Read this before your first purchase and keep it in mind whenever something unexpected happens to your account. It pairs with protecting your recovery phrase — the two together cover most of what can go wrong.
The hard rules (read these first)
1. No legitimate company, exchange, or support agent will ever ask for your private key or recovery phrase. If anything asks for it, that's the scam — full stop.
2. No one can guarantee returns, "double" your money, or "recover" stolen coins for a fee. Anyone who claims to is a scammer.
3. Legitimate companies will not message you first out of the blue to "verify" or "secure" your account. You contact them, through the official site you type in yourself.
4. Urgency is the tell. "Act now or lose everything" is how scams skip your judgment. Slow down; the pressure is the manipulation.
The patterns, and how to spot each
1. Fake support and "account security" messages
A text, email, DM, or call claiming your account is "suspended," "compromised," or needs "verification" — often with a link or a phone number. The goal is to get you to enter your credentials or recovery phrase on a fake site, or to talk them through a code. The spot: real companies don't initiate with a link, and they never need your recovery phrase. Verify by typing the official address yourself or using a support path you already trust.
2. Impersonation of people and brands
Fake profiles of celebrities, executives, or companies — a "giveaway" from a fake account of a well-known figure, a "support" account with a near-identical name, a cloned website. The spot: check the verified handle and the exact domain. Giveaways from people you've never interacted with, and domains that are almost-but-not-quite right, are the classic tells.
3. "Recovery" and "hacker" services
After you've been scammed or lost funds, a "recovery agent" or "hacker" appears — often in a support forum or via DM — promising to get your money back for a fee. This is a second scam targeting people who are already desperate. The spot: no one can reach into a blockchain and reverse a transaction. Anyone offering to "recover" your coins for a payment is running the same scam on you again.
4. Guaranteed returns and "investment" schemes
An offer promising fixed or guaranteed returns — "double your crypto in a week," a private group with a track record of easy gains, a friend who "never loses." The spot: guaranteed returns on a volatile asset don't exist. The early small payouts are bait to get you to commit more before the collapse. If the pitch is about the return and not the underlying asset, walk away.
5. Approval and signature phishing (for the more technical)
On some platforms, a malicious website asks you to "sign" a transaction or grant "approval" that looks harmless but actually authorizes it to drain your wallet. The spot: only sign things you initiated on a site you trust, and read what a signature actually authorizes before confirming. If a game, airdrop, or "verification" asks you to sign something, assume it's an attack until you've verified the source.
6. Fake exchanges and platforms
A look-alike exchange site, often promoted through a search ad or a message, that lets you "deposit" and then vanishes or makes withdrawal impossible. The spot: bookmark the real site and type the address yourself; never follow a link in an unsolicited message. If a "platform" pressures you to deposit quickly and makes withdrawal hard, that's the pattern.
If you think you've been scammed
- Stop and don't send more. The urge to "fix it" by paying the recovery agent or sending one more amount is how losses double. Stop.
- Secure what you can. If a device or account may be compromised, move what you still control to a fresh, safe wallet, and change passwords. Never share your recovery phrase in doing this.
- Report it. In the United States, report to the FTC (and your local consumer-protection agency elsewhere). Reporting won't recover a blockchain transaction, but it helps pattern-tracking and may stop the scam from hitting others.
- Don't trust the "recovery" offers that now flood in. After a loss, expect a wave of them. None of them are real.
Frequently asked questions
Can I get my money back if I've been scammed?
Usually not, and quickly. Because blockchain transactions are irreversible and there's no central party, there's rarely a way to reverse a completed transfer. This is why prevention — the four rules above — is the only reliable protection. Report it to the FTC and your local authorities, but don't count on recovery, and never pay a "recovery service."
How do I verify a website is the real one?
Type the address yourself from memory or a bookmark you created earlier — never click a link in a message or an unexpected ad. Check the exact domain (scammers use near-identical ones), and when in doubt, find the site through a source you independently trust. For a device, buy only from the manufacturer's official store.
Is two-factor authentication enough?
It helps a lot against account takeover, but it's not a wall against every scam — and some 2FA methods (SMS) can be intercepted. Use an authenticator app where offered. More importantly, 2FA does nothing to protect a self-custody wallet if you hand over your recovery phrase, so the phrase rules matter just as much.
A friend recommended an investment group. Is that safe?
A recommendation doesn't make it safe — and it's one of the most effective scam vectors, because trust is borrowed. Evaluate the underlying offer on its own: are returns guaranteed or "guaranteed-ish"? Is there pressure? Could you lose the whole amount? If yes to those, the fact that a friend likes it is not a reason to invest.
Where to go next
The other half of staying safe is protecting your recovery phrase. And the broader risk picture — volatility, custody, and how these fit together — is in crypto risks. Before you buy, make a first purchase with these rules in view.