How to Spot Crypto Scams: Clone Sites, Fake Support and Drainers

You can spot most crypto scams by three signals that appear in almost all of them: pressure to act fast, a request you cannot undo, such as sending crypto, sharing a seed phrase or signing a wallet approval, and returns that sound too good to be true. Treat any message that combines two of these as fraud until proven otherwise.

Learning how to spot crypto scams is mostly about recognizing a handful of patterns that repeat endlessly with new names and new logos. The details change every month. The ending does not: you are persuaded to send crypto, reveal your seed phrase, or sign a transaction you do not understand. Because blockchain transfers cannot be reversed, there is rarely a second chance.

This guide, part of independent crypto coverage from Be1Crypto.com, covers the six patterns that cause the most damage, the checks that defeat them, and what to do if you have already been caught. None of it needs technical skill. It needs a few habits, applied every time.

How to spot crypto scams: the three universal red flags

Before the specific patterns, learn the three signals that show up in nearly all of them.

1. Urgency. “Act within 30 minutes.” “Your account will be suspended.” “This window closes tonight.” Pressure exists to stop you from checking.
2. An irreversible request. Send funds, enter your seed phrase, connect your wallet, sign this approval. Legitimate services rarely need any of these from you in an unsolicited conversation.
3. Too-good returns or free money. Guaranteed daily profits, doubled deposits, surprise airdrops of valuable tokens.

If a message has any two of these, stop. If it has all three, it is a scam.

1. Clone and lookalike websites

A clone site copies the look of a real exchange, wallet or app, down to the logo, fonts and charts. It sits at a domain that is close enough to fool a quick glance.

Common tricks in the address:

That last row deserves attention. In an address like brandname.example-login.com, the site actually belongs to example-login.com. The real owner of any address is the name immediately to the left of the ending, before the first single slash. Everything further left is just a label the owner chose.

Clone sites usually arrive through search ads placed above the real result, links in direct messages, or emails that look like security alerts. A padlock icon only means the connection is encrypted. Scammers get padlocks too.

2. Fake customer support

You post a complaint publicly: a stuck withdrawal, a missing token. Within minutes, an “official support” account replies or messages you, often with the right logo and a convincing name.

They are helpful, patient and sympathetic. Eventually they need you to do one thing: enter your seed phrase on a “verification” page, share your screen while you open your wallet, install remote-access software, or send a small amount to “unlock” the account.

The rules that defeat this are simple:

• Real support never asks for your seed phrase or private key. Never, for any reason.
• Real support does not cold-message you first on social media or chat apps.
• Contact support only through the help section of the official site or app, reached from your own bookmark.

3. Pig-butchering and romance-investment scams

This is the slowest and often the most costly pattern. The name refers to “fattening up” the victim before taking everything.

It usually unfolds like this:

1. A stranger makes contact, often through a wrong-number text, a dating app or a social network.
2. Weeks of friendly, personal conversation follow. No money is mentioned.
3. They mention, almost in passing, that they make good money trading crypto, and offer to show you.
4. They direct you to a trading platform or app. It looks professional. It is controlled by the scammers.
5. You deposit a small amount. The balance grows quickly. You may even be allowed one small withdrawal to build trust.
6. You deposit more. When you try to withdraw the larger balance, you are told to pay a “tax”, “unlock fee” or “verification deposit” first.

The numbers on that platform were never real. Here is how the trap compounds. Suppose you deposit $2,000, then $8,000 after seeing gains. The site shows $25,000. To withdraw, you are asked for a 20% “tax”: $25,000 × 0.20 = $5,000. If you pay, your total loss rises from $10,000 to $15,000, and another fee usually follows. Every payment goes to the same people.

Two checks stop this: never take investment advice from someone you have only met online, and never use a platform you were directed to by that person. Our guide on how to verify a platform yourself sets out the independent checks to run before depositing anywhere. Fake platforms also like to claim they are insured like a brokerage; our analysis of a platform for stocks and crypto explains why crypto balances carry no SIPC-style protection.

4. Fake giveaways and “doubling” offers

A video, post or livestream appears to show a well-known company or public figure announcing a giveaway: send any amount of crypto to this address and receive double back. Sometimes there is a fake live feed of other people “receiving” their payouts.

Nobody gives away money this way. The arithmetic alone gives it away: anyone able to double every deposit would have no reason to ask for yours. Any offer that requires you to send funds first in order to receive more is a scam, without exception.

Variants include fake airdrops that require a “gas fee” payment, and unexpected tokens appearing in your wallet with a website name attached. Do not visit those websites. Ignore the tokens.

5. Approval drainers and malicious signatures

This pattern targets people who use self-custody wallets with on-chain apps, and it works even with a hardware wallet.

Many apps ask you to approve them to spend a token from your wallet. That is normal; a decentralized exchange needs permission to swap your tokens. A drainer abuses the same mechanism. A fake mint page, airdrop claim or “wallet upgrade” asks you to sign a request that gives an attacker permission to move your tokens, sometimes with no limit. Once signed, the attacker can empty those tokens immediately or wait.

Defenses:

• Read the request. If your wallet shows “approve” or “set approval for all” on a site where you only expected to view something, reject it.
• Be suspicious of unlimited approvals. Where possible, approve only the amount you intend to use.
• Revoke old approvals. Reputable tools let you review and cancel permissions you no longer need.
• Use a separate wallet with a small balance for new or unfamiliar apps, keeping your main holdings elsewhere.

Our guide to crypto wallets explained covers how to split funds between a hot wallet and cold storage so that one bad signature cannot reach everything.

6. Recovery scams

People who have already lost money are targeted again. A “recovery agent,” “blockchain investigator” or “lawyer” gets in touch, sometimes claiming to be from a government agency, and promises to trace and return the stolen crypto for an upfront fee.

Legitimate law enforcement does not charge you to investigate a crime. Anyone who contacts you first, promising recovery for a fee, should be treated as the next stage of the scam.

How to verify a URL and bookmark official sites

The single habit that prevents more losses than any other: never reach a financial site through a link or an ad. Use a bookmark you created yourself.

Do it once, properly:

1. Find the official address from a source you trust and can cross-check, such as the address printed in the official app store listing of a well-known service, or an address you have used safely for a long time.
2. Type it in manually rather than clicking a search result. Search ads can sit above the real result and point to clones.
3. Read the domain letter by letter. Identify the name immediately left of the ending, before the first single slash.
4. Save it as a bookmark and give it a clear name.
5. From then on, use only that bookmark. If an email or message says you need to log in, close it and open your bookmark instead.

Combine that with a password manager. Password managers fill credentials only on the exact domain they were saved for. If yours refuses to autofill on a page that looks right, treat that as a warning that the domain is not what you think.

What to do if you have been scammed

Act quickly, and in this order:

1. Stop sending money. Do not pay any fee, tax or deposit to “unlock” a withdrawal.
2. Secure what is left. Move remaining funds to a new wallet with a new seed phrase if your phrase may be exposed. Revoke token approvals. Change passwords and enable app-based two-factor authentication.
3. Collect evidence. Transaction IDs, wallet addresses, website addresses, screenshots and chat logs.
4. Report it. In the United States, file reports with the FBI’s Internet Crime Complaint Center (IC3) and the FTC at ReportFraud.ftc.gov. Elsewhere, contact local police and your national fraud reporting body.
5. Tell any exchange involved. If funds moved through a known exchange, it may be able to flag or freeze them.

Recovery is never guaranteed and often not possible. Reporting still matters, because it helps investigators link cases and warn others.

The short checklist

Knowing how to spot crypto scams comes down to a few rules you never break:

• Never share a seed phrase or private key with anyone.
• Never send crypto to receive more crypto back.
• Never take investment advice from someone you met online.
• Never reach a financial site through an ad or a link; use your own bookmark.
• Read every wallet signature before you approve it.

For more on staying safe, browse the Security section; for step-by-step setup help, including wallets and platform checks, see the Guides section.

Editorial note: Be1Crypto.com never asks readers for seed phrases, wallet connections or payments, and it does not offer trading or fund recovery. Any message in our name that does is a scam.

Frequently asked questions

This article is for educational purposes only and is not financial advice. Be1Crypto.com is an independent publication and is not a trading platform.