Common crypto scams: how they work and how to spot them

How big is the crypto scam problem?#

The FBI’s Internet Crime Complaint Center (IC3) received 859,532 complaints in 2024, with reported losses of $16.6 billion — a record ^[3]. Complaints tagged as involving cryptocurrency numbered 149,686, with losses of $9,322,335,911 ^[3]. By our arithmetic, that is about 56% of all reported losses, from about 17% of complaints.

Reported losses by crime type, IC3 2024 (US$ billions)

Two cautions. These are complaints people chose to file with a US agency, so they are not a full count of global fraud. And the crime types overlap with crypto rather than sitting beside it: IC3 uses “cryptocurrency” as a descriptor of the payment tool, added after a crime type is chosen ^[3].

Which crypto scams cost the most?#

The 2024 IC3 report has a separate section on cryptocurrency fraud. It counts 149,686 complaints with $9.3 billion in losses, which IC3 summarises as a 66% increase in losses, and the largest age group reporting was people aged 60 and over ^[4].

Investment scams dominate. Crypto investment fraud produced 41,557 complaints and $5.8 billion in losses in 2024, with complaints up 29% and losses up 47% from 2023 ^[4]. By our arithmetic, that is about 62% of all crypto-related losses, and about 89% of the $6.57 billion lost to investment fraud through every payment method ^{[4] [3]}.

Crypto-related losses by crime type, IC3 2024 (US$ billions)

Older people lose the most. People over 60 filed 33,369 crypto-related complaints, with losses of $2,839,333,197 ^[4]. Not every complaint includes an age, so the age groups do not add up to the total ^[4].

What are the main types of crypto scams?#

How does a crypto investment scam unfold?#

Investment scams are where crypto plays a double role: it is both the “investment” and the payment method ^[1]. A common pattern is the romance or friendship scam, which criminal groups call sha zhu pan, or pig butchering. The US Commodity Futures Trading Commission says financial romance and grooming gangs stole more than $3.5 billion in 2023, and that the grooming phase can take several weeks ^[5].

The typical arc of a romance-investment scam

The FTC describes the same ending: the investment site looks real but is fake, and when you try to take money out you cannot, or only after paying high fees ^[1]. The early “profits” are numbers on a screen, there to make you send more.

No real market investment does that. The numbers only work on a fake dashboard, or by paying earlier investors with new deposits — the definition of a Ponzi scheme, which the SEC’s investor office warns is common in crypto promotions ^[8].

Why do giveaways and celebrity endorsements fool people?#

The giveaway scam asks you to send crypto to an address and promises to send back double — which is why it is also called the 2-for-1 scam. It usually comes with a short deadline to create urgency ^[2]. Scammers often re-stream an old interview with a well-known person so that it looks like a live endorsement ^[2]. In one case in July 2020, hacked social-media accounts of well-known people and organisations posted a bitcoin giveaway, and the hackers collected 11 bitcoin before the posts were deleted ^[2].

Even real endorsements prove little. The SEC’s investor office notes that celebrities are often paid to promote an investment and that an endorsement does not mean the investment is legitimate ^[8]. EU supervisors warn that social-media influencers typically have a financial incentive to market the products they talk about ^[9].

How do phishing and fake support steal wallets?#

Phishing is when criminals use scam emails, texts or calls to trick you, often into visiting a website that installs malware or collects your details ^[10]. It was the single most reported crime type to IC3 in 2024, with 193,407 complaints ^[3]. In crypto, the target is usually your recovery phrase: imitation websites ask you to enter it, reset a password or send funds ^[2]. Scammers can even spoof the link preview on social media so a malicious link appears to point to a real site ^[2].

Fake support works by building trust. Scammers watch public chat channels for people asking for help, then send a private message offering it — and eventually ask for keys or for funds ^[2]. Real staff will not contact you through private, unofficial channels ^[2]. IC3’s 2024 report also lists an FBI warning about scammers impersonating cryptocurrency exchanges ^[3].

What is address poisoning?#

Address poisoning is a scam that plants transfers to look-alike addresses in your wallet history, so that you later copy the wrong address and send tokens to the scammer ^[6]. Revoke.cash, a wallet-security service, describes two main versions ^[6].

• Fake tokens. The scammer creates a token with the same name as a popular one, such as USDC or USDT, and makes it look as if you sent tokens to the scammer’s address ^[6].
• Zero-value transfers. The scammer uses the real token’s transferFrom function to record a transfer of zero tokens from your address to a look-alike address ^[6]. No approval from you is needed: the function only checks that the amount is not more than the approved amount, and zero always passes that check ^[6].

The defence is simple. Never use your wallet history or a block explorer as the place you copy addresses from ^[6]. For an exchange deposit, copy the address from the exchange’s website every time; for a friend, ask them for it directly ^[6]. Then compare far more than the start and end of the address:

It is commonly recommended to verify the first and last 4 characters of the address, but this is actually not enough.

Revoke.cash, What Is Address Poisoning? ^[6]

The reason, Revoke.cash explains, is that scammers can create addresses with the same first and last four characters as the one you meant to use ^[6].

What red flags apply to almost every scam?#

• You are told to pay in crypto. The FTC says no legitimate business will demand that you send crypto in advance — not to buy something, and not to protect your money ^[1].
• Profits are promised. Nobody can promise guaranteed returns; the FTC treats any such promise as a sign of a scam ^[1].
• Someone you met online starts giving investment advice. Never mix online dating or friendship with investing ^[1].
• You are rushed. Short deadlines are designed to stop you from thinking or checking ^[2].
• The conversation moves to a private app. It is one of the CFTC’s warning signs ^[5].
• You must pay to withdraw. Fake “fees” or “taxes” to unlock your money are the final stage of the scam ^[5].
• Free money appears. Free crypto, doubled deposits and surprise airdrops that need you to “claim” them are not gifts ^[2].

What is a recovery scam?#

A recovery scam targets people who have already lost money. Someone says they can get your money back, but you must pay them first, and if you do, you lose more ^[7]. The US Federal Trade Commission explains that scammers buy, sell and trade lists of people who have already been scammed, expecting them to be good targets again ^[7]. The caller may claim to be from a government agency, a consumer group or a law firm ^[7], and ask for a “retainer fee”, “processing fee” or “tax” before any money is returned ^[7].

The FBI gives crypto scam victims the same warning: be wary of anyone claiming they can recover your funds, as this may be another scam ^[11]. Its list of 2024 public alerts includes one titled “Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds”, dated 24 June 2024 ^[4].

What should you do if you have been scammed?#

1. Stop sending money

   Do not pay any “fee”, “tax” or “verification” charge to get funds back. Paying to withdraw is part of the scam ^[5].

2. Secure what is left

   If you shared a recovery phrase, treat that wallet as compromised: whoever holds the phrase can access every account in it ^[2]. Move any remaining funds to a new wallet with a new phrase.

3. Keep records

   Save messages, website addresses, wallet addresses and transaction IDs before the scammer deletes anything. The FBI says the most important details are the crypto addresses, the amount and type of crypto, the date and time, and the transaction ID (hash) ^[11].

4. Report it

   In the US, the FBI asks crypto scam victims to report to IC3 at ic3.gov without waiting, and to file a report even if they have no transaction details ^[11]. The FTC also lists ReportFraud.ftc.gov, the CFTC, the SEC and the exchange you used ^[1]. In the UK, the NCSC accepts reports of scam emails, texts, websites and adverts ^[10].

5. Beware of “recovery” offers

   The SEC’s investor office warns that recovering money from crypto fraudsters can be nearly impossible ^[8]. Anyone who asks for an upfront fee to get your money back is running a scam of their own, according to the FTC ^[7].

What mistakes do beginners make here?#

• Trusting a website because it looks professional

  Fake trading platforms copy the look of real ones and show convincing dashboards. Check how long a site has existed and whether the firm is registered with the regulator.

• Believing that small early withdrawals prove it is real

  Letting you withdraw a little at first is a deliberate tactic to win a bigger deposit.

• Answering “support” messages you did not request

  Real help desks do not reach out first in private messages. Contact support only through the official website you typed yourself.

• Paying a fee to unlock your own money

  A platform that demands taxes or fees before releasing funds is almost always the scam itself, asking for one more payment.

• Copying an address from your transaction history

  Address poisoning plants look-alike addresses there. Copy each address from its original source, every time.

Frequently asked questions#

The bottom line#

Crypto scams succeed through persuasion, not hacking. Almost all of them need you to do one of two things: send crypto to someone, or reveal a recovery phrase. If you never do either at a stranger’s request, most of these schemes simply fail.

Some newer tricks work through signatures and approvals rather than direct payments — see token approvals and wallet drainers. For how platforms themselves can fail, read custodial vs self-custody and crypto volatility and risk.

Sources#