Cryptocurrency Scams

A phone call from someone claiming to be customer support, an investment opportunity promoted by a familiar face, or a reward that unexpectedly appears in your wallet. Each situation may look different, but they can all lead to the same outcome: we disclose sensitive information, send funds, or approve a transaction without understanding what it actually does.

We cannot necessarily recognise a scam by the name of a cryptocurrency or the appearance of an app. What matters more is what the other party is asking us to do and what access or control we would be giving them. The following scenarios highlight the points at which we can stop a scam before any damage is done.

Focus on What the Scam Asks You to Do

An attacker may begin by making us fear for the security of our account, promising exceptional returns, or gradually earning our trust. Time pressure then leaves less room for verification. Sometimes the attacker asks for another deposit after weeks of communication; at other times, they want us to take the decisive step within minutes. A professional manner and a willingness to answer questions are not, in themselves, evidence that an offer is legitimate.

When assessing a situation, we therefore return to the specific action being requested. Are we being asked to share login credentials, allow remote access to a device, transfer money, or sign something in a wallet? The phrase ‘it is just a verification step’ does not explain what the confirmation will actually do. The gap between what is promised and what the requested action enables is often the most important warning sign.

Fake Support Offers to ‘Protect’ Your Account

Someone calls, knows our name, and introduces themselves as a representative of a cryptocurrency service. They claim our account has been compromised. We are told to install remote-access software and move our cryptocurrency to a new address they will provide. Supposedly, this will protect the funds from theft.

In this scenario, what is presented as a security measure becomes a transfer of funds carried out at a stranger’s direction. Knowing our name or displaying a familiar phone number does not verify the caller’s identity. Coinbase, for example, warns that scammers can spoof genuine phone numbers and that its support team does not ask for passwords, verification codes, or transfers to external addresses.

We end the call and access the service independently through an app we already know or a verified website. We check for any problem there and contact support through an independently verified channel. We do not use the phone number or link supplied by the caller. We never disclose a recovery phrase or private key, even to someone who promises merely to ‘check’ our wallet.

An ‘Investment Adviser’ Shows Profits on Screen

After responding to an advertisement, we are contacted by someone claiming to be an investment adviser. They offer automated cryptocurrency trading and help us create an account. In this example, we deposit CZK 20,000 and, a few days later, see a balance of CZK 31,000. The app looks convincing, and the adviser readily explains what to do next.

But a number displayed in an app is not proof that the assets actually exist. The Police of the Czech Republic describe scams in which a platform shows fictitious profits while the perpetrator gradually persuades the victim to make further deposits. Allowing a small withdrawal can also help build trust. Such a payout does not, by itself, establish that the remaining funds exist or are available to withdraw.

When we attempt a larger withdrawal, we may be asked to pay an additional amount for a supposed tax, insurance charge, or account-unblocking fee. In this example, we are told to send another CZK 8,000 to access the returns already displayed. Escalating demands may simply increase our losses. Calling a payment a ‘tax’ does not make it legitimate.

Before making the first deposit, we verify the actual operator and its authorisation to provide the regulated service in official registers. We also check that the company’s identity matches the website and contact details through which we are communicating. A scammer may misuse the name of a genuine business; the Czech National Bank (CNB) therefore recommends checking both the provider’s licence and its actual identity. A photograph of an authorisation document or a link to a register supplied by the other party is not a substitute for an independent check.

If we are already caught in such a scenario, we do not send more money merely to ‘save’ our original deposit. We verify the demand independently of the supposed adviser. Pressure to take out a loan or conceal the investment from family and friends is another reason to stop and reconsider.

A Familiar Website Asks Us to Log In Again

We search for a wallet or service we regularly use. We open a result displaying a familiar logo, and the website asks us to log in. It then requests our recovery phrase, supposedly to update or verify the wallet.

This is a typical form of phishing: a fraudulent website impersonates a trusted service to obtain sensitive information. The attack does not have to begin with a suspicious email. Coinbase also warns about fraudulent search advertisements, social media messages, and fake decentralised applications. A high position in search results therefore does not establish that a website is authentic.

Before entering any information, we check the actual domain name and the origin of the app. We do not rely on a link from an unsolicited message or advertisement as our only means of verification. We never enter a recovery phrase into a form opened in response to an unexpected request. If we genuinely need to restore our own wallet, we follow the wallet provider’s verified instructions.

A similar request may even come from an account belonging to someone we know. We verify unusual messages through another communication channel. Fluent language, a familiar voice, or a convincing video is not sufficient proof of identity; artificial intelligence can also be used to imitate them.

A Wallet Requests Confirmation of a Supposed Verification

A website promises a reward for connecting our wallet. Once connected, it claims that we need only sign a simple verification request. However, the wallet actually displays a request for permission to access tokens we already own.

For certain tokens and blockchain applications, a so-called token approval authorises a designated address or smart contract to transfer the specified tokens up to an agreed limit. This is a normal technical mechanism, but it can also be abused. An unlimited allowance is not, in itself, evidence of fraud, yet it can greatly increase the consequences of granting approval to the wrong party.

Suppose we hold 1,000 USDC tokens on Ethereum and a website offers a reward of 25 USDC. Instead of simply delivering the expected reward, it asks for permission to access all our USDC. That mismatch is the key warning sign. We do not approve the request; instead, we check why such permission would be needed for the promised action at all.

Connecting a website, signing a message, and granting token approval are not interchangeable actions.

The absence of a network fee does not mean that a signature cannot put funds at risk. Some mechanisms allow token permissions to be granted through a signed message that can subsequently be used on the blockchain. Such a signature must not automatically be treated as a harmless login request.

If we do not understand the consequences, we reject the request. Closing the page or disconnecting the wallet does not revoke an approval already granted. MetaMask explicitly distinguishes between disconnecting an application and revoking a token approval.

An Unknown Reward Appears in Our Wallet

We find a token in our asset list that we never purchased. Its name or an accompanying message points to a website where we can supposedly claim a reward. The site then asks us to connect a wallet, sign a message, or make an upfront payment.

Receiving an unfamiliar token does not, by itself, mean that someone controls our private keys. However, the token may be bait designed to prompt further action. Coinbase warns about fraudulent airdrops as well as tokens whose transfers or sales are restricted by hidden smart-contract rules. A displayed token name or value is therefore no guarantee that the asset can actually be sold for money.

We do not visit a website embedded in the name of an unsolicited token or sign anything because of it. If we cannot establish the token’s origin, we can leave it untouched or hide it in the app. A request to make a transfer first for ‘address verification’ or to unlock a reward is a reason to stop. Legitimate network fees do exist, but mentioning them does not make an offer authentic.

A ‘Recovery Expert’ Promises to Return Lost Funds

After a previous loss, someone claiming to be a specialist or legal representative contacts us. They say they have traced the funds, know the details of the case, and can recover the money. First, however, they demand an advance payment, a fee to release the funds, or access to our wallet.

This may be a follow-up fraud, commonly known as a recovery scam. The FBI warns about companies that promise to retrieve stolen cryptocurrency, collect an upfront fee, and then stop responding or demand further payments. The scammers may even impersonate people associated with legal or law-enforcement authorities.

Tracing the movement of funds is not the same as having control over them or being able to compel their return. A report listing addresses and transactions therefore does not prove that its author controls the money. We do not test an unsolicited promise of guaranteed recovery by sending another payment. We provide relevant records to the affected service and the police, and retain details of the new contact as part of the case.

Verify Both the Source and the Consequences Before Confirming

The scenarios described above share one simple rule: verify a message or offer through a route independent of the person requesting the action. A different contact supplied by that same person may not constitute independent verification.

Before making a payment, installing software, or signing anything, we should ask ourselves a few questions:

Did we initiate this action ourselves, or are we responding to an unsolicited request?

What exactly would we disclose to the other party or allow them to do?

Does the effect of the requested action match what we are trying to achieve?

Have we verified the identity and terms independently of the links and contact details provided?

Can we postpone the decision and take time to check the information?

A single warning sign does not necessarily prove fraud. But we do not need to establish criminal intent before declining an unclear request. It is enough that we cannot verify its origin or reasonably explain why access to our funds is needed.

If We Have Already Responded

We stop sending money and following the suspicious person’s instructions. If the incident involves a bank transfer, payment card, or access to online banking, we contact our bank immediately. We also contact the relevant cryptocurrency service provider through its official channels. Acting quickly may limit further damage, although the outcome cannot be guaranteed.

What we do next depends on the action already taken. If a password or verification code has been disclosed, we secure the account using a trusted device and review connected devices and the recovery email address. If a computer has been compromised, we do not use that same potentially unsafe device or access route to change account details.

If we have granted token approval, we need to review and, where appropriate, revoke that specific permission on the relevant network. For signed messages, the remedy depends on the type of signature: a standard approval revocation may not address every signed request. We consult the verified documentation for the wallet we use rather than following a newly supplied ‘recovery’ link.

If a recovery phrase or private key has been exposed, changing the app password is not enough. Any remaining funds may need to be secured using new, independently generated keys in a trusted environment, and we should stop using the compromised wallet. If incoming funds disappear immediately, we do not blindly send more cryptocurrency to cover transaction fees: an automated program controlled by the attacker may be draining the wallet.

We preserve messages, website addresses, and payment details, including cryptocurrency transaction identifiers. We report suspected criminal activity to the Police of the Czech Republic. We do not wait for a promised refund or a response from the supposed adviser. Feelings of embarrassment should not delay steps that may help prevent further losses.

Conclusion

Cryptocurrency scams often succeed when someone accepts an attacker’s explanation without examining the consequences of their own actions. Supposed account protection may mean transferring money to a stranger; a promise of returns may lead to a fake platform; and an apparently routine wallet verification may grant dangerous permissions.

The most effective defence is to stop before taking the decisive action and verify it independently. A familiar logo, a convincing voice, or a rising balance on screen is not enough. We need to know who is really making the request and what we are enabling by confirming it.

If we have already shared information or sent funds, our next steps should reflect the nature of the exposure. Promptly securing an account, contacting the bank or service provider, and preserving evidence are more valuable than paying yet another fee for a promised recovery.