10 Common Crypto Scams Everyone Should Watch Out For

Cryptocurrency has revolutionised the financial landscape, offering unprecedented opportunities for investment, innovation, and financial autonomy. Yet, alongside these opportunities lurks a darker side, a thriving ecosystem of scams designed to exploit unsuspecting investors. From phishing emails that mimic legitimate exchanges to elaborate Ponzi schemes promising unrealistic returns, crypto scams have cost individuals and institutions billions of pounds worldwide.

The decentralised and pseudonymous nature of cryptocurrency makes it particularly attractive to fraudsters. Transactions are often irreversible, regulatory oversight remains patchy, and the technical complexity can leave even experienced users vulnerable. Whether someone is a seasoned trader or a curious newcomer, understanding the most prevalent crypto scams is essential for protecting hard-earned assets.

This article examines ten common crypto scams that everyone should watch out for. Each section explores how these scams operate, what warning signs to look for, and practical steps to avoid falling victim. Armed with this knowledge, readers can navigate the crypto landscape with greater confidence and security.

1. Phishing Scams: Fraudulent Emails and Websites

Phishing remains one of the most prevalent and effective scams in the cryptocurrency world. Fraudsters create convincing replicas of legitimate exchange websites, wallet services, or blockchain platforms, then lure users into entering their login credentials, private keys, or seed phrases. These fraudulent sites often arrive via email, social media messages, or paid advertisements that appear at the top of search results.

The sophistication of phishing attacks has increased dramatically. Scammers now register domain names that differ by just one character from legitimate sites, such as “coinbаse.com” using a Cyrillic ‘а’ instead of a Latin ‘a’. Email templates replicate official branding down to the footer, complete with fake security warnings urging immediate action to “secure your account” or “verify your identity”.

Once credentials are entered on these fake sites, attackers gain complete access to victims’ accounts and can drain funds within minutes. In 2024 alone, phishing scams accounted for an estimated £300 million in stolen cryptocurrency globally.

How to Spot a Phishing Attempt

Recognising phishing attempts requires vigilance and attention to detail. The URL should always be checked carefully, look for subtle misspellings, additional characters, or unusual top-level domains like “.tk” or “.xyz”. Legitimate cryptocurrency platforms will never ask users to provide their private keys, seed phrases, or passwords via email or direct message.

Another telltale sign is urgency. Phishing emails often create artificial pressure with messages like “Your account will be suspended in 24 hours” or “Unusual activity detected, verify immediately”. Legitimate companies provide ample time for users to respond and typically communicate through multiple verified channels.

Users should bookmark official website URLs and access them directly rather than clicking links in emails. Two-factor authentication (2FA) adds an additional layer of security, though SMS-based 2FA can still be vulnerable to SIM swapping attacks. Authenticator apps like Google Authenticator or hardware security keys offer stronger protection.

2. Ponzi and Pyramid Schemes: Too Good to Be True Returns

Ponzi and pyramid schemes have plagued the financial world for decades, and cryptocurrency has provided fertile ground for these fraudulent operations. These scams promise exceptionally high returns with little to no risk, claims that should immediately raise suspicion. The infamous BitConnect collapse in 2018 saw investors lose over $2 billion when the lending and exchange platform turned out to be a massive Ponzi scheme.

In a Ponzi scheme, returns to earlier investors are paid using funds from newer investors rather than from legitimate business activities. The scheme inevitably collapses when new investment slows or stops. Pyramid schemes operate similarly but require participants to recruit others, with commissions paid for bringing in new victims. Both models rely on a constant influx of new money to sustain the illusion of profitability.

Cryptocurrency Ponzis often disguise themselves as “cloud mining” operations, “automated trading bots”, or “decentralised investment platforms”. They leverage technical jargon and blockchain’s complexity to confuse potential victims and create an aura of legitimacy.

Warning Signs of Investment Fraud

Several red flags can help identify investment fraud schemes. Guaranteed returns or promises of consistent profits regardless of market conditions are physically impossible in legitimate trading. Any platform claiming to “beat the market” or offer “risk-free” investments should be viewed with extreme scepticism.

Lack of transparency about how profits are generated is another major warning sign. Legitimate investment platforms provide clear information about their business model, fee structure, and risk factors. If the compensation plan seems overly complex or emphasises recruitment over actual product value, it’s likely a pyramid scheme.

Unregistered investments pose significant risks. In the UK, legitimate investment firms must be registered with the Financial Conduct Authority (FCA). The FCA maintains a warning list of unauthorised firms and known scams that investors should consult before committing funds. Also, pressure to recruit friends and family or to invest quickly before a “limited opportunity” expires are classic manipulation tactics used by fraudsters.

3. Fake Cryptocurrency Exchanges

Fake cryptocurrency exchanges represent a particularly dangerous scam because they appear to offer legitimate trading services. These fraudulent platforms often feature professional-looking websites, fabricated trading volumes, and customer testimonials designed to build trust. Some even allow initial small withdrawals to create confidence before blocking larger withdrawal requests.

These fake exchanges typically lure users through aggressive marketing, offering unrealistically low fees or exclusive access to new tokens. Once users deposit cryptocurrency or fiat currency, the funds become inaccessible. Support tickets go unanswered, withdrawal requests are perpetually “pending”, and eventually the entire website disappears, taking users’ funds with it.

The problem is compounded by the proliferation of decentralised exchanges (DEXs) and the general lack of regulatory oversight in many jurisdictions. Whilst legitimate DEXs provide valuable services, scammers exploit the decentralised model to create convincing imitations that lack accountability.

Verifying Legitimate Trading Platforms

Before depositing funds on any exchange, thorough due diligence is essential. Established exchanges like Coinbase, Binance, Kraken, and Gemini have years of operational history, regulatory compliance, and strong security track records. Newer platforms require extra scrutiny, checking their registration status with financial regulators, reading independent reviews, and searching for complaint histories.

Legitimate exchanges carry out robust security measures including cold storage for the majority of user funds, insurance policies, regular security audits, and comprehensive KYC (Know Your Customer) procedures. They also maintain active social media presence with verified accounts and responsive customer support.

Users should be wary of exchanges with poorly written content, grammatical errors, or missing legal information such as terms of service and privacy policies. The domain age can be checked using WHOIS lookup tools, newly registered domains promoting “revolutionary” trading platforms warrant particular suspicion. Testing with small amounts before committing significant funds, whilst not foolproof, can sometimes reveal issues with withdrawal processes.

4. Rug Pull Scams in DeFi Projects

Rug pulls have become one of the most notorious scams in the decentralised finance (DeFi) space. In this scam, developers create a new token or DeFi project, generate hype to attract investors, then suddenly withdraw all the liquidity or drain the project’s funds, leaving investors holding worthless tokens. The Squid Game token scam in 2021 exemplified this perfectly, rising to a market cap of $2.7 million before developers vanished with the funds.

Rug pulls exploit the permissionless nature of blockchain technology. Anyone can create a token and list it on decentralised exchanges without undergoing the rigorous scrutiny that centralised exchanges require. The speed at which these projects launch and collapse has accelerated, with some rug pulls occurring within hours of launch.

There are “soft” and “hard” rug pulls. Hard rug pulls involve malicious code in smart contracts that allows developers to drain funds directly, a clear case of theft. Soft rug pulls are more subtle, involving developers gradually selling their massive token holdings, causing the price to collapse, or simply abandoning the project after raising funds.

Red Flags Before Investing

Several indicators can help identify potential rug pulls before investing. Anonymous development teams with no verifiable track record present significant risk. Whilst pseudonymity is common in crypto, legitimate projects typically have at least some team members with public profiles and verifiable credentials.

Smart contract code should be publicly available and ideally audited by reputable security firms like CertiK, Quantstamp, or OpenZeppelin. Unaudited contracts or those with suspicious functions, such as the ability for developers to mint unlimited tokens or restrict selling, are major red flags. Tools like Token Sniffer and RugDoc provide automated analysis of smart contracts to identify common scam patterns.

Liquidity pool details matter significantly. If liquidity isn’t locked or the lock period is very short (less than one year), developers can remove it at any time. Extremely high token allocations to team wallets, especially without vesting periods, enable developers to dump tokens on investors. Also, projects promising unrealistic returns, lacking clear roadmaps, or heavily emphasising memes over utility often prove to be scams.

5. Romance and Social Media Scams

Romance scams involving cryptocurrency have surged in recent years, with the FBI’s Internet Crime Complaint Centre reporting losses exceeding £400 million in 2023 alone. These scams, often called “pig butchering” scams, involve fraudsters developing seemingly genuine romantic relationships over weeks or months before gradually introducing cryptocurrency investment opportunities.

Scammers create attractive profiles on dating apps like Tinder, Bumble, or Hinge, or reach out through social media platforms including Instagram, Facebook, and LinkedIn. They invest time building trust, sharing fabricated personal stories, and creating emotional connections. Once trust is established, they casually mention their success with cryptocurrency investments and offer to “help” their victim get started.

Victims are directed to fake trading platforms that show impressive (but fictitious) returns on investments. This encourages larger deposits. When victims attempt to withdraw funds, they’re told they must pay taxes or fees first, leading to additional losses. Eventually, the scammer disappears entirely, along with all the invested funds.

Protecting Yourself on Dating Apps and Social Platforms

Scepticism is crucial when online relationships quickly turn to financial discussions. Legitimate romantic interests don’t push investment advice, ask for money, or request cryptocurrency transfers. Any mention of investment opportunities, especially those requiring immediate action or secrecy from friends and family, should trigger alarm bells.

Reverse image searches can reveal whether profile photos are stolen from elsewhere online. Inconsistencies in stories, reluctance to video chat, or excuses for never meeting in person even though long conversations are classic red flags. Scammers often claim to work overseas on oil rigs, military deployments, or international business, scenarios that conveniently explain their unavailability.

Never send cryptocurrency or money to someone met exclusively online, regardless of their story. Genuine investment opportunities don’t require sending crypto to strangers. If pressure is applied to invest quickly or warnings are given against discussing the opportunity with others, it’s almost certainly a scam. Consulting friends, family, or financial advisors before making significant investment decisions provides valuable perspective and can prevent emotionally-driven mistakes.

6. Fake Celebrity or Influencer Giveaways

Fake giveaway scams leverage the popularity and trust associated with celebrities and influencers. Scammers create counterfeit social media accounts impersonating figures like Elon Musk, Vitalik Buterin, or popular crypto influencers, then announce giveaways where users must send cryptocurrency to receive a larger amount in return. These scams proliferate particularly during live streams or major announcements when engagement is high.

The scam follows a simple but effective formula: “Send 0.5 ETH to this address and receive 5 ETH back immediately.” These posts often include fabricated screenshots showing “successful” transactions and testimonials from supposed winners. During high-profile events like cryptocurrency conferences or product launches, dozens of fake accounts flood comment sections with these offers.

In 2020, Twitter itself was compromised when hackers gained access to verified accounts belonging to Barack Obama, Bill Gates, and Apple, among others, posting Bitcoin giveaway scams that netted over £100,000 in just hours. This incident highlighted how even verified accounts can’t be blindly trusted during security breaches.

No legitimate giveaway requires sending cryptocurrency first. This “send to receive” model is always a scam, without exception. Genuine giveaways only require wallet addresses for receiving funds, never outgoing transactions. Celebrity accounts have verification badges, but these can be faked in screenshots, so always check the profile directly.

Scammers create urgency with countdown timers and limited participation slots. They use bots to generate fake replies thanking the “celebrity” for the giveaway and claiming successful receipt of doubled funds. These fabricated social proof tactics pressure victims into acting quickly without proper verification.

Before engaging with any giveaway, the account’s post history, follower count, and engagement patterns should be examined. Newly created accounts or those with few genuine posts are red flags. Legitimate influencers announce giveaways across multiple platforms and their official websites, not solely through replies to other people’s tweets. When in doubt, visiting the celebrity’s official verified account or website directly, rather than clicking links, prevents falling for impersonations.

7. Malware and Clipboard Hijacking

Malware targeting cryptocurrency users has become increasingly sophisticated. Clipboard hijacking is a particularly insidious attack where malicious software monitors the clipboard for cryptocurrency addresses. When a user copies a wallet address to send funds, the malware instantly replaces it with the attacker’s address. If the user doesn’t notice and completes the transaction, funds are sent to the scammer instead of the intended recipient.

This attack succeeds because cryptocurrency addresses are long strings of random characters that users rarely verify completely. Many people check only the first and last few characters, but advanced malware can generate addresses matching those specific characters, making detection even harder.

Other malware variants include keyloggers that record every keystroke to capture passwords and seed phrases, screen recorders that capture sensitive information during wallet operations, and trojans disguised as legitimate cryptocurrency applications. Some malware even targets mobile devices, intercepting SMS messages used for two-factor authentication.

Cryptojacking malware mines cryptocurrency using victims’ computing resources without their knowledge, causing devices to slow down and consume excessive electricity. Whilst this doesn’t steal funds directly, it demonstrates the creativity of cryptocurrency-focused cybercriminals.

Securing Your Devices and Wallets

Robust cybersecurity practices are essential for protecting cryptocurrency assets. Reputable antivirus and anti-malware software should be installed and kept updated on all devices used for cryptocurrency transactions. Windows Defender, Malwarebytes, and Bitdefender offer strong protection against known threats.

Wallet addresses should always be verified character-by-character before confirming transactions, never assume the clipboard contents are correct. For frequent recipients, using address book features in wallet applications adds a layer of safety. Sending a small test transaction first, whilst costing minor fees, can prevent catastrophic losses.

Software should only be downloaded from official sources. Wallet applications, trading platforms, and cryptocurrency tools should come directly from official websites or verified app stores, never from third-party download sites or email attachments. Browser extensions require particular caution, as malicious extensions can access browsing data and modify web pages.

Hardware wallets like Ledger and Trezor provide the strongest security by keeping private keys offline and isolated from potentially infected computers. Even if malware compromises the connected device, it cannot access the private keys stored on the hardware wallet. For significant holdings, hardware wallets represent an essential investment. Operating systems and all applications should be kept updated with the latest security patches, and public Wi-Fi should be avoided for cryptocurrency transactions or, if necessary, used only through a trusted VPN.

8. Pump and Dump Schemes

Pump and dump schemes artificially inflate a cryptocurrency’s price through coordinated buying and misleading positive information, then sell at the peak, leaving late investors with worthless assets. These schemes typically target low-cap altcoins with limited liquidity, where relatively small buying pressure can dramatically move prices.

Organisers accumulate large positions in obscure tokens at low prices, then coordinate simultaneous buying through Telegram or Discord groups. They spread hype through social media, fake news articles, and fabricated partnerships to attract unsuspecting investors. As the price rockets upward, FOMO (fear of missing out) drives more buyers into the market.

At a predetermined price or time, organisers sell their holdings, causing the price to crash. Ordinary investors, who bought at inflated prices, suffer substantial losses. These schemes can unfold in minutes on small exchanges, leaving little opportunity for victims to react.

The cryptocurrency market’s 24/7 operation and global nature make pump and dump schemes particularly effective and difficult to prosecute. Organisers often operate across multiple jurisdictions, complicating legal action.

How Coordinated Groups Manipulate Prices

Pump and dump groups advertise through social media, claiming to offer “VIP signals” or “guaranteed profit opportunities”. They charge membership fees or promise free signals to attract participants. But, only the organisers profit, members receive the signal after organisers have already bought, and by the time members purchase, the price is already artificially inflated.

These groups use sophisticated tactics including wash trading (simultaneously buying and selling to create false volume), spoofing (placing large orders that are cancelled before execution to manipulate perception), and coordinating messages across multiple platforms to create the illusion of organic interest.

The manipulation extends to creating fake buzz through bot accounts on Twitter, Reddit, and cryptocurrency forums. They may create professional-looking websites for the targeted token, fabricate partnership announcements, or pay minor influencers to promote the project without disclosure.

Avoiding pump and dump schemes requires healthy scepticism about unexpected price surges in low-volume tokens. Legitimate projects build value gradually through technological development, partnerships, and user adoption, not sudden unexplained rallies. Any group promising guaranteed returns or coordinated buying signals should be avoided entirely. Due diligence should include researching the project’s fundamentals, team credentials, and actual utility rather than price predictions. Tokens promoted primarily through hype, memes, or celebrity endorsements without substantive technology warrant extreme caution.

9. Fake Wallet Applications

Fake wallet applications represent one of the most direct routes for scammers to steal cryptocurrency. These fraudulent applications impersonate legitimate wallets like MetaMask, Trust Wallet, or Ledger Live, appearing in app stores or promoted through search engine advertisements. Users who download these fake apps and enter their seed phrases or private keys immediately lose access to their funds.

The sophistication of these fakes has increased substantially. They replicate the user interface, branding, and functionality of legitimate wallets so convincingly that even experienced users can be fooled. Some fake wallets even allow normal transactions initially to build trust before eventually stealing funds or transmitting private keys to attackers.

Google Play and Apple’s App Store have improved their vetting processes, but fake wallets still occasionally slip through, often using slightly altered names like “MyEtherwαllet” or “Trust.Wallet” to bypass automated detection. They may accumulate positive reviews from fake accounts to appear legitimate.

Searching for wallet names sometimes yields paid advertisements for fake versions appearing above the legitimate wallet’s official website. These cloned sites look identical to the real ones and distribute malicious versions of the wallet software.

Protection begins with extreme caution when downloading wallet applications. The developer name and download count should be verified, and reviews should be read carefully for complaints about stolen funds. Legitimate wallets have millions of downloads and long operational histories. Official wallet websites should be accessed directly by typing the URL rather than clicking search results or advertisements.

Many legitimate wallet projects list their official app store links on their verified websites and social media accounts. Cross-referencing these official sources before downloading prevents mistakes. For desktop wallets, downloads should only come from the official project website, and the file hash should be verified if provided.

Existing users who are prompted to re-enter seed phrases through app updates should be extremely cautious. Legitimate wallet updates never require seed phrase re-entry, this is a common tactic used by fake wallet updates. When uncertain about an application’s legitimacy, seeking verification from the wallet’s official support channels or cryptocurrency communities like Reddit’s r/CryptoCurrency can provide clarity. Most importantly, seed phrases should never be entered into any application without absolute certainty of its legitimacy, and they should never be photographed, emailed, or stored digitally where malware might access them.

10. Impersonation of Customer Support

Customer support impersonation has become one of the most effective social engineering attacks in cryptocurrency. Scammers monitor social media platforms, particularly Twitter and Reddit, for users posting questions or complaints about exchanges or wallets. Within minutes, fake support accounts contact the user, offering assistance and directing them to fraudulent websites or requesting sensitive information.

These fake support representatives use logos, profile pictures, and usernames that closely match official accounts. They may use names like “@Coinbase_Support” or “@BinanceHelpDesk” that appear legitimate at first glance. Their responses seem professional and helpful, creating a false sense of security.

The scammer typically requests private keys, seed phrases, or login credentials under the guise of “verifying the account” or “resolving the issue”. Alternatively, they direct users to fake support websites that harvest credentials or install malware. Some sophisticated scammers conduct lengthy troubleshooting sessions to build trust before making their malicious request.

Legitimate cryptocurrency companies never initiate direct messages on social media, never ask for private keys or seed phrases, and never request passwords or 2FA codes. These are absolute rules without exception. Official support operates exclusively through verified channels like ticket systems on the company’s official website or through official support email addresses.

Contacting Official Support Safely

When assistance is needed, users should always initiate contact through official channels. This means visiting the exchange or wallet’s official website directly and using their designated support portal. Most major platforms offer ticketing systems, live chat features on their verified websites, or official support email addresses published on their sites.

Verification badges on social media accounts provide some assurance, but these should be supplemented by checking the account against the official website’s listed social media profiles. Many companies maintain a “Beware of scammers” notice on their websites listing their only legitimate support channels.

Direct messages on social media claiming to be from support should be ignored entirely, even if they appear helpful. If a response is needed, it should come through official tickets or verified channels. Reputable companies understand this and will never be offended by users verifying their identity through official channels.

Before sharing any information, users should question whether the requested information is necessary. Screenshots of errors are reasonable to request: private keys are never reasonable. When in doubt, ending the conversation and reaching out through verified official channels is always the safest approach. Community forums and official subreddits can also provide guidance, though users should remain cautious about private messages even in these spaces, as scammers patrol them actively looking for victims.

Conclusion

The cryptocurrency landscape offers tremendous opportunities but also harbours significant risks. The ten common crypto scams outlined here, from phishing attempts and fake exchanges to sophisticated social engineering attacks, represent just a fraction of the threats users face. The decentralised, pseudonymous, and irreversible nature of cryptocurrency transactions makes it an attractive target for fraudsters, whilst the complexity of the technology can leave even experienced users vulnerable.

Protection requires a combination of technical security measures and healthy scepticism. Hardware wallets, two-factor authentication, and robust malware protection provide essential defences. But equally important is the mindset: questioning offers that seem too good to be true, verifying sources before taking action, and never sharing private keys or seed phrases under any circumstances.

The cryptocurrency community continues to develop better security practices, regulatory frameworks, and educational resources. But, scammers evolve alongside these developments, constantly refining their tactics and exploiting new vulnerabilities. Staying informed about emerging threats through reputable cryptocurrency news sources, security blogs, and official announcements from wallet and exchange providers remains crucial.

Eventually, protecting cryptocurrency assets is a personal responsibility. There are no chargebacks, no customer protection schemes, and often limited legal recourse when funds are stolen. But with vigilance, proper security practices, and awareness of common scam patterns, users can significantly reduce their risk and participate in the cryptocurrency revolution safely. Education and caution are the best defences against crypto scams, sharing this knowledge with friends, family, and fellow community members helps create a more secure ecosystem for everyone.

Frequently Asked Questions

What are the most common crypto scams to watch out for?

The most prevalent crypto scams include phishing attacks, Ponzi schemes, fake exchanges, rug pulls in DeFi projects, romance scams, fake giveaways, malware attacks, pump and dump schemes, fraudulent wallet applications, and customer support impersonation. Each exploits different vulnerabilities in the cryptocurrency ecosystem.

How can I identify a crypto phishing scam?

Phishing scams often feature URLs with subtle misspellings, urgent language pressuring immediate action, and requests for private keys or seed phrases. Always check URLs carefully, bookmark legitimate sites, enable two-factor authentication, and never click links in unsolicited emails claiming to be from exchanges.

Are crypto giveaways that require sending cryptocurrency first legitimate?

No, any giveaway requiring you to send cryptocurrency first is always a scam without exception. Legitimate giveaways only require a wallet address to receive funds, never outgoing transactions. This ‘send to receive’ model is a guaranteed fraud indicator used by impersonators.

What is a rug pull scam in cryptocurrency?

A rug pull occurs when DeFi project developers create hype around a new token, attract investors, then suddenly withdraw all liquidity or drain funds, leaving investors with worthless tokens. Warning signs include anonymous teams, unaudited smart contracts, and unlocked liquidity pools.

How do I verify if a cryptocurrency exchange is legitimate?

Check the exchange’s registration with financial regulators like the FCA, review its operational history, verify security measures including cold storage and insurance, read independent reviews, and test withdrawals with small amounts first. Established platforms have years of track records and regulatory compliance.

Can someone steal my crypto by knowing my wallet address?

No, wallet addresses are public by design and safe to share for receiving funds. However, private keys and seed phrases grant complete access to your cryptocurrency. Never share these with anyone, regardless of claims about account verification or technical support needs.