Most digital-asset scams leave technical fingerprints you can check before you lose anything: a request to sign something you do not understand, an address that only matches at the start and end, a wallet app from outside the official store, a token you never bought suddenly appearing, or a platform that shows growing profits but charges "fees" to withdraw. If you see one of these, stop and verify through a channel you found yourself.
This guide covers the mechanics only: what the trick does on the blockchain or on your device, and which setting or habit blocks it. The emotional side of scams, and recovering after one, deserves its own space; here the focus is on what the screen and the chain are telling you.
Why technical checks beat gut feeling
Scammers are good at stories. They pose as a helpful admin, a successful investor, a romantic partner or a government office, and they are patient. Gut feeling often fails because the story feels personal and urgent. Technical signals do not care about the story. An address either matches or it does not. A signature request either gives away control of your tokens or it does not.
The good news is that the number of technical tricks is small compared with the number of stories wrapped around them. Learn the handful of mechanisms below, and most new scams turn out to be old mechanisms in new clothes.
The habit to build is a pause. Before any send, any signature and any install, ask: where did this request come from, did I start it, and can I check it through a route I found myself? Most losses happen in the thirty seconds where that question was skipped.
Six mechanisms behind most crypto scams
Address poisoning. The scammer sends you a tiny or zero-value transfer from an address that matches the first and last few characters of an address you use often. Next time you copy "the usual" address from your history, you copy theirs.
Drainer signatures. A website asks you to sign something presented as a login, a free mint or an airdrop claim. In reality it is an approval or a signed permit letting their contract move your tokens.
Fake wallet apps and browser extensions. Look-alike apps, often promoted through ads or links, capture your seed phrase when you "import" an existing wallet.
Surprise tokens. An unknown token appears in your wallet with a name that is a web address. Visiting that address to "claim" or "sell" it leads to a drainer site.
Fake trading platforms. A polished website or app shows deposits growing quickly. The numbers are just figures in their database. When you try to withdraw, they invent taxes, fees or "verification deposits".
Fake support and fake recovery services. After you post a problem publicly, "support agents" or "recovery experts" contact you privately and ask for your phrase, remote access to your screen, or an upfront fee.
QR codes and payment links swapped. A shared QR code or payment link is quietly replaced with one pointing to the scammer's address, for example in a group chat or on a printed sheet.
Red flags you can see on your own screen
The address matches at the ends but not in the middle. Compare the full string, or at least a block in the middle, not just the first and last characters.
A signature request you cannot read. If the wallet shows raw data or warns that it cannot decode the request, do not sign. Legitimate logins rarely need a token approval.
The words "approve", "permit", "setApprovalForAll" or "increase allowance" during a supposed login. These grant spending rights. A login should not move or authorise moving anything.
An app installed from a link, an APK file or a beta-testing invitation. Real wallet apps are normally in the official app stores under the developer's verified name. Sideloaded apps skip those checks.
A countdown on a "claim" page. Urgency is designed to stop you from checking. Real airdrops do not disappear because you took ten minutes to verify.
A platform you cannot find in independent coverage. If the only sources praising a trading site are its own pages and chat groups, treat the balance it shows as fiction.
Withdrawal requires paying first. Any request to send more money so you can withdraw is the clearest single sign of a fake platform.
Someone asks to share your screen or install a remote-access app. Remote access gives them your wallet. No genuine support process requires it.
Settings and habits that block most of these tricks
None of these needs technical skill. Together they shut the doors most scams walk through.
- Keep two wallets. A "vault" wallet that only receives and rarely signs anything, and a small "everyday" wallet for trying apps.
- Use an address book or whitelist. Save addresses you use often inside your wallet or exchange, with labels, and send only from that list.
- Send a small test first. For any new or large transfer, send a small amount, confirm with the recipient through a separate channel, then send the rest.
- Read every signature request. Prefer wallets that preview what a transaction will do. If you cannot tell what you are signing, decline.
- Bookmark the real sites. Reach exchanges, explorers and apps only through bookmarks or by typing the address, never through ads or search ads.
- Ignore surprise tokens. Do not try to sell, swap or "claim" tokens you did not acquire. Many wallets let you hide them.
- Review approvals regularly. Revoke permissions you no longer use, especially unlimited ones.
If something has already gone wrong
If you signed something suspicious but nothing has moved yet, act quickly: revoke the approval from a clean device and move remaining assets to a brand-new wallet with a new seed phrase. If you typed your seed phrase anywhere, assume the whole wallet is compromised and move everything that is still there.
If funds have left, write down the transaction IDs, addresses, website addresses, chat usernames and screenshots while they are fresh. Report to the police; if bank cards or bank transfers were involved, call your bank immediately. Some issuers of centrally managed stablecoins can freeze stolen funds when law enforcement asks quickly enough.
Be very wary of anyone who then offers to recover your funds for a fee. Paid "recovery" offers aimed at victims are a well-known second wave of the same scam. Real investigations go through the police, not through strangers in your inbox.
Frequently asked questions
What is address poisoning in crypto?
It is a trick where a scammer sends a tiny transfer from an address that looks like one you use, hoping you will later copy it from your history by mistake. Checking the full address before every send defeats it.
Can I lose money just by connecting my wallet to a website?
Connecting alone usually only shares your address, but the next step is typically a signature request, and that is where the danger lies. Treat every signature on an unfamiliar site as potentially harmful.
A strange token appeared in my wallet. Should I sell it?
No. Unsolicited tokens are often bait leading to drainer sites, and some cannot be sold anyway. Hide it in your wallet and leave it alone.
How can I tell if a trading platform is fake?
Warning signs include no independent coverage, an app installed from a link instead of an official store, guaranteed returns, and any fee required before withdrawal. A withdrawal fee demand alone is enough to stop.
Can the police recover stolen crypto?
Sometimes, particularly when funds reach regulated exchanges or freezable stablecoins, but it is far from guaranteed. Reporting quickly with complete records gives the best chance.
