Crypto scams in the UK: how to spot them and what to do

You post about a problem, or search for help, and someone "from support" gets in touch: a reply on X or Reddit, a direct message, an email, or a chat window on a lookalike site. They are friendly, quick and urgent, and before long they need you to "verify", "sync" or "validate" your wallet.

• They contacted you first
• They ask for your recovery phrase, or to share your screen
• There's a deadline, a threat or a "frozen" account

Stop replying. Go to the maker's or exchange's website yourself, by typing the address, and use their help pages. Real support never contacts you first through social media and never needs your words.

A caller says they're from your wallet maker, your exchange, your bank or even the police. Your account has been hacked, they say, and you need to move your crypto to a "safe wallet" right now, or read out your recovery phrase so they can "secure" it.

• An unexpected call about a security problem
• Pressure to act before you hang up
• A "safe wallet" address you didn't create

Hang up. Wallet makers don't phone their customers. If you're worried about an account, contact the company through its own website or app, from a different phone if you can.

Lookalike versions of wallet apps and websites appear in search ads, app stores and links. They look identical to the real thing, then ask you to "restore" your wallet by typing in your recovery phrase on your computer or phone.

• You arrived from an ad, a link or a message
• The web address is slightly different
• It asks for your words on a computer or phone

Download wallet apps only from the maker's own website, typed in yourself and bookmarked. If you've already typed your words in, treat the wallet as compromised and move what's left to a new wallet with a new recovery phrase straight away.

A message claims there's a security problem, a compulsory update, a new regulation or a frozen account. It looks official and links to a page that asks for your recovery phrase. Many are sent to email addresses exposed in past data leaks, so they can use your real name.

• Urgent: "act within 24 hours"
• A link or button to "verify" or "update"
• Any request for your words

Don't click or reply. Check anything that worries you on the company's own website. Forward scam emails to report@phishing.gov.uk and scam texts to 7726.

A well-printed letter arrives with the right logo, claiming a security problem or a compulsory update. It asks you to scan a QR code or visit a website and enter your recovery phrase. Like the emails, these are often sent to addresses exposed in data leaks.

• A letter about your crypto you weren't expecting
• A QR code or web address to visit
• Any request for your words

Don't scan or visit anything. A genuine wallet maker will never ask for your recovery phrase by post. Report the letter to the company it claims to be from, using the contact details on their website, then destroy it.

Fake accounts impersonate wallet makers, exchanges and well-known figures, sometimes with convincing AI-generated videos. They promise giveaways ("send some crypto, get double back"), or point you to fake apps and support pages.

• Anything that doubles your money
• Brand-new or lookalike accounts
• Comments full of "it worked for me"

Ignore it. No genuine company or person gives away crypto in return for you sending some first. Report the account to the platform.

A device bought from a marketplace or reseller arrives already set up, or with a recovery sheet that already has words printed or written on it. Whoever chose those words can empty the wallet at any time.

• Words already on the recovery card
• The device doesn't ask you to set it up from scratch
• Damaged, opened or resealed packaging

Don't use it. Buy from the maker or an authorised reseller, and only trust a recovery phrase you watched your own device create.

A scammer sends you a tiny amount from an address made to look almost identical to one you use, matching the first and last few characters. They're hoping that next time you copy an address from your transaction history, you'll pick theirs.

• Tiny, unexpected incoming transactions
• Addresses that match only at the start and end

Never copy an address from your transaction history. Get it fresh from your wallet app, check the whole address on your device's screen, and send a small test amount first.

Malware on your computer or phone watches for crypto addresses being copied, and swaps in the attacker's address as you paste. At a glance it looks right, so the transfer goes to them.

• The pasted address differs from the one you copied
• Your device's screen shows a different address from your computer

Always check the full address on your hardware device's screen before you approve. It is the one screen malware can't change.

A website, often a fake mint, airdrop or "claim" page, asks you to sign something. It isn't a payment: it gives a contract permission to move your tokens. Once signed, a drainer can empty them, sometimes days later.

• "Claim your free tokens" sites
• Requests to approve or sign that you don't understand
• Your device can't show what you're signing in plain terms (blind signing)

Don't sign anything you can't read and understand on your device's screen. Keep long-term holdings in a wallet you never connect to websites, and review and revoke old approvals with a reputable tool.

Unknown tokens or free NFTs appear in your wallet, often with a website name in the title. Tiny "dust" amounts can also be sent to track you. The link leads to a drainer or a fake support page.

• Tokens or NFTs you didn't buy
• A web address in the token's name or picture

Ignore them. Don't visit the website, try to sell them or interact with them. Hide them in your wallet app if you can.

Some networks let a sender attach a short note to a transaction. Scammers send tiny amounts with notes like "reward ready to claim" or "security alert, visit…", hoping you'll follow the link.

• A message or memo on a payment you weren't expecting
• A website to visit, or a reward to claim

Ignore it. A message inside a transaction is just text anyone can write. Never follow it.

A criminal convinces your mobile network to move your number to their SIM. Your texts, including security codes, now go to them, giving them a way into your email and exchange accounts.

• Your phone suddenly loses signal
• "SIM changed" or "number transferred" messages you didn't request

Use an authenticator app or a security key, not text messages, for your exchange and email accounts. Ask your network about extra account security. If it happens, call your network immediately from another phone.

Someone builds a friendship or relationship online over weeks, then introduces a crypto platform where they've "made a fortune". The early profits on screen are fake, and the money can never be withdrawn. These are sometimes called pig-butchering scams.

• A new online contact who steers talk to investing
• A platform you can't find independently
• Fees or "taxes" demanded before you can withdraw

Stop sending money. Check any investment firm against the FCA Warning List before you pay. Talk to someone you trust, and report it.

After a loss, often after you've posted about it, someone offers to recover your crypto for a fee up front, or for your recovery phrase. It's the same people, or their friends, taking a second bite.

• They found you, not the other way round
• Fees up front and "guaranteed" results
• Claims of special "tracing" or hacking access

Don't pay. Report the original scam, and read I've lost my recovery phrase. What now? for what can genuinely be recovered.

Instead of hacking, criminals target the person: threats, home invasions or kidnapping, to force a transfer. There have been cases in the UK as well as abroad. Victims are usually chosen because they've been visible, talking about holdings online, or their details were exposed in a data leak.

• Don't discuss your holdings in public or online
• Keep your home address off crypto-linked accounts and deliveries where you can
• Use a setup where no single device or phrase unlocks everything, such as a passphrase or multisig

Your safety comes first. Do what keeps you safe, and report it to the police on 999 as soon as you can. A setup that needs keys kept in different places means you physically can't hand over everything, which also makes you a less attractive target.