Pause when a message creates pressure.
Threats, urgent deadlines and promises of easy profit are reasons to stop and check. A countdown, familiar logo or polished dashboard does not prove that an offer is genuine.
- Do not act on an unexpected demand to move money to a supposedly safe wallet.
- Be cautious of guaranteed returns, unsolicited investment advice and people asking you to keep an investment secret.
Check the sender through a separate channel.
Open a website you already know or use the provider's official app. Contact the organisation using details you find independently, not a phone number or link from the suspicious message.
Check the complete website address and sender email. A copied logo or a secure-connection padlock is not proof that the person behind a website can be trusted.
Read the FTC's phishing guideKeep account and wallet secrets private.
Do not send anyone your password, one-time verification code, recovery phrase or private key. A wallet recovery phrase can give another person control of the wallet.
- Use a unique password for each account and a reputable password manager.
- Enable multifactor authentication wherever your email or wallet provider offers it.
- Keep your device and browser updated. Do not install remote-access software at the request of an unsolicited support agent.
Question requests for more money.
Before approving any transfer, independently confirm who receives it, the amount and the purpose. Crypto transfers are usually irreversible. An animation, displayed balance or transaction screenshot is not proof that funds are available or that a payment has settled.
Do not pay someone who promises to recover lost crypto for an upfront fee. Recovery promises can be another scam.
Read the FBI's investment-fraud warningsAct promptly if something seems wrong.
- Stop contact and further payments. Do not send another payment to release or recover the first one.
- Secure affected accounts. From a trusted device, change exposed passwords and contact your provider if codes or wallet secrets were shared.
- Keep evidence. Save messages, receipts, website addresses and transaction references. Do not include passwords or recovery phrases in reports.
- Contact the payment provider. Tell your bank, mobile-money network or exchange what happened as soon as possible. A refund or reversal is not guaranteed.
- Report locally. Contact the appropriate police or fraud authority in your country. US users can also report through ReportFraud.ftc.gov or IC3.gov.
A quick reality check
Does a familiar logo make a message trustworthy?
No. A logo, sender name or professional-looking page can be copied. Verify through a contact method you already trust.
Should I send my email code to a support agent?
No. Keep verification codes private. Only enter one into the genuine service when you initiated the relevant sign-in or account action.
Does a successful small withdrawal prove an investment is safe?
No. Fraudulent platforms may allow a small withdrawal to build confidence before asking for larger deposits. Verify the company independently rather than relying on a test payment.
Read more from the original sources
- FTC: cryptocurrency and common scams
- FTC: recognising phishing
- Trezor: recovery-phrase and wallet-security warnings
- FBI: investment and withdrawal-fee fraud
- FTC: what to do after a scam
This guide is general education, not a guarantee of account security, investment safety or recovery of funds. Source links do not imply endorsement of CoinVault. Reporting routes and consumer protections vary by country.