Crypto Scam Protection: Verify and Secure

Introduction

This page is written for two moments. The first is the minute before you send crypto, connect a wallet or sign a request that someone else has put in front of you. The second is the hour after you realise that a payment or a signature went somewhere it should not have. Both moments are short, and both reward a reader who already knows what to do, so the page is built as a set of steps rather than a catalogue of scam names.

The steps hang on three questions: who is asking, what they are asking you to sign or send, and why it has to happen now. Each question has a check you can run yourself without trusting the person in front of you. You can search a register, read a device screen or look up a phone number on your own. The three questions section sets out those checks, and the three sections after it take them further.

Broadly, a scam asks for a payment, a signature or a secret such as your recovery phrase. Investment fraud, fake trading platforms and impersonated officials want a payment. Wallet drainers want a signature, an approval that lets someone else move tokens out of your wallet. A fake support agent may want the recovery phrase itself, which controls the whole wallet. Each request needs its own habit, which is why this page has a section on verifying a platform before you deposit and a separate section on protecting your wallet and what it signs.

The page then moves in the order a reader usually needs it. It starts with what the money is actually lost to and why every published figure is a minimum. Then come the three questions, a five-question checklist for any platform that wants a deposit, the habits that protect a self-custody wallet and the sentences that scam scripts reuse. It ends with the first hour, day and week after a loss, where to report in the UK, the US and the EU, and what no page can do.

Every sentence that reports what a regulator, police service, company or researcher says names that source and the date it was published or read, and every sentence about a regulator or a police service names the jurisdiction it applies to. That matters here more than on most subjects, because reporting routes and protections differ between countries and, for reporting, even between the nations of the UK. Where a claim could not be checked against a primary source on 5 October 2026, it is not on this page.

If you are reading this for a parent, a partner or a friend, the three questions work as a conversation rather than a lecture. Ask who first got in touch, what they have been asked to send, and what would happen if they waited a week before sending anything else. The answers tell you which section to read together.

This page does not promise that money can be recovered, and it recommends nobody who claims they can do it; the section on what no page can do explains why. It is also not about platforms that failed. If an exchange or lender you used became insolvent rather than turning out to be fake, our guide to crypto platform failure and recovery covers that separate problem.

If something has already happened, go straight to the first hour, day and week, and come back to the rest when the urgent steps are done.

What the Money Is Actually Lost To

Two data series anchor this guide and its companion pages. The first measures money received by scams on public blockchains; the second, kept on another page, measures losses to wallet drainers on phishing websites and the number of victim wallets. Neither is a count of everything that people lose, so each is quoted with its source and its date on the page that carries it.

The measured floor, and the projection

Blockchain analytics firm Chainalysis reported on 13 January 2026 that crypto scams received at least $14 billion on-chain in 2025, and projected that the figure could exceed $17 billion as more scam wallets are identified.

Chainalysis based that projection on historical trends, in which its annual estimates grow between reporting periods, and said the figure would rise as it identified more illicit wallet addresses in the months after publication (Chainalysis, 13 January 2026). The measured number is therefore a floor, and the larger one is a forecast of how far the floor may rise.

If you quote these figures, quote the measured one as at least $14 billion and call the larger one a projection. A headline that says $17 billion was stolen states a forecast as if it were a count, and a reader who later sees the measured figure may wrongly conclude that one of the two numbers is false.

The figure counts what scam addresses received on public blockchains, as identified by Chainalysis, rather than what victims reported losing, which is why it rises as more addresses are found (Chainalysis, 13 January 2026). Chainalysis's on-chain figure says nothing about how many people were involved, or about money that reached scammers by bank transfer, card or cash without passing through a blockchain.

Where the money goes: the two dominant categories

In the same report, published on 13 January 2026, Chainalysis named high-yield investment programmes (HYIPs) and pig butchering as the dominant crypto scam categories by volume in 2025, while noting that scam types increasingly overlap.

In the US, the FTC says investment scams often promise you can make lots of money with zero risk, and often start on social media or on online dating apps and sites (guidance last modified 10 February 2025). Neither category needs a hacker to work. In both, you make the payment yourself, which is why the verification checks later on this page come before any deposit rather than after it.

Pig butchering is explained stage by stage on its own page, linked from the section on recognising the pitch.

Why every reported figure is too low

In the US, the Federal Trade Commission told Congress on 25 March 2026 that the fraud losses reported to it are only a fraction of what American consumers actually lose, because not everyone who loses money to a scam reports it to the FTC or its data sources.

Read every loss figure on this site, and on any other, as a minimum. Figures built from complaints count only the people who reported, and figures built from blockchain data count only the addresses that analysts have identified. Both methods miss the rest, and they miss it in different ways, which is also why figures from different sources should never be added together.

The drainer series, kept on its own page

The second series, Scam Sniffer's annual total of what wallet drainers took through phishing websites and the number of victim wallets, lives with its source and scope on our wallet drainer and phishing defence guide. It is not repeated here, so that each figure on this site has one home and one date.

Drainers need something different from you. They do not ask for a payment; they ask for a signature, and the section on protecting the wallet is built around that difference.

Three Questions to Ask Before You Send or Sign

In the UK, the FCA tells you to stop and check whenever a contact is unexpected, pressures you to act quickly, offers something too good to be true or claims to be authorised (guidance last updated 19 January 2026).

The three questions below fold those signs into something you can ask in a few seconds. Ask them of a text, a call, a direct message, an advert, a website, or a person you have come to trust online.

Who is asking?

Treat a name, a logo, a phone number or a verified-looking profile as a claim until you have checked it through a channel you chose yourself. A number you looked up and an address you typed are channels you chose; a link in the message is not.

In the UK, the FCA warns that scammers can make its real switchboard numbers appear in your caller ID, and says it does not use WhatsApp, other messaging services or automated calls (guidance last updated 12 May 2026).

In the US, the CFTC says its email always comes from an @cftc.gov address and that government officials will never contact you from web-based email accounts such as Yahoo or Gmail (advisory read on 5 October 2026).

In the US, the CFTC says the vast majority of crypto and forex trading frauds begin on social media or messaging apps (April 2023 brochure). In the US, the CFTC also says that if someone you meet online introduces you to a trading website you have never heard of, it is likely a fraud (April 2023 brochure).

In the US, the FTC's rule is never to mix online dating and investment advice: if someone you meet on a dating site or app wants to show you how to invest in crypto, or asks you to send them crypto, the FTC calls it a scam (guidance last modified 10 February 2025).

In the UK, the National Crime Agency tells crypto investors to beware of attempts to move a conversation onto an encrypted app such as WhatsApp or Telegram (information sheet last modified 23 September 2026).

Our threat modelling guide walks you through working out who is likely to target you, given what you hold and who knows you hold it.

What are they asking you to sign or send?

Name the thing being asked for before you do anything else. A payment to an address, a bank transfer to buy crypto on someone else's instructions and a wallet connection are different requests. So are a signature, a recovery phrase and a code from your phone, and each one carries a different risk.

In the US, the FTC says only scammers demand payment in cryptocurrency (guidance last modified 10 February 2025). In the US, the FTC says no legitimate business will demand you send crypto in advance, whether to buy something or to protect your money (guidance last modified 10 February 2025).

In the US, the CFTC warns that scam trading websites will not accept transfers from your bank (April 2023 brochure). In the US, the CFTC says the scammers instead walk you through buying crypto on a legitimate platform and then ask you to send it to them (April 2023 brochure).

In the US, the CFTC says it has no digital wallet and does not ask for personal digital wallet information (advisory read on 5 October 2026). In the US, the CFTC says it would never ask for your private keys or seed phrases (advisory read on 5 October 2026).

In the UK, the FCA says it would never ask you to transfer money to it, or ask for sensitive banking information such as bank account PINs and passwords (guidance last updated 12 May 2026).

In the US, the FTC warns that cryptocurrency payments typically cannot be reversed (guidance last modified 10 February 2025). In the US, the FTC says that once you pay with crypto, you can usually get the money back only if the person you paid sends it back (guidance last modified 10 February 2025). So the decision point is before the payment, and nothing after it is as reliable as not sending.

A signature deserves the same pause as a payment. A request to approve a token or to sign a message can give someone else permission over what you hold, and connecting your wallet to a dApp is often the step just before one. The section on protecting the wallet covers how to read one before you confirm it.

Why does it have to happen now?

In the UK, the FCA lists feeling pressured to act quickly as a warning sign (guidance last updated 19 January 2026). In the UK, the FCA says scammers may offer a bonus or discount for investing quickly, or say an opportunity is only available for a short time (guidance last updated 19 January 2026).

In the UK, the National Crime Agency tells crypto investors to be suspicious if they are told to ignore warnings from banks and crypto exchanges, or to keep a special deal secret (information sheet last modified 23 September 2026).

In the US, the CFTC tells anyone called by someone claiming to be from the CFTC to end the call and contact the CFTC to verify it (advisory read on 5 October 2026). In the US, the CFTC says not to give or confirm personal or account information on such a call, including digital wallet private keys (advisory read on 5 October 2026).

Give every request a day before you act on it. Hang up, close the chat and check through a channel you chose. A genuine bank, regulator or friend will still be there tomorrow. A request that cannot survive a day of checking was never safe to act on.

Verify the Platform: A Five-Question Checklist

Before any deposit, ask these five questions of the platform, app or person handling your money, and stop at the first answer that fails or that you cannot get. The full walkthrough, including how to read a register entry, is in our guide to verifying a crypto platform.

• 1. Is it on the register for your country, for this activity? In the UK that is the FCA's Financial Services Register, in the EU it is ESMA's register of authorised crypto-asset service providers, and in the US it is the federal and state registrations the firm needs for what it offers you. A firm you cannot find is a firm you do not deposit with.
• 2. Do the details you were given match the register entry exactly? Compare the website address, the email domain and the phone number character by character with the register entry, not with the details on the firm's own pages or in the message that reached you.
• 3. Does the entry cover what you are being offered? A registration for one purpose is not permission for another, and a registration is not a promise of compensation if the firm fails.
• 4. Is there a warning about it? Search the regulator's warnings, and search the firm's name and web address with the words scam and fraud. A warning is enough to stop; the absence of one proves nothing.
• 5. Does the website or app hold up? Check when the domain was registered, type the address yourself rather than following a link, and treat the padlock and an app-store listing as no proof that the service is genuine or legal.

The register check, by jurisdiction

In the UK, the FCA tells you to search its Financial Services Register by a crypto firm's name or reference number and check what the firm has permission to do (guidance last updated 16 February 2026). In the UK, the FCA also tells you to make sure a crypto firm's contact details match the ones you were given (guidance last updated 16 February 2026).

In the UK, the FCA says a firm you cannot find on its Financial Services Register is unlikely to have permission to offer you crypto products, and that you should avoid it (guidance last updated 16 February 2026).

In the EU, the MiCA transitional period for crypto firms operating under national rules ended on 1 July 2026 (ESMA statement, 23 June 2026). In the EU, ESMA warned on 23 June 2026 that clients of unauthorised crypto-asset service providers do not benefit from MiCA safeguards, including protections for client assets. In the EU, ESMA invites crypto clients to check whether their provider is authorised in the ESMA register (statement of 23 June 2026).

In the US, the CFTC says the US Treasury treats crypto trading platforms as money services businesses that must register with FinCEN (April 2023 brochure). In the US, the CFTC says registration alone will not protect you from fraud, but that most scams involve unregistered firms, people and products (April 2023 brochure).

What registered does and does not mean

In the UK, the FCA says firms offering certain crypto activities, such as crypto exchanges, crypto ATMs and custodian wallet providers, must be registered with it for anti-money laundering purposes, and that you should avoid such firms if they are not registered (guidance last updated 22 September 2026). In the UK, the FCA says a firm that is registered but not authorised cannot provide regulated products and services that need authorisation (guidance last updated 22 September 2026).

In the UK, the FCA says most crypto-related activities are not regulated (guidance last updated 16 February 2026). In the UK, the FCA says that if you invest in crypto you generally cannot complain about the firm to the Financial Ombudsman Service, and are not protected by the Financial Services Compensation Scheme if it fails (guidance last updated 16 February 2026).

In the US, the CFTC states that it does not issue cryptocurrency trading licences, so a document presented to you as a CFTC crypto trading licence is not genuine and is a reason to stop (advisory read on 5 October 2026).

A platform that says it is regulated has told you nothing until it names the register, the entry and the activity. The entry then has to say what the platform implies. The verification guide shows a real register entry and sets out what it does not promise.

Warnings, and what their absence proves

In the UK, the FCA says a warning it has published about an unauthorised firm appears on the Firm Checker and the Financial Services Register when you search for that firm, and that its Warning List is the full list of the firms it has warned about (guidance last updated 22 September 2026).

In the EU, ESMA tells investors not to assume a company that approaches them is authorised or legitimate just because the IOSCO Investor Alerts Portal has no warning about it (page read on 5 October 2026). In the EU, ESMA tells investors to check with their domestic regulator whether a company is authorised to provide investment services (page read on 5 October 2026).

In the US, the CFTC suggests searching a trading website's domain name with the words scam, fraud or reviews to see whether earlier users have posted warnings (April 2023 brochure).

Websites and apps

In the US, the CFTC advises looking up when a trading website's domain was registered at lookup.icann.org (April 2023 brochure). In the US, the CFTC says a domain only a few weeks old marks a scam when the company claims to have been around for several years (April 2023 brochure).

In the US, the FBI warned on 10 June 2019 that criminals use website certificates so that phishing sites show https and a lock icon. In the US, the FBI advised on 10 June 2019 not to trust a website just because it has a lock icon or https in the address bar.

In the US, the FBI warned on 25 April 2024 that an app being available in an app store does not necessarily mean it is a legal service that complies with federal requirements.

In the UK, the FCA tells you to reach its Firm Checker through the web address it publishes, fca.org.uk/consumers/fca-firm-checker, and never through links in emails or on company websites (guidance last updated 19 January 2026).

When the answer is that you cannot verify it

Do not deposit anything. "I could not confirm it" is a complete answer, and no amount of urgency from the other side changes it. If you have already deposited and now cannot verify the platform, stop adding money and go to the first hour, day and week before you do anything else.

Protect the Wallet: Read, Revoke, Repeat

A self-custody wallet takes the platform out of the picture, and with it the platform's own checks. What is left is you, your device and whatever you sign. Three habits follow, and the mechanics behind each one live on the pages linked from this section.

Read the transaction on the device, not in the browser

If you use a hardware wallet, read the destination address, the amount and the action on the device's own screen, and compare them with what you meant to do before you press confirm. Do this every time, including on a site you have used for months.

If the device shows only a hash or a string of raw data and asks you to enable blind signing, decline the request. You cannot check what you cannot read, and our transaction signing hygiene guide explains clear signing, blind signing and the short routine to run on every request.

Choosing a device, setting it up and testing the backup before you rely on it are covered in our hardware wallet security guide.

Revoke what you no longer use

The approvals service revoke.cash explains that a token approval gives a smart contract permission to spend your tokens on your behalf, and that the contract can then spend them at any time (explainer read on 5 October 2026). The approvals service also describes scammers tricking people into approving a contract they control, so they can take the money directly from the wallet (revoke.cash explainer, read on 5 October 2026).

List the token and NFT approvals your wallet has granted, and revoke the ones you no longer use. Expect each revoke to ask for a signature and a gas fee, like any other transaction, and run it from the same device you use to approve. The signing hygiene guide linked above walks through the tool step by step. It also explains how off-chain permits differ from on-chain approvals.

The daily habit

• Bookmark the sites you use and reach them only through the bookmark, never through a search advert, an emailed link or a link in a message.
• Split your wallets. Keep a small balance in a wallet you connect to new sites, and keep savings in a separate wallet that never connects to anything you have not used before.
• Type your recovery phrase nowhere but the device itself, during a recovery. Treat any website, app, form, chat or caller that asks for it as the scam, whatever name it uses.
• Check the whole address before you send, not only the first and last few characters; how lookalike addresses get planted in your history is covered in our wallet drainer guide.

The longer version of these habits, with the reasons behind each and the backup routine that goes with them, is in our operational security guide.

Recognise the Pitch: Sentences That Signal a Scam

In the US, the FTC notes that scammers are using some tried and true scam tactics, only now demanding payment in cryptocurrency (guidance last modified 10 February 2025). Old tactics mean familiar sentences, and learning the sentences is worth more than learning scam names. Each pattern below comes with what a regulator or police body says about it.

Pig butchering, the long con that strings several of these sentences together, is set out stage by stage in our guide to pig butchering scams, including what to say to someone who is in the middle of one.

The returns pitch

It can sound like this: “Guaranteed 2% a day, and the plan pays more the more you put in”.

In the US, the FTC says only scammers will guarantee profits or big returns (guidance last modified 10 February 2025). In the US, the FTC advises against trusting anyone who promises you can quickly and easily make money in the crypto markets (guidance last modified 10 February 2025).

In the US, the CFTC warns that many scam trading sites offer investment plans whose promised returns rise with the amount you deposit, and calls the upgrades ploys to coax more money out of victims (April 2023 brochure). In the US, the CFTC says there are no risk-free investments in crypto assets (April 2023 brochure).

In the UK, the National Crime Agency tells investors not to believe exceptionally high returns on an investment over a short period of time (information sheet last modified 23 September 2026).

The verification deposit

It can sound like this: “Your withdrawal is approved, but to release it you must deposit 20% of the balance to verify your account”.

In the UK, the FCA warns that crypto scam adverts often lead to professional-looking websites where fraudsters may manipulate software to fake prices and investment returns (guidance last updated 16 February 2026). In the UK, the FCA warns that you may not realise you have invested in a scam until you try to sell (guidance last updated 16 February 2026).

On a fake platform, the balance is a number the website chose to show you. A request to send more money before you can take any out is the moment that number is tested. In the US, the FTC warns that on the fake investment websites scammers steer people to, you will not be able to withdraw your money at all, or only if you pay high fees (guidance last modified 10 February 2025).

The tax to withdraw

It can sound like this: “Before we can pay out, you must settle the capital gains tax on your profit through our compliance desk”.

In the UK, the National Crime Agency warns crypto investors not to be reassured by a small first withdrawal, because further withdrawals may then be blocked by high fees or taxes (information sheet last modified 23 September 2026).

In the US, the CFTC says it never collects taxes and does not ask trading platforms or brokers to collect funds from customers on the government's behalf (advisory read on 5 October 2026). In the US, the CFTC says people typically pay the tax due on trading when they file their income tax returns (advisory read on 5 October 2026).

The support agent

It can sound like this: “This is wallet support, your account has been flagged, and you need to confirm your recovery phrase so we can secure it”.

Hang up or close the chat, then contact the company through the address you would have used anyway. Do not read out a code and do not install software the caller names. Do not type your recovery phrase into anything they send you.

In the US, the FTC says that in a business or government impersonator scam, the scammer pretends to be someone you trust, to get you to buy cryptocurrency and send it to them (guidance last modified 10 February 2025).

In the US, the FBI said on 20 July 2026 that the IC3 has no social media presence and never contacts people directly by phone, email, social media, phone apps or online chat. In the US, the FBI said on 20 July 2026 that if more information is needed about an IC3 complaint, people are contacted by FBI employees from local field offices or other law enforcement officers, not by the IC3 itself.

The recovery expert

It can sound like this: “We have traced your stolen crypto to an exchange wallet, and for a 10% retainer our legal team can have it frozen and returned to you”.

In the UK, the FCA warns that recovery room scammers approach people who have already been scammed, offering to get their money back for an upfront fee, and that the people behind the original scam may run the recovery room themselves (guidance last updated 19 January 2026).

In the US, the FBI stated on 20 July 2026 that the IC3 will never ask for payment to recover lost funds. In the US, the FBI stated on 20 July 2026 that the IC3 will never refer anyone to a company that charges for recovery.

In the US, the CFTC says it will never tell you that your money has been recovered but that you must pay a fee or a tax to get it back (advisory read on 5 October 2026). In the US, the CFTC says you should never pay an upfront fee for fraud recovery services (advisory read on 5 October 2026).

If It Has Happened: The First Hour, Day and Week

Work in this order: stop further losses first, then keep the evidence, then report. The full version of this section, with a reporting table and the signs of a recovery scam, is in our guide to what to do after a crypto scam.

The first hour

• 1. Stop paying and stop signing. Send nothing more, whatever reason you are given, including a fee or a tax said to release your balance.
• 2. If money left your bank account or card, call your bank now. Ask for the payment to be stopped or recalled, and say that it was a scam.
• 3. If a wallet was involved, protect what is left. Revoke any approval you did not mean to give, using the routine in our signing hygiene guide, and if you typed or shared your recovery phrase anywhere, move what remains to a new wallet created on a clean device.
• 4. Tell the exchange the money left from. Report the transaction as fraud through the support channel in the exchange's own app or website, not through a number or link the scammer gave you.
• 5. Cut contact. Do not tell the scammer what you are doing and do not argue; block them, but keep the messages as evidence.

In the UK, calling 159 connects customers of more than 99% of UK retail bank current accounts to their own bank, according to Stop Scams UK, which lists 159 among its programmes (page read on 5 October 2026). In the UK, Stop Scams UK says the 159 short code cannot be spoofed (page read on 5 October 2026).

The first day

• Save the evidence. Keep the transaction IDs, the wallet addresses you sent to, the website addresses and app names, the usernames and phone numbers involved, and screenshots of the chats, each with its date.
• Write the timeline down while you remember it: the first contact, each payment, each promise and each new person who joined the conversation.
• Report it to the police or the national reporting service for where you live, using the summary in the next section, and keep the reference number you are given.

A clear timeline lets whoever reads your report see the scam in the order it happened, rather than as a pile of screenshots. It also helps you recognise the second approach when it comes.

The first week

• Expect a second approach. Treat any call or message offering to get your money back as the next stage of the scam, whoever it claims to be, and do not pay it anything.
• Secure the accounts around the loss. Change passwords and two-factor settings on any exchange, email or messaging account you used while the scam was running.
• Keep the records for your tax return. Whether a scam loss counts for tax depends on where you live, so check with your tax authority or an adviser; our crypto tax guide covers the records to keep and the general rules by jurisdiction.

In the UK, the FCA warns that people who have already invested in a scam may be targeted again or have their details sold to other criminals (guidance last updated 16 February 2026). In the UK, the FCA says a follow-up scam may include an offer to get your money back, or to buy back the investment, after you pay a fee (guidance last updated 16 February 2026).

Where to Report a Crypto Scam, by Jurisdiction

This is the short version, with one line per reporting route. The full table, including what each body does and does not do with your report, is in our reporting table for crypto scam victims.

• England, Wales and Northern Ireland: Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025, takes reports at reportfraud.police.uk or on 0300 123 2040 (GOV.UK news story, 4 December 2025).
• Scotland: in Scotland, report to Police Scotland, which takes non-emergency reports by phone on 101, online or in person (Police Scotland, read 5 October 2026).
• UK, after the police report: in the UK, the FCA asks scam victims to report to Report Fraud, or to Police Scotland on 101 if they live in Scotland, and then to report the scam to the FCA (guidance last updated 19 January 2026).
• United States: in the US, the FBI's Internet Crime Complaint Center (IC3) at ic3.gov describes itself as the central hub for reporting cyber-enabled crime, and says complaints may be referred to federal, state, local or international law enforcement but that it cannot respond directly to every submission (site read 5 October 2026).
• United States, other bodies: in the US, the FTC lists ReportFraud.ftc.gov, the CFTC, the SEC, the IC3 and the crypto exchange you used to send the money as places to report crypto fraud (guidance last modified 10 February 2025).
• European Union: in the EU, ESMA tells victims to stop all contact with the fraudsters, report the case to local law enforcement such as the police, and inform their national competent authority (page read 5 October 2026).

In the UK, the National Cyber Security Centre directs fraud victims in England, Wales and Northern Ireland to Report Fraud, and victims in Scotland to Police Scotland on 101 (guidance read on 5 October 2026). Use the route for where you live, not for where the scammer said they were.

Reporting a message before it costs you anything

In the UK, the National Cyber Security Centre runs a reporting service for suspicious emails and says it acts on every message, though it cannot tell you the outcome (guidance read on 5 October 2026). Use the NCSC's email reporting service for suspicious messages, not to report a crime: a loss still goes to the police route for where you live, and the address to forward to is on the NCSC page in the sources.

In the UK, most mobile networks let customers forward a suspicious text to 7726 free of charge, so the provider can investigate the sender and block it if it is malicious (NCSC guidance, read on 5 October 2026).

What No Page Can Do for You

No guide, this one included, can reverse a payment, freeze a wallet or make a scammer pay you back. What a guide can do is help you avoid a second loss. It can also help you file a report complete enough to be useful to whoever reads it.

Reporting is not recovery

In the UK, the FCA says it cannot help you get your money back after a scam (guidance last updated 19 January 2026). In the UK, the FCA says it looks into every report it receives and that a report could help protect others (guidance last updated 19 January 2026).

In the EU, ESMA says it is not able to deal with investment fraud cases and cannot assist individuals with their matter (page read on 5 October 2026).

In the US, the CFTC states that it does not represent individual victims in fraud recovery efforts and does not take possession of customer funds (advisory read on 5 October 2026).

Report the scam anyway, because a report is how a pattern becomes visible to the people who can act on it. Keep the reference number too, because your bank, your exchange or the police may later ask what you did. Just do not expect the report itself to bring the money back.

Offers to get your money back

Treat anyone who contacts you offering to get money back for a fee as following the recovery pattern in the recovery expert section above, whoever they claim to be. That includes callers who know exactly how much you lost and when. Knowing the amount and the date proves nothing, because whoever took the money knows both.

If you decide you want legal advice, find the lawyer yourself through the professional body in your own country, never through someone who contacted you first. In the EU, ESMA lists approaching a lawyer to consider legal action against the firm among the steps victims can take (page read on 5 October 2026).

A scam is not a platform failure

If the platform you used was a real business that failed, rather than a fake one, the questions are different. They are about who holds the assets, whether an insolvency process is running, and how claims are made and paid. Our platform failure and recovery guide covers that case.

Conclusion

Most of the protection on this page happens before anything leaves your wallet, and most of it costs nothing. Ask who is asking, and check the answer through a channel you chose yourself. Ask what they want you to sign or send, and remember that a crypto payment is usually final. Ask why it has to happen now, and give every request a day.

When a platform wants a deposit, run the five questions in order. Find the firm on the register for your country and for the activity it offers. Compare every detail you were given with the register entry, and read what the entry does and does not cover. Look for warnings without treating their absence as proof, and check that the website and the app are what they claim to be. If any answer fails, or you cannot get one, do not deposit; that answer needs no further justification.

When the risk is a signature rather than a payment, read the transaction on the device and not in the browser. Decline anything the device can only show as unreadable data. Revoke the approvals you no longer use, and type your recovery phrase nowhere but the device itself. The daily habits are small on purpose: a bookmark, a second wallet, and a whole address checked before you send.

Learn the sentences rather than the scam names. A fixed daily return, a deposit to verify a withdrawal and a tax to release a balance are the same request in different words. So are a support agent who wants your recovery phrase and an expert who offers to get your money back for a fee. The regulators and police bodies quoted on this page describe each of these patterns, and each section above gives you their words with a date.

If it has already happened, the order matters more than the speed. Stop further losses, protect what is left, keep the evidence and report to the body for where you live. Then expect a second approach, and treat it as a second scam. Reporting is not recovery, and no page can promise you the money back. A complete report and a refusal to pay anyone who calls you afterwards are both still within your control. If you are helping someone else through it, the same order applies, and the first thing to agree with them is that nothing more gets sent while you check.

Read every figure about scam losses as a minimum. The 2025 figure that Chainalysis measured on-chain is a floor, which Chainalysis said on 13 January 2026 it expects to rise as more scam wallets are identified. Every complaint-based figure counts only the people who chose to report. The scale is a reason to take the three questions seriously, not a reason to panic.

The pages linked from each section go further than this one on purpose. One covers verifying a platform, one the pig butchering long con and one what to do after a scam, while the wallet pages cover drainers, signing and hardware. For the security routine underneath all of them, start with our operational security guide. Come back here whenever a message, a call or a new friend asks you for something you cannot take back.

Sources

Every primary source below was read on 5 October 2026. Each entry names the document, the date it was published or last updated where the page shows one, and what it supports on this page. A figure appears once on this site; where a figure lives on another page, that page is named instead.

• Chainalysis, 2026 Crypto Crime Report, scams chapter, published 13 January 2026 — the at-least-$14-billion floor for 2025, the projection, and the dominant scam categories by volume. chainalysis.com
• US Federal Trade Commission, prepared statement to the Joint Economic Committee, 25 March 2026 — reported fraud losses as a fraction of actual losses. ftc.gov
• FTC Consumer Advice, What To Know About Cryptocurrency and Scams, shown as May 2022 on the page and last modified 10 February 2025 according to its metadata — irreversible payments, payment demands, returns, withdrawals from fake investment sites, impersonators, dating and investment advice, tried and true tactics, and where to report in the US. consumer.ftc.gov
• FCA, Protect yourself from scams, last updated 19 January 2026 — the warning-sign questions and reaching the Firm Checker only through the address the FCA publishes. fca.org.uk
• FCA, Crypto investment scams, last updated 16 February 2026 — searching the register, what to do when a firm is not on it, the Ombudsman and compensation scheme position, faked prices and returns, and follow-up scams. fca.org.uk
• FCA, Report a scam, last updated 19 January 2026 — the reporting order and what the FCA cannot do. fca.org.uk
• FCA, Recovery room scams, last updated 19 January 2026 — who recovery room scammers approach, the upfront fee, and who may run them. fca.org.uk
• FCA, Fake FCA communications, last updated 12 May 2026 — spoofed switchboard numbers, messaging apps, and what the FCA never asks for. fca.org.uk
• FCA, How to check a firm or individual is authorised, last updated 22 September 2026 — registered against authorised, anti-money laundering registration of crypto firms, where FCA warnings appear, and the Warning List. fca.org.uk
• National Crime Agency, Crypto Dream, Scam Nightmare information sheet, PDF last modified 23 September 2026 — moves to encrypted apps, instructions to ignore bank warnings, high returns, and fees or taxes on withdrawal. The sheet still names Action Fraud as the reporting route; Report Fraud replaced it on 4 December 2025, as the GOV.UK entry below records. nationalcrimeagency.gov.uk
• CFTC, Beware Imposters Posing as CFTC Officials, undated advisory — official email addresses, what the CFTC never asks for, taxes, trading licences, recovery fees and what the CFTC does not do for victims. cftc.gov
• CFTC, 10 Signs of a Scam Crypto or Forex Trading Website, April 2023 brochure — where trading frauds begin, bank transfers, returns plans, registration, domain age and searching for warnings. cftc.gov
• ESMA, public statement on the end of the MiCA transitional period, ESMA75-113276571-1710, 23 June 2026 — the 1 July 2026 end date and checking the ESMA register. esma.europa.eu
• ESMA, Investor Corner: Frauds and scams related to ESMA logo and ID, undated — what victims should do, what ESMA cannot do, legal action, and the absence of a warning. esma.europa.eu
• FBI Internet Crime Complaint Center, home page, undated — the IC3's role, the referral of complaints and the limits on replies. ic3.gov
• FBI, public service announcement I-072026-PSA, 20 July 2026 — impersonation of the IC3, no payment for recovery, and no direct contact. ic3.gov
• FBI, public service announcement I-061019-PSA, 10 June 2019 — https and the lock icon on phishing sites. ic3.gov
• FBI, public service announcement I-042524-PSA, 25 April 2024 — app-store availability is not legality. ic3.gov
• GOV.UK, Serious Fraud Office news story, Report Fraud: New service from City of London Police, 4 December 2025 — the replacement of Action Fraud, the reporting address and the unchanged phone number. gov.uk
• National Cyber Security Centre, Report a scam email, page dated 26 November 2021 and reviewed 5 September 2022, with later edits that name Report Fraud — the email reporting service and the reporting routes for England, Wales and Northern Ireland and for Scotland. ncsc.gov.uk
• National Cyber Security Centre, Report a scam text message, page dated 26 November 2021 and reviewed 5 September 2022 — forwarding suspicious texts to 7726. ncsc.gov.uk
• Police Scotland, How to report a crime, undated — 101 and the other ways to report in Scotland. scotland.police.uk
• Stop Scams UK, 159 phone number, no date on the page and modified 15 September 2026 according to its metadata — the 159 short code and its reach across UK bank current accounts. stopscamsuk.org.uk
• revoke.cash, What are token approvals?, undated explainer — what an approval permits and how approval scams work. revoke.cash
• Ledger support, Global-e Incident to Order Data, January 2026, last updated 13 May 2026 — the Global-e notification of 5 January 2026 about accessed order data, and Ledger's work with Global-e to notify affected customers. support.ledger.com
• Trezor blog, Recent customer data exposed in shipping provider incident, posted 13 August 2026 and updated 4 September 2026 — the ShipMonk breach, the securing of ShipMonk's systems and the emails sent directly to every affected customer. trezor.io
• Trezor blog, Security incident at Brevo, our third-party email provider, posted 10 September 2026 and updated 17 September 2026 — the fake security alert of 9 September 2026, the DNS-level takedown, within 20 minutes, of the domain the email's link ran through, the suspended Brevo account and the contact with every recipient. trezor.io
• Keystone, home page, undated — the maker's own description of its device. keyst.one
• How drainers work, and the drainer figures this page does not repeat, are on our wallet drainer and phishing defence guide.
• What each signature type grants, and how to revoke it, is on our transaction signing hygiene guide.
• Choosing, setting up and testing a device is on our hardware wallet security guide.
• Working out who is likely to target you is on our threat modelling guide.
• The common mistakes that lead to losses, scams among them, are on our crypto mistakes to avoid page.
• When a real platform fails rather than a fake one, see our platform failure and recovery guide.
• The records to keep for your tax return, and the general crypto tax rules by jurisdiction, are on our crypto tax guide.

Frequently Asked Questions

How can I tell whether a crypto platform is legitimate before I deposit?

Run five checks before any deposit. In the UK, the FCA tells you to search its Financial Services Register by the firm's name or reference number and to check that the contact details match the ones you were given (guidance last updated 16 February 2026). In the EU, ESMA invites crypto clients to check whether their provider is authorised in the ESMA register (statement of 23 June 2026). Then look for warnings, test the website and the app, and do not deposit if any check fails or cannot be completed.

Does registration with the FCA mean a crypto platform is safe?

No. In the UK, the FCA says firms must be registered with it, for anti-money laundering purposes, to run crypto exchanges, crypto ATMs or custodian wallet services, and that a firm which is registered but not authorised cannot provide regulated products and services that need authorisation (guidance last updated 22 September 2026). In the UK, the FCA also says most crypto-related activities are not regulated (guidance last updated 16 February 2026). A registration tells you who the firm is, not that your money is protected.

What should I do in the first hour after sending crypto to a scammer?

Stop sending money and stop signing anything, whatever fee or tax you are told will release your balance. If money left your bank account or card, call your bank at once; in the UK, calling 159 connects customers of more than 99% of UK retail bank current accounts to their own bank, according to Stop Scams UK (page read 5 October 2026). If a wallet was involved, revoke stray approvals, move what is left if your recovery phrase was exposed, and tell the exchange the money left from.

Can a crypto payment to a scammer be reversed?

Generally not. In the US, the FTC warns that cryptocurrency payments typically cannot be reversed, and that you can usually get the money back only if the person you paid sends it back (guidance last modified 10 February 2025). Anyone who later offers to reverse the payment for a fee should be treated as a second scam.

Where do I report a crypto scam in the UK?

In England, Wales and Northern Ireland, report it to Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040 (GOV.UK news story, 4 December 2025). In Scotland, report it to Police Scotland on 101 (NCSC guidance, read 5 October 2026). In the UK, the FCA asks scam victims to report to Report Fraud, or to Police Scotland if they live in Scotland, and then to report the scam to the FCA (guidance last updated 19 January 2026).

Where do I report a crypto scam in the US or the EU?

In the US, the FBI's Internet Crime Complaint Center at ic3.gov describes itself as the central hub for reporting cyber-enabled crime (site read 5 October 2026), and the FTC also lists ReportFraud.ftc.gov, the CFTC, the SEC and the exchange you used (guidance last modified 10 February 2025). In the EU, ESMA tells victims to report to local law enforcement such as the police and to inform their national competent authority (page read 5 October 2026).

Someone says they can get my lost crypto back for a fee. Is that genuine?

Treat it as a second scam. In the UK, the FCA warns that recovery room scammers approach people who have already been scammed, offering to get their money back for an upfront fee (guidance last updated 19 January 2026). In the US, the FBI stated on 20 July 2026 that the IC3 will never ask for payment to recover lost funds, and the CFTC says never to pay an upfront fee for fraud recovery services (advisory read 5 October 2026).

What does it mean if a platform wants a tax or fee before I can withdraw?

It is a warning sign, and you should not pay it. In the UK, the National Crime Agency warns crypto investors not to be reassured by a small first withdrawal, because further withdrawals may then be blocked by high fees or taxes (information sheet last modified 23 September 2026). In the US, the CFTC says it does not ask trading platforms or brokers to collect funds from customers on the government's behalf (advisory read 5 October 2026).

Will a hardware wallet protect me from crypto scams?

Not on its own. A hardware wallet cannot stop you approving a malicious request yourself, and revoke.cash describes scammers tricking people into approving a contract they control so they can take tokens directly from the wallet (explainer read 5 October 2026). Read the address, the amount and the action on the device before you confirm, decline anything it shows only as unreadable data, and never type your recovery phrase into a website, an app or a chat.

Would a real support agent or regulator ever ask for my recovery phrase?

Treat any such request as the scam itself. In the US, the CFTC says it has no digital wallet and would never ask for your private keys or seed phrases (advisory read 5 October 2026), and the FBI says the IC3 never contacts people directly by phone, email, social media, apps or online chat (20 July 2026). In the UK, the FCA warns that scammers can make its real switchboard numbers appear in your caller ID (guidance last updated 12 May 2026).

How much money is lost to crypto scams each year?

At least $14 billion was received on-chain by crypto scams in 2025, according to Chainalysis, which reported on 13 January 2026 that the total could exceed $17 billion as more scam wallets are identified. The larger number is a projection, not a count. In the US, the FTC told Congress on 25 March 2026 that the fraud losses reported to it are only a fraction of what American consumers actually lose, because not everyone who loses money to a scam reports it to the FTC or its data sources.

Financial Disclaimer

This content is not financial advice. All information provided is for educational purposes only. Cryptocurrency investments carry significant investment risk, and past performance does not guarantee future results. Always do your own research and consult a qualified financial advisor before making investment decisions.