Crypto Scams and Phishing: How They Work and How to Spot Them

Nearly every crypto scam does one of two things: it gets you to send coins to the wrong place, or it gets you to sign something that lets someone else take them. Phishing is the second kind - a page, message or email imitating something you trust for just long enough to collect a signature or a seed phrase. Since a confirmed blockchain transaction cannot be undone by anyone, spotting the attempt is the entire defence.

What the common ones look like

• The fake front door. A paid search result or a link in a reply leads to a copy of the Uniswap or MetaMask site. It behaves normally right up to the moment it asks you to sign.
• The helpful stranger. You post a problem publicly and a direct message arrives within minutes offering support, then asks for your seed phrase to "restore" the wallet. No real support team ever needs it.
• The claim page. An airdrop or rescue site puts a signature request in front of you that is in fact a token approval or an NFT transfer.
• Address poisoning. A dust payment lands from an address whose first and last characters match one you use, hoping you copy the wrong one out of your history next time.

The habit that catches most of them

Scams need you in a hurry. The deadline, the limited allocation, the expiring name - all of it exists to stop you checking. So add a pause: nothing gets signed in the first minute. Reach every app by typing its address or using your own bookmark, never a link from a message, and read what the wallet request actually says before confirming. If it talks about approving or transferring when you only meant to log in, close it.

What makes you a hard target

Keep savings on a hardware wallet such as a Ledger that never connects to websites, and browse with a second wallet holding only what you could stand to lose. Write the seed phrase on paper rather than in a photo or a note, and take as settled that nobody legitimate will ever ask for it. With an unfamiliar address, send a small test payment first and wait for it to arrive.

If you have ever used a DeFi app, start with the permissions already sitting in your wallet - revoking old token approvals walks through it. Lookalike names are their own trick, covered in the guide to homoglyphs.