How to Spot a Crypto Scam: 15 Red Flags and How to Protect Yourself (2026)

A crypto offer is almost certainly a scam if someone promises guaranteed returns, asks for your seed phrase, pushes you to pay in crypto, contacted you first or met you online, or lets you deposit but not withdraw. The US Federal Trade Commission (FTC) puts it bluntly: "Only scammers demand payment in cryptocurrency" and "only scammers will guarantee profits or big returns." Below are the 15 warning signs, how today's main schemes work, how to secure a wallet, and what to do if you have already paid.

The latest twist is aimed at people who have already lost money. On 20 July 2026 the FBI warned that scammers are posing as staff of its Internet Crime Complaint Center (IC3). They use fake "update your report" links and AI-generated videos of a senior FBI official to promote a spoofed IC3 website. The FBI says IC3 "will never directly communicate with individuals via phone, email, social media" and will never ask for payment to recover funds.

How big the problem is

• United States, 2025 (FBI IC3, report released April 2026): IC3 received 1,008,597 complaints, with reported losses of about $20.9 billion. Cryptocurrency investment fraud caused the largest losses of any category, at about $7.2 billion. As reported by The Block, complaints that involved cryptocurrency in any form totalled 181,565, with $11.366 billion lost. People aged 60 and over reported $4.4 billion of those crypto losses.
• Recovery scams (IC3, 2025): 10,516 complaints and about $1.4 billion in losses, according to The Block's reading of the report.
• Crypto kiosks (IC3 alert, 15 May 2026): more than 13,400 complaints and over $388 million lost in 2025. Losses rose 58% on 2024.
• Worldwide, 2025 (Chainalysis, 13 January 2026): scam addresses received at least $14 billion on-chain. Chainalysis projects the total could reach about $17 billion once more scam wallets are identified, so $17 billion is an estimate rather than a count. Reported impersonation scams rose about 1,400% year on year. The average scam payment rose from $782 to $2,764.
• Social media (FTC Data Spotlight, 27 April 2026): nearly 30% of people who lost money to any scam in 2025 said it started on social media. Reported losses from those scams were $2.1 billion, of which $1.1 billion went to investment scams.

All of these figures come from reported complaints or identified wallets. The FBI and the FTC both say real losses are likely much higher.

The 15 red flags

1. Guaranteed returns. No legitimate investment can guarantee profit.
2. Requests for your seed phrase or private key. Wallet providers say they never ask for it. MetaMask's support pages say: "We will never ask you to provide your SRP" (Secret Recovery Phrase).
3. Pressure to pay in crypto. This covers fees, taxes, "unlock" charges or a government demand. In its kiosk alert the FBI says: "No legitimate law enforcement or government official will call to demand payment via a cryptocurrency kiosk."
4. Investment tips from someone you met online. The FTC's advice is: "Never mix online dating and investment advice."
5. Unsolicited contact. A stranger messages you first about an opportunity.
6. Urgency. You hear lines like "limited spots," "act today" or "the window closes tonight."
7. Withdrawals that require a fee. The platform says you must pay tax, a verification fee or a deposit before you can take money out.
8. Small early withdrawals that work. The FTC describes fake platforms that show fake profits and allow small withdrawals to build trust before larger deposits.
9. "Invest more to unlock a higher tier." Any return that depends on depositing more money is a warning sign.
10. Celebrity or official endorsement videos. These include giveaways that promise to "double" what you send, and videos of officials. The July 2026 FBI alert lists "unnatural movements," "inaccurate shadows" and "voice call lag time" as signs of a fake video.
11. Links in unexpected messages. The FTC says never to click a link in an unexpected text, email or social message, even if it seems to come from a company you know.
12. A token you can buy but cannot sell. This is a "honeypot" contract.
13. Unknown tokens or tiny transfers appearing in your wallet. These are often bait for a malicious approval or for address poisoning (see below).
14. Requests for screen sharing or remote access, or to install an app sent by link.
15. An unsolicited offer to recover lost funds, especially one from a "law firm" or "government partner."

One flag is enough reason to stop and check the offer independently. If you see several, walk away.

How the main scams work

Pig butchering (relationship investment fraud)

A stranger builds trust over weeks or months through a dating app, social media, a "wrong number" text or a WhatsApp investing group. Then they introduce a trading platform that shows growing profits. The FTC describes scammers posing as friendly advisers and filling group chats with fake "successful investors." When you try to withdraw a large amount, you are told to pay taxes or fees first. The IC3 2025 report says these schemes are largely run by criminal groups in Southeast Asia that use trafficking victims as forced labour.

People often do not realise they are in one. In February 2025 the FBI said its Operation Level Up had notified more than 4,300 victims since January 2024, and about 76% of them did not know they were being scammed (reported by Nextgov). Experience gives no protection either. Shan Hanes, former CEO of Heartland Tri-State Bank in Kansas, wired $47.1 million of the bank's money to crypto wallets in a pig-butchering scheme between May and July 2023. The bank failed, and in August 2024 he was sentenced to 293 months in federal prison, according to the US Attorney's Office for the District of Kansas.

Impersonation scams

Scammers pose as wallet or platform support staff, government agencies, the FBI or well-known people. AI makes it cheaper for them to produce convincing voices, videos and websites. Chainalysis found that scam operations with on-chain links to AI vendors took in about 4.5 times more revenue on average than those without, at $3.2 million versus $719,000 per operation. The defence is to reach the organisation yourself through an address you typed or saved, never through a link or number the contact gave you.

Fake platforms and apps

The site or app looks like a real trading platform and shows a live-looking balance. Deposits go straight to the scammers. Withdrawals are "temporarily suspended" for compliance checks or need an upfront fee. Before you deposit, look up the firm with the financial regulator in your country, for example the SEC, CFTC or your state regulator in the US.

Address poisoning

The attacker creates a wallet address whose first and last characters match one you use often. They send you a zero-value or tiny transfer from it, so the fake address appears in your transaction history. If you later copy the address from that history, the money goes to the attacker. Ledger documents a case on 26 May 2025 in which one trader lost about $2.6 million in USDT this way. Defences:

• Copy addresses from a saved contact or allow-list, never from your transaction history.
• Check the full address, not only the first and last few characters.
• On a hardware wallet, confirm the address on the device's screen.

Malicious approvals and fake airdrops

A site offering a free token airdrop asks you to "connect and claim." The transaction you sign actually gives a contract permission to spend your tokens. Revoke permissions you no longer use. Etherscan's Token Approval Checker, for example, lets you review and revoke ERC-20, ERC-721 and ERC-1155 approvals on Ethereum.

SIM swaps

A criminal persuades your mobile carrier to move your number to their SIM. They then receive your SMS login codes. In November 2023 the US Federal Communications Commission adopted rules (FCC 23-95) that require carriers to authenticate customers securely before a SIM change or number port, to notify customers of those requests, and to offer an account lock. Turn that lock on, and use an authenticator app or a hardware security key instead of SMS codes for any account that holds crypto.

Rug pulls and honeypots

The developers promote a new token, then withdraw the liquidity or use contract code that stops holders from selling. Warning signs include:

• an anonymous team
• unverified contract code on the block explorer
• a few wallets holding most of the supply
• liquidity that is not locked
• a chart that shows only buys

Recovery scams

People who have already lost money are approached again by someone offering to get it back. The FBI's 13 August 2025 alert describes fake "crypto recovery law firms" that know the exact amounts and dates of your losses, claim government partnerships ("There are no law firms which are officially authorized partners of US Government agencies"), refer you to made-up regulators and ask for fees in crypto or gift cards. The IC3 says it does not work with law firms or private recovery services to recover funds.

Crypto kiosk scams

A caller pretending to be from a bank, a government agency or tech support tells you to withdraw cash and feed it into a crypto ATM, often using a QR code they send you. If you are using a kiosk on someone's instructions, stop.

How to check a project or platform

• Contract address: take it from the project's official documentation and confirm it on the chain's block explorer. Copycat tokens reuse the same name and logo with a different address.
• Verified code: the explorer should show verified source code. Treat unverified code as high risk.
• Holder spread: check the explorer's holder list for heavy concentration in a few wallets.
• Team: check whether you can confirm real identities and earlier work independently.
• Platform registration: look the firm up on your regulator's register, not on the firm's own website.
• Domain: a WHOIS lookup shows when the domain was registered. A brand-new domain for an "established" platform is a warning sign.
• Withdrawal test: a small withdrawal that works proves nothing, because fake platforms allow these on purpose.

How to protect your wallet

• Never share or type your seed phrase into a website, form, chat or "validation" tool. MetaMask says the only legitimate times to enter it are when you create or restore a wallet.
• Keep long-term holdings in a hardware wallet, and confirm every address and transaction on its screen.
• Use separate wallets: a cold wallet for savings, a hot wallet for small everyday amounts, and a burner wallet for new apps and airdrops.
• Review and revoke token approvals regularly.
• Ignore unknown tokens that appear in your wallet. Do not try to sell them or follow their links. Hide them if your wallet allows it.
• Turn on withdrawal address allow-lists and withdrawal limits wherever your platform offers them.
• Protect your phone number with a carrier account lock, and do not use SMS for two-factor authentication.
• Get to official sites by bookmark or by typing the address, not through search ads. The FBI's July 2026 alert specifically warns about "sponsored" results.

What to do if you have been scammed

1. Stop paying. No fee, tax or deposit will release your funds.
2. Move any remaining assets to a new wallet with a new seed phrase if your phrase or device may be compromised. Revoke approvals on the old wallet.
3. Record everything: wallet addresses, transaction hashes, dates, amounts, chats, website addresses and receipts.
4. Report it. In the US:

- FBI IC3 at ic3.gov, typed directly into the browser - FTC at ReportFraud.ftc.gov - CFTC at cftc.gov/complaint - SEC at sec.gov/tcr - the platform you sent the money from

People aged 60 and over can call the DOJ Elder Justice Hotline on 1-833-FRAUD-11 (1-833-372-8311). Outside the US, report to your national police and financial regulator.

1. Expect recovery offers and treat them all as scams. That includes anyone who claims to be from the FBI or IC3.

Limitations: the loss figures come from US complaint data and from wallets Chainalysis has identified, so they undercount losses and tell you little about any single country outside the US.