Pause Before You Pay
No real investment needs secrecy, pressure, or one more payment before withdrawal.
Fake exchange alerts, wallet verification messages, airdrop links, invoices, QR codes, and recovery emails are built to make you click before you think.
If an unexpected email, text, direct message, pop-up, or QR code asks you to click, call, scan, connect a wallet, enter a seed phrase, approve a transaction, or pay with crypto, stop.
Open the real exchange, wallet, bank, or government site yourself by typing the address or using the official app. Do not use links, phone numbers, QR codes, or attachments from the message.
If an authentication code or sign-in approval prompt arrives when you did not request it, do not click Approve and do not share the code. Someone may already have your password and be trying to access your account. Open the official app or website yourself, change your password, review active sessions, and contact the real provider if needed.
The message says your Coinbase, Binance, Kraken, Crypto.com, wallet, bank, or payment account was locked or compromised. It pushes a login link, support number, or identity upload.
A page asks for your seed phrase, private key, 2FA code, driver's license, passport, selfie, or proof of address. Real support should never need your recovery phrase.
An authentication code arrives by email or text, or your phone asks you to approve a sign-in you did not start. Never share the code, click a sign-in link, or approve the prompt. Deny it and secure the account through the official app or website.
The site asks you to connect your wallet or sign a transaction to claim free tokens. The approval may let the attacker drain tokens or NFTs.
A "support agent," "lawyer," "IC3 agent," or recovery firm emails after a loss. They may ask for a fee, wallet access, screenshots, ID, or your seed phrase.
A fake crypto purchase receipt, tax form, legal notice, or PDF urges you to call a number or open an attachment. That can lead to remote-access software or credential theft.
The email claims your device was hacked or private material will be released unless you send crypto. Preserve the message and report it; do not pay.
A scammer sends a QR code and tells you to use a crypto ATM, kiosk, or wallet app. The QR code usually points straight to the scammer's wallet.
Emails and texts invite you to a trading group, task app, professor's assistant, or recruiter. The link leads to a fake platform or a deposit demand.
Type the known address yourself, use a bookmark you created earlier, or open the official app already installed on your device.
Names, logos, caller ID, and email display names are easy to fake. A padlock or https connection only means the connection is encrypted, not that the site is honest.
Scammers use account freezes, law-enforcement threats, tax deadlines, bonus expirations, and "withdraw now" pressure to stop you from checking.
Call the number on your card or statement, use the official help center, or ask a trusted person to review the message before you do anything.
That kind of message is dangerous because it combines urgency, a fake security problem, a login link, and a threat. Go to the real site yourself instead.
Change the password from a clean device, revoke active sessions, turn on app-based 2FA, and change that password anywhere else you reused it.
Treat the wallet as compromised. From a clean device, create a brand-new wallet and move any remaining assets there. Never reuse the exposed phrase.
Disconnect the site and review approvals using your wallet's official help instructions or a trusted block explorer reached independently.
Watch for identity theft, consider a credit freeze or fraud alert, and use IdentityTheft.gov for recovery steps.
No real investment needs secrecy, pressure, or one more payment before withdrawal.