How to Spot a Crypto Scam: The Complete Guide (2026)

Crypto scams are everywhere. On Twitter, Telegram, Discord, Google ads, email, even dating apps. Scammers are professional, persistent, and constantly inventing new tactics.

This guide covers every major type of crypto scam, how to spot each one, and exactly what to do if you’re targeted.

The Universal Red Flags

These warning signs apply to every type of scam. If you see any of these, stop and walk away:

Scam Type 1: Fake Exchanges

A fake exchange is a website that looks exactly like a real exchange (Coinbase, Binance, Kraken) but steals your deposits.

How it works:

1. You search “best crypto exchange” on Google
2. A paid ad at the top takes you to a lookalike site
3. You deposit money, see fake balances and fake trading profits
4. When you try to withdraw, you’re hit with “fees” or “verification requirements”
5. Every fee you pay leads to another fee. Your money never comes back.

How to spot it:

• Domain name is slightly wrong (co1nbase.com, binance-secure.com)
• Domain registered less than 1 year ago (check with Whois lookup)
• No regulatory license (or fake license numbers)
• Unrealistic promotions (“0% fees forever,” “deposit $100 get $500”)
• Not listed on CoinMarketCap or CoinGecko

How to protect yourself:

• Bookmark exchange URLs — never search or click ads
• Only use exchanges from CoinMarketCap’s top 20
• Test withdrawals with $20 before depositing more

➡️ Deep dives: How to Spot a Fake Exchange | Best Crypto Exchange for Beginners | What Happens If an Exchange Collapses?

Scam Type 2: Phishing

Phishing is tricking you into entering your password, seed phrase, or private key on a fake website.

Common phishing tactics:

• Emails claiming “suspicious activity on your account” with a link to log in
• Fake websites that look identical to real ones
• Google ads for “MetaMask login” or “Coinbase support”
• DMs from fake support accounts on Twitter/Reddit

The #1 phishing attack: A fake website asks you to enter your seed phrase to “verify your wallet” or “claim an airdrop.” You enter it. Your wallet is drained.

How to protect yourself:

• Never enter your seed phrase into any website, app, or email — ever
• Navigate to crypto sites by typing the URL or using bookmarks
• Use a password manager — it auto-fills only on the correct domain
• Verify URLs carefully before entering credentials

➡️ Deep dives: Common Phishing Attacks | What Is Two-Factor Authentication?

Scam Type 3: Pump and Dump Schemes

Coordinated groups that buy a low-cap coin, hype it, then sell at the peak — leaving late buyers with losses.

How it works:

1. Organizers buy a coin with low liquidity (easy to manipulate)
2. They announce the “pump” in Telegram/Discord groups
3. Hundreds of members buy simultaneously, price shoots up
4. The hype spreads to Twitter, YouTube, TikTok
5. Organizers sell at the peak (they bought first, at the lowest price)
6. Price crashes. Late buyers lose 50-90%.

How to spot it:

• Telegram or Discord group promising “guaranteed pumps”
• “Signal groups” with paid subscriptions
• Low liquidity coin suddenly pumping 200%+ in hours
• Social media flooded with coordinated hype

How to protect yourself:

• Never buy coins promoted in Telegram groups
• Check liquidity and holder distribution (DexScreener, RugCheck)
• If it pumped 200% in a day, you’re late — don’t buy
• Only buy coins on major exchanges with real volume

➡️ Deep dive: How to Avoid Pump and Dump Schemes

Scam Type 4: Fake Airdrops

Scammers create fake “claim” websites for popular airdrops. When you connect your wallet, they drain your funds.

How it works:

1. A new token airdrop is announced (or a fake version of a real one)
2. Scammers create a lookalike claim website
3. You connect your wallet to “check eligibility”
4. The site asks you to sign a transaction
5. The transaction gives them permission to spend your tokens
6. Your wallet is drained

How to spot it:

• The URL is slightly different from the real project
• You need to “pay gas fees” to claim (real airdrops don’t require this)
• It asks you to sign an “approve” transaction
• The domain was registered days ago

How to protect yourself:

• Only claim airdrops from official project websites (linked from their Twitter/GitHub)
• Never connect your main wallet to unknown sites — use a burner wallet
• Read what you’re signing in MetaMask before confirming
• Use Revoke.cash to revoke permissions if you connected somewhere sketchy

➡️ Deep dives: Fake Crypto Airdrops | What Is a Real Crypto Airdrop?

Scam Type 5: Romance and Social Engineering Scams

Scammers build emotional trust over weeks or months, then ask for crypto.

How it works:

1. Someone messages you on a dating app, Instagram, or WhatsApp
2. They build a relationship — daily messages, photos, calls
3. Eventually they mention crypto — “I’ve been investing and making great returns”
4. They offer to “help you invest” or ask you to send crypto for an emergency
5. Once you send money, they disappear

Signs it’s a scam:

• They’ve never met you in person but declare strong feelings quickly
• They always have an excuse not to video call
• They steer conversations toward crypto
• They introduce you to a “trusted platform” or “investment manager”
• They ask for crypto for “travel expenses” to visit you

Protection: Never send crypto to someone you haven’t met in person. No exceptions.

Scam Type 6: Rug Pulls

Developers create a legitimate-looking project, raise money, then disappear with the funds.

Common types:

• Liquidity pull — Developers remove liquidity from a DEX, making the token untradeable
• Sell restriction — The smart contract prevents anyone except the team from selling
• Honeypot — You can buy the token but not sell it

How to spot a rug pull:

• Team is anonymous or uses fake identities
• High concentration of supply held by a few wallets
• Smart contract not audited
• Unrealistic tokenomics (90% to team, 10% to public)
• No working product, just a website and whitepaper

Protection: Stick with established tokens on major exchanges. Use RugCheck or similar tools before buying unknown tokens.

Scam Type 7: Investment Manager / “Yield” Scams

Someone offers to trade or invest your crypto for you, promising high returns.

How it works:

• “I’ll trade your crypto and give you 10% monthly returns”
• You send them crypto
• They show fake “profits” on a dashboard
• When you try to withdraw, there are “taxes” or “fees”
• Eventually they disappear

Protection: No legitimate trader needs your money. If they could consistently generate 10% monthly returns, they’d be a billionaire trading their own capital.

Scam Type 8: SIM Swap Attacks

An attacker convinces your phone carrier to transfer your number to their SIM. They then receive your SMS 2FA codes and reset your exchange passwords.

Protection:

• Don’t use SMS 2FA for crypto accounts (use authenticator app)
• Add a PIN/Password with your phone carrier for SIM changes
• Use Google Voice or a VoIP number as an alternative

The Ultimate Scam Protection Checklist

What to Do If You’ve Been Scammed

1. Stop sending money — No fee will recover your funds
2. Move remaining crypto to a new wallet (new seed phrase)
3. Report the scam:
   • Local police (file a report)
   • FBI IC3 (US) — ic3.gov
   • Action Fraud (UK)
   • The exchange where you sent funds (if applicable)
4. Warn others — Post on BitcoinTalk, Reddit, Twitter
5. Accept the loss — Most crypto scams are not recoverable. Treat it as an expensive lesson.

Verdict

Crypto scams exist because they work. They exploit trust, urgency, and greed. The defense is simple:

Slow down. Verify everything. Trust no one online.

No legitimate opportunity arrives through a cold DM. No exchange needs your seed phrase. No investment has “guaranteed returns.” No stranger needs your crypto.

Follow the checklist in this guide and you’ll avoid 99% of crypto scams. The 1% you’ll catch because you’re paying attention.

Scam reports are the most-read posts on BitcoinTalk. The community’s universal advice: if you have to ask whether it’s a scam, it’s a scam.