Spotting & avoiding scams: 13 schemes and their warning signs

Scams can catch anyone, careful people included. But most follow a handful of patterns – once you know them, you’ll usually recognise an attempt within a few sentences.

The basic pattern: trust, pressure, no chargeback

Crypto assets are attractive to criminals because they work worldwide, they are fast and payments often can’t be reversed.^[1] With Bitcoin there are no exceptions: nobody can reverse a confirmed transaction – no bank, no hotline.

Almost every scheme follows three steps:

1. Build trust: as support staff, a new acquaintance, a successful trader or an authority.
2. Apply pressure: ‘today only’, ‘your account will be blocked’, ‘the group is almost full’.
3. Get access: a bank transfer, a bitcoin payment, a remote-access app or your seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×.

$17 bn

estimated revenue from crypto scams worldwide

2025, Chainalysis projection; traced so far: at least 14 bn

$7.2 bn

reported losses from crypto investment fraud in the USA

2025, FBI IC3

$1.4 bn

losses reported in complaints about recovery scams in the USA

2025, FBI IC3; may include losses from the original scam

$389m

reported losses via crypto ATMs in the USA

2025, FBI IC3; +58% on the previous year

Sources: Chainalysis and the annual report of the FBI, the US Federal Bureau of Investigation (as of 2025).^[3],[2] We don’t have figures this detailed for Germany; BaFin, Germany’s financial regulator, and German consumer advice centres warn about the same schemes.^[5],[4]

Schemes that target your login details

1. Phishing

In phishingGlossaryPhishingFraud using fake emails, text messages, websites or calls that look like genuine exchanges, wallet makers or banks. The goal is your passwords, 2FA codes – and above all your seed phrase.In the glossary →×, an email, text or other message appears to come from your exchange or wallet: a security problem needs fixing, please log in here or update the app. The link leads to a fake website or app through which criminals get hold of your data.^[1]

Warning signs: time pressure, a link or QR code, an address with missing or extra letters in the company name.^[1] Protection: only open your exchange via the official app or a bookmark you saved yourself.

2. Fake support

You ask for help with your wallet in a forum or on social media. Shortly afterwards, someone messages you privately – supposedly from support – and asks for your seed phrase, password or private key.^[1] Or they want you to install remote-access software ‘so they can explain the account to you’.^[8]

Protection: genuine support doesn’t contact you unprompted by direct message. Reputable companies never ask for passwords or security codes by email, text or phone.^[1] Only get help via the official app or website.

3. Fake apps

The app looks like the original but comes from scammers. It often reaches your phone via a link or QR code in a message, disguised as an ‘urgent update’, and gives the perpetrators access to your data.^[1]

Protection: only install official apps from trustworthy app stores and don’t scan unknown QR codes.^[1] Compare the developer name with the one on the maker’s website. If a hardware wallet comes with a list of words already filled in, it’s a scam – see Setting up a hardware wallet.

4. SIM swap

With SIM swappingGlossarySIM swappingFraudsters get your mobile number transferred to their own SIM card and so receive your text-message codes. They use this to take over accounts that are only protected by SMS. Protection: 2FA via an app or security key instead of SMS.In the glossary →×, criminals get your mobile provider to transfer your phone number to their SIM card. From then on, your SMS codes go to them, and your phone suddenly shows ‘no signal’.^[2]

Protection: secure your exchange with two-factor authenticationGlossaryTwo-factor authentication (2FA)Logging in with two independent proofs, such as a password plus a code from an authenticator app. For accounts with exchanges and Bitcoin apps, 2FA is a must – and SMS codes are the weakest option.On the learning path: Stage 4 · Step 3 – Buying Bitcoin →In the glossary →× via an authenticator app or hardware key rather than SMS. According to the BSI, Germany’s Federal Office for Information Security, hardware-based methods such as FIDO security keys offer a high level of security.^[9] Ask your mobile provider for a customer password for changes to your contract.

Schemes built on false promises

5. Pig butchering: slow trust-building

As the name suggests, the victim is first ‘fattened up’ over weeks. Contact begins by text message, on social networks, via adverts or dating apps and quickly moves to a messenger. Then come a supposed insider group, a trading app with fake profits and often a loan for ‘bigger opportunities’. Anyone who wants to withdraw is first told to pay taxes and fees – after which the perpetrators disappear. According to the FBI, organised gangs in South-East Asia are usually behind it, and no other scheme caused higher reported losses in the USA in 2025.^[2]

6. Romance scams

Someone you’ve never met writes to you often, personally and romantically. The profile and photos are fake, stolen or generated with AI. At some point the conversation turns to a crypto investment with ‘high returns and low risk’ – often starting with a small deposit so that everything looks legitimate.^[1]

Warning sign: the acquaintance keeps postponing meeting up but wants to talk about money. Protection: never send money or bitcoin to people you only know online, and talk to someone you trust.

7. Fake exchanges and trading platforms

The website shows prices, charts and your growing balance. Usually, though, no trading takes place at all; the profits are made up. Before a withdrawal, taxes, fees or insurance fall due.^[8] A recent example: on 23 September 2026, BaFin warned about a series of almost identical websites for supposedly ‘AI-powered crypto trading platforms’ without a valid legal notice. Data entered in their contact forms ends up with operators of unauthorised trading platforms.^[6]

Protection: check every provider before you send money: is it in ESMA’s MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× register? Is there a warning from BaFin or your national regulator, or an entry on IOSCO’s international I-SCAN warning list?^[1] How to read the register is explained in MiCA & regulation, and Choosing the right provider covers what else to look for.

8. WhatsApp and Telegram groups

Using the names of well-known financial firms, stock market experts, celebrities or politicians, scammers lure people into investment groups, court them there for days or weeks and then push them to deposit money on trading platforms. Typical signs are a supposedly exclusive group with limited places, a ‘safe investment’ with high returns and pressure to pay in more and more. Germany’s consumer advice centre (Verbraucherzentrale) warned about this most recently in September 2026.^[4]

Protection: at the slightest doubt, leave the group, and don’t send money or bitcoin to accounts or addresses you don’t know.^[4] Since October 2025, banks in the euro area have been checking, for SEPA transfers, whether the recipient’s name matches the IBAN. If your bank flags a mismatch, only make the transfer once you have checked the recipient yourself – scammers sometimes urge their victims to ignore this warning.^[4]

9. Giveaway scams

On social media, a well-known person or company is ‘giving away’ bitcoin: you’re supposed to send an amount first and will supposedly get double back. The logo and website look official. Anyone who pays gets nothing.^[1]

Rule of thumb: a promise to double your money is always a scam.

10. AI deepfakes

AI makes every scheme more convincing. According to the FBI, investment clubs use AI-generated videos and voices of celebrities and company bosses, and AI helps run thousands of different-seeming chats at the same time.^[2] Chainalysis found that scam operations with traceable payments to AI vendors took in about 4.5 times as much on average as others.^[3]

Protection: a familiar face or voice is no proof. Check offers via the official website, which you open yourself. If a caller with a familiar voice asks for money: hang up and call back yourself on the number you know.

Schemes that exploit your situation

11. Crypto ATMs as a payment route

Someone calls, supposedly from the police, your bank or an authority: your money is in danger, you should withdraw it, pay it into a Bitcoin ATMGlossaryBitcoin ATM (crypto ATM)A machine where you exchange cash for bitcoin. In Germany, the operator needs a licence; BaFin, the German financial regulator, seized unlicensed machines in 2024. Scammers deliberately push victims to pay in at such machines.In the glossary →× and use the callers’ QR code to do so. The FBI explicitly warns about such schemes. Around two thirds of the losses via crypto ATMs reported in the USA in 2025, about $257 million, were reported by people aged 60 and over.^[2]

Remember: no police force, bank or authority will ask you to pay money into a crypto ATM. The legal situation in Germany: Bitcoin ATMs & cash.

12. Recovery scams

After a scam, someone gets in touch who wants to help: a law firm, a ‘blockchain investigator’, supposedly even the police, the tax authority or the financial regulator. For a fee, your money is to be recovered – often this is the next scam targeting the same victim.^[1],[8] In December 2025, for example, BaFin warned about ‘RecoverX’, which offered recovery services and falsely claimed to be supervised by BaFin.^[7]

Protection: never pay anyone in advance for a recovery. Contact the police, your financial regulator or a lawyer you have chosen yourself.

13. Wrench attacks: violence instead of technology

In a wrench attackGlossaryWrench attack ($5 wrench attack)An attack using violence or threats instead of technology: criminals force Bitcoin owners to unlock their wallet or transfer bitcoin. The best protection is discretion – if nobody knows you own bitcoin, you are less likely to become a target.In the glossary →×, perpetrators threaten people directly to get at their bitcoin – no encryption helps against that. Jameson Lopp collects publicly known cases; for 2025, his list contains dozens of entries, including the kidnapping of a Ledger co-founder in France in January 2025.^[10]

Protection: don’t talk publicly about your holdings. According to the supervisory authorities, revealing too much about yourself and your investments makes you an ‘easy target’.^[1] For larger amounts, a passphrase or multisig helps, so that nobody can hand over everything at once under pressure. More on this: Privacy with Bitcoin.

What scam attempts look like

The screens are made up, but modelled on typical cases. Each caption explains the numbers.

Address poisoning (screen 3) needs no contact at all: the perpetrators often change only the middle of the address and hope you’ll later copy it from your history.^[1]

The red flags at a glance

The European supervisory authorities also name most of these signals as warning signs.^[1]

Test yourself: genuine or scam?

Seven made-up messages in the style of real cases, two of them harmless.

The security check shows in a few minutes how well your own accounts and wallets are protected against these schemes.

What to do if the worst happens

Act quickly and without shame – the perpetrators are professionals. The supervisory authorities recommend these steps:^[1]

1. Stop payments, break off contact

   Don’t transfer anything more – no ‘final fee’ and no advance payment for a supposed recovery. Block the senders.

2. Change passwords and lock access

   Change the passwords of all your accounts, not just the affected one: criminals try stolen passwords on many services.^[1] If you installed a remote-access app, uninstall it and have the device checked.

3. Move any remaining funds to safety

   If your wallet is compromised – for example because you entered the seed phrase – set up a new wallet with a new seed phrase and transfer the remaining funds there.^[1] Never use the old seed phrase again; back up the new one as described in Backing up your seed phrase.

4. Inform your provider

   Report the case via your exchange’s official channels. If the perpetrators’ bitcoin are on a regulated platform, it may be able to freeze their account and block the address.^[1]

5. Report it to the police and inform your financial regulator

   Secure evidence: chat histories, screenshots, addresses, transaction IDs. In Germany, report it to the police in person or via your federal state’s online police station (Onlinewache).^[8] BaFin’s consumer helpline is free on 0800 2 100 500, Monday to Friday from 8 am to 6 pm, or from abroad on +49 228 299 70 299 (as of September 2026).^[11] Elsewhere, contact your local police and your national financial regulator.

Official BaFin pages (in German):

• Warnings – has a platform already been warned about?
• Databases of institutions – is a company authorised?
• Recognising investment fraud – typical schemes and warning signs