--- title: Crypto scams in the UK: how to spot them and what to do — KeyCompass description: The crypto scams targeting UK holders, from fake support and phishing letters to address poisoning, drainers and wrench attacks, and what to do if you're hit. category: Scams published: 2026-10-12 checked: 2026-10-12 featured: no --- # Crypto scams in the UK: how to spot them and what to do > Almost every crypto scam ends with one of two requests: type in your recovery phrase, or send > your crypto somewhere. Here is how each one gets you there, and how to stop it. :::answer The scams aimed at people holding their own crypto fall into three groups. Some try to get your recovery phrase, through fake support, fake apps and phishing messages or letters. Some trick you into sending crypto to the wrong place, through lookalike addresses, malware and malicious approvals. And some target your accounts or you personally, from SIM swaps to fake investment schemes and physical threats. The protection is mostly the same habits: never type your recovery phrase anywhere but your device, check every address on the device's screen, and treat anyone who contacts you first as a scammer until proven otherwise. ::: Pick the scam you want to know about from the tabs in each section. On a phone, tap a scam to open it. Each one follows the same pattern: how it works, how to spot it, and what to do. - The one rule - Scams that go after your recovery phrase - Scams that trick you into sending crypto - Scams that target your accounts, or you - How to protect yourself: a checklist - If you've been scammed ## The one rule :::rule **Nobody legitimate will ever ask for your recovery phrase.** Not your wallet maker, not your exchange, not your bank, not the police, not "support", and not KeyCompass. Not by phone, email, letter, website, app or message. If anyone asks for it, in whole or in part, it is a scam. ::: Most of the scams below are elaborate ways of getting you to break that rule without noticing. The rest try to get you to send crypto yourself, which is why the second habit matters just as much: check every address on your device's own screen before you approve anything. ## Scams that go after your recovery phrase :::tabs Scams that go after your recovery phrase ::tab Fake support | Someone "from support" contacts you first ::part How it works You post about a problem, or search for help, and someone "from support" gets in touch: a reply on X or Reddit, a direct message, an email, or a chat window on a lookalike site. They are friendly, quick and urgent, and before long they need you to "verify", "sync" or "validate" your wallet. ::part How to spot it - They contacted you first - They ask for your recovery phrase, or to share your screen - There's a deadline, a threat or a "frozen" account ::part What to do Stop replying. Go to the maker's or exchange's website yourself, by typing the address, and use their help pages. Real support never contacts you first through social media and never needs your words. ::tab Phone calls | "Your account is at risk, move your funds now" ::part How it works A caller says they're from your wallet maker, your exchange, your bank or even the police. Your account has been hacked, they say, and you need to move your crypto to a "safe wallet" right now, or read out your recovery phrase so they can "secure" it. ::part How to spot it - An unexpected call about a security problem - Pressure to act before you hang up - A "safe wallet" address you didn't create ::part What to do Hang up. Wallet makers don't phone their customers. If you're worried about an account, contact the company through its own website or app, from a different phone if you can. ::tab Fake apps and websites | Lookalikes in search ads and app stores ::part How it works Lookalike versions of wallet apps and websites appear in search ads, app stores and links. They look identical to the real thing, then ask you to "restore" your wallet by typing in your recovery phrase on your computer or phone. ::part How to spot it - You arrived from an ad, a link or a message - The web address is slightly different - It asks for your words on a computer or phone ::part What to do Download wallet apps only from the maker's own website, typed in yourself and bookmarked. If you've already typed your words in, treat the wallet as compromised and move what's left to a new wallet with a new recovery phrase straight away. ::tab Emails and texts | "Security alert" messages with a link ::part How it works A message claims there's a security problem, a compulsory update, a new regulation or a frozen account. It looks official and links to a page that asks for your recovery phrase. Many are sent to email addresses exposed in past data leaks, so they can use your real name. ::part How to spot it - Urgent: "act within 24 hours" - A link or button to "verify" or "update" - Any request for your words ::part What to do Don't click or reply. Check anything that worries you on the company's own website. Forward scam emails to report@phishing.gov.uk and scam texts to 7726. ::tab Letters in the post | Printed letters with a QR code ::part How it works A well-printed letter arrives with the right logo, claiming a security problem or a compulsory update. It asks you to scan a QR code or visit a website and enter your recovery phrase. Like the emails, these are often sent to addresses exposed in data leaks. ::part How to spot it - A letter about your crypto you weren't expecting - A QR code or web address to visit - Any request for your words ::part What to do Don't scan or visit anything. A genuine wallet maker will never ask for your recovery phrase by post. Report the letter to the company it claims to be from, using the contact details on their website, then destroy it. ::tab Social media and giveaways | "Send 1, get 2 back" ::part How it works Fake accounts impersonate wallet makers, exchanges and well-known figures, sometimes with convincing AI-generated videos. They promise giveaways ("send some crypto, get double back"), or point you to fake apps and support pages. ::part How to spot it - Anything that doubles your money - Brand-new or lookalike accounts - Comments full of "it worked for me" ::part What to do Ignore it. No genuine company or person gives away crypto in return for you sending some first. Report the account to the platform. ::tab Pre-set-up devices | Words already on the card ::part How it works A device bought from a marketplace or reseller arrives already set up, or with a recovery sheet that already has words printed or written on it. Whoever chose those words can empty the wallet at any time. ::part How to spot it - Words already on the recovery card - The device doesn't ask you to set it up from scratch - Damaged, opened or resealed packaging ::part What to do Don't use it. Buy from the maker or an authorised reseller, and only trust a recovery phrase you watched your own device create. ::: ## Scams that trick you into sending crypto :::tabs Scams that trick you into sending crypto ::tab Address poisoning | Lookalike addresses planted in your history ::part How it works A scammer sends you a tiny amount from an address made to look almost identical to one you use, matching the first and last few characters. They're hoping that next time you copy an address from your transaction history, you'll pick theirs. ::part How to spot it - Tiny, unexpected incoming transactions - Addresses that match only at the start and end ::part What to do Never copy an address from your transaction history. Get it fresh from your wallet app, check the whole address on your device's screen, and send a small test amount first. ::tab Clipboard hijackers | Malware that swaps the address you paste ::part How it works Malware on your computer or phone watches for crypto addresses being copied, and swaps in the attacker's address as you paste. At a glance it looks right, so the transfer goes to them. ::part How to spot it - The pasted address differs from the one you copied - Your device's screen shows a different address from your computer ::part What to do Always check the full address on your hardware device's screen before you approve. It is the one screen malware can't change. ::tab Approvals and drainers | Signing away permission to move your tokens ::part How it works A website, often a fake mint, airdrop or "claim" page, asks you to sign something. It isn't a payment: it gives a contract permission to move your tokens. Once signed, a drainer can empty them, sometimes days later. ::part How to spot it - "Claim your free tokens" sites - Requests to approve or sign that you don't understand - Your device can't show what you're signing in plain terms (blind signing) ::part What to do Don't sign anything you can't read and understand on your device's screen. Keep long-term holdings in a wallet you never connect to websites, and review and revoke old approvals with a reputable tool. ::tab Airdrops and free NFTs | Tokens you didn't buy, with a link ::part How it works Unknown tokens or free NFTs appear in your wallet, often with a website name in the title. Tiny "dust" amounts can also be sent to track you. The link leads to a drainer or a fake support page. ::part How to spot it - Tokens or NFTs you didn't buy - A web address in the token's name or picture ::part What to do Ignore them. Don't visit the website, try to sell them or interact with them. Hide them in your wallet app if you can. ::tab Messages in transactions | Notes attached to tiny payments ::part How it works Some networks let a sender attach a short note to a transaction. Scammers send tiny amounts with notes like "reward ready to claim" or "security alert, visit…", hoping you'll follow the link. ::part How to spot it - A message or memo on a payment you weren't expecting - A website to visit, or a reward to claim ::part What to do Ignore it. A message inside a transaction is just text anyone can write. Never follow it. ::: ## Scams that target your accounts, or you :::tabs Scams that target your accounts, or you ::tab SIM swaps | Your phone number moved to a criminal's SIM ::part How it works A criminal convinces your mobile network to move your number to their SIM. Your texts, including security codes, now go to them, giving them a way into your email and exchange accounts. ::part How to spot it - Your phone suddenly loses signal - "SIM changed" or "number transferred" messages you didn't request ::part What to do Use an authenticator app or a security key, not text messages, for your exchange and email accounts. Ask your network about extra account security. If it happens, call your network immediately from another phone. ::tab Fake investments and romance | A friend online with a "great platform" ::part How it works Someone builds a friendship or relationship online over weeks, then introduces a crypto platform where they've "made a fortune". The early profits on screen are fake, and the money can never be withdrawn. These are sometimes called pig-butchering scams. ::part How to spot it - A new online contact who steers talk to investing - A platform you can't find independently - Fees or "taxes" demanded before you can withdraw ::part What to do Stop sending money. Check any investment firm against the FCA Warning List before you pay. Talk to someone you trust, and report it. ::tab "Recovery services" | Someone offering to get your crypto back ::part How it works After a loss, often after you've posted about it, someone offers to recover your crypto for a fee up front, or for your recovery phrase. It's the same people, or their friends, taking a second bite. ::part How to spot it - They found you, not the other way round - Fees up front and "guaranteed" results - Claims of special "tracing" or hacking access ::part What to do Don't pay. Report the original scam, and read [I've lost my recovery phrase. What now?](https://keycompass.co.uk/lost-recovery-phrase) for what can genuinely be recovered. ::tab Wrench attacks | Physical threats to force a transfer ::part How it works Instead of hacking, criminals target the person: threats, home invasions or kidnapping, to force a transfer. There have been cases in the UK as well as abroad. Victims are usually chosen because they've been visible, talking about holdings online, or their details were exposed in a data leak. ::part How to reduce the risk - Don't discuss your holdings in public or online - Keep your home address off crypto-linked accounts and deliveries where you can - Use a setup where no single device or phrase unlocks everything, such as a passphrase or multisig ::part If it happens Your safety comes first. Do what keeps you safe, and report it to the police on 999 as soon as you can. A setup that needs keys kept in different places means you physically can't hand over everything, which also makes you a less attractive target. ::: ## How to protect yourself: a checklist - **Enter your recovery phrase only on your device,** never on a computer, phone or website. - **Check every address on your device's screen** before you approve, and send a small test first. - **Treat anyone who contacts you first as a scammer,** whatever they claim to be. - **Download wallet software only from the maker's own website,** typed in yourself. - **Use an authenticator app or security key** for your exchange and email, not text messages. - **Don't sign anything you can't read on your device's screen.** - **Keep long-term holdings separate** from any wallet you connect to websites. - **Stay private** about what you hold, online and off. :::tip Already set up? A [KeyCompass security review](https://keycompass.co.uk/security-review) checks your setup against every scam on this page, without ever seeing your recovery phrase. ::: ## If you've been scammed 1. **Stop sending anything.** No more payments, fees or "unlocking" charges. 2. **If your recovery phrase was exposed,** set up a new wallet with a new recovery phrase on your device, test the backup, and move whatever is left there straight away. 3. **Secure your accounts.** Change your email and exchange passwords and switch to an authenticator app. 4. **Contact your bank or card provider** if you paid by bank transfer or card. Do it quickly: some payments can be stopped or refunded. 5. **Report it.** In England, Wales and Northern Ireland, report to Report Fraud (the service that replaced Action Fraud) at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. Your bank may need the crime reference number. 6. **Tell the exchange** the crypto was sent to, if you know it. They can sometimes freeze funds. :::warn Expect a second wave After a scam, you are a target for "recovery services". Anyone who contacts you offering to get your money back is very likely part of the same scam. ::: ## Getting help If you're not sure whether something is a scam, a KeyCompass drop-in hour is a calm place to check before you act. And a security review looks at your whole setup against everything on this page, with a written list of what to fix, without ever seeing your words. KeyCompass never asks for your recovery phrase, a photo of it or any part of it, and never contacts you first. Anyone who does, whatever they claim to be, is attempting to steal from you. [How a security review works, and what it costs](https://keycompass.co.uk/security-review)