crypto sent to a particular address. Defence: Remember that if an offer seems too good to be true, it probably is. Legitimate companies do not ask for funds in return for greater rewards.

Impersonation Scams 

Impersonation: Scammers pose as support staff, colleagues or familiar organizations. Contact the person or service through a channel you independently know to be genuine. A verified identity still has no reason to request your recovery phrase or private keys.

Romance Scams 

In these scams, someone creates a fake online identity to gain a victim’s affection and trust, then manipulates them into sending cryptocurrency. For example, an online romantic partner may ask for crypto to cover a supposed emergency. Defence: Never send money or share cryptocurrency with someone you have only met online.

Fake Wallets and Exchanges 

Fake apps and exchanges: A familiar name or search result can lead to an imitation service. Verify the publisher and download route through independently known official sources. Popularity alone is not proof that a particular link or app is genuine.

Malware Scams 

Malware designed to steal cryptocurrency infects your devices through dubious downloads. An example is downloading a crypto trading application from an unverified source that contains keylogging software. Defence: Protect your devices by using robust antivirus software, avoiding downloads from untrustworthy sources, and regularly updating your software.

Man-in-the-Middle Attacks 

Interception: Compromised networks, devices or services can expose data or alter what a user sees. Protect the device, verify the destination and use account security where applicable. Two-factor authentication protects supported accounts; it does not undo a harmful on-chain signature.

SIM Swapping 

This involves a scammer convincing a mobile carrier to transfer a victim’s phone number to a SIM they control, allowing them to intercept SMS verification codes. This can compromise exchange, email, or other accounts that use SMS for login or recovery. Taking over a phone number alone does not reveal a recovery phrase or private key in a conventional seed-based self-custody wallet. Defence: Use an authenticator app or security key instead of SMS where supported, and protect your mobile-carrier account with a separate PIN.

Employment Scams 

Scammers offer fake job opportunities, often asking for payment in crypto for training or equipment. An example is a scammer posing as a recruiter for a well-known crypto company, asking for payment in crypto to secure a job position. Defence: Verify the legitimacy of the job offer and the employer, especially if the recruitment process seems unusually fast or easy.

Non-Existent Mining Equipment 

Scammers sell mining equipment that either doesn’t exist or is grossly overpriced. For instance, you might pay for a high-performance mining rig only to receive an inferior or non-existent product. Defence: Research the seller’s reputation, compare prices, and consider seeking opinions from trusted community forums.

Social Engineering Scams 

These involve manipulating individuals into revealing confidential information or making security mistakes. For example, someone posing as support may ask for your recovery phrase or persuade you to approve a malicious transaction. A token approval or permit signature can authorize spending without revealing your private key. Defence: Contact support through official channels you locate yourself, never share recovery secrets, and inspect the recipient, asset, amount, and permissions before signing. Decline any request you do not understand.

A Cautionary Tale

Even when a business seems incredibly reputable and well funded, it can all go tragically wrong, very fast. Take FTX for example, they had A-list celebrities including Larry David and Tom Brady who were being paid to promote the exchange — effectively endorsing it by lending their credibility. There was even a Superbowl ad. Yet, in the background, Sam Bankman-Fried was siphoning off billions of dollars in funds to his other entities and using customers money for supposed ‘altruism’. Many thousands of exchange users could have mitigated their exposure by not keeping all their crypto eggs in one basket.

Key Takeaways:

• ABS: ALWAYS BE SKEPTICAL

• Exercise extreme caution with investment opportunities promising exceptional returns.

• Thoroughly research and verify the legitimacy of cryptocurrency exchanges and investment platforms.

• Approach romantic connections that quickly pivot to financial aid or investment opportunities with skepticism.

• Never share your recovery phrase or private keys with another person, even someone who appears to be verified support. Separately, verify every website and request before entering account credentials or signing anything.

• Recognize the hallmarks of a Ponzi scheme: reliance on bringing in new investors to reward existing ones, and promises of high returns with little risk.

• Utilize strong passwords, enable two-factor authentication, and critically assess every communication for authenticity.

• Separate what you want to be true, from what actually is true. Wishful thinking does not pay the bills!

Again: if it’s too good to be true, it usually is. We’ll continue to update you as new scams arise, in the meantime, stay vigilant and be wise.

Sources: Wallet security guidance; FTC on SIM swaps