How to Spot Fake Support, Phishing Links and Approval Scams
Five checks stop most fake-support scams: who made contact, the exact domain, pressure or fees, requests for codes or seeds, and what you sign.
Direct answer: Run five checks before you reply, click or sign: who contacted whom, the exact domain, whether you are being rushed or asked to pay to unlock funds, whether anyone wants a seed phrase, code or remote access, and what a wallet request actually approves. If any check fails, stop and contact support yourself from inside the official app or a bookmarked site.
Why fake support works
When something goes wrong, such as a delayed withdrawal or a locked account, people ask for help in public: on social media, in a project's chat group, in the comments under a post. Scammers watch exactly those places. Within minutes, a "support agent" or "admin" sends a private message with a friendly tone, a logo for a profile picture and a link to "fix" the problem.
ethereum.org describes this pattern directly: scammers pose as support staff and message people who ask questions in public channels, and as a general rule staff will never communicate with you through private, unofficial channels (checked 2026-11-01). Binance's security blog describes impersonators who ask for login credentials and two-factor authentication codes, and says Binance will never reach out to users on WhatsApp with investment advice (checked 2026-11-01).
Fake support is one branch of phishing, which the FBI's Internet Crime Complaint Center ranked as the most-reported complaint type in its 2024 report (checked 2026-11-01). For the wider picture, see how to avoid phishing.
How the script unfolds: an example
Sam posts: "My withdrawal has been pending for two hours, anyone else?" Five minutes later a DM arrives from an account named after the exchange's support team. It apologises, asks for his user ID, then sends a link to a "secure verification portal". The portal asks for his email, password and 2FA code. When Sam hesitates, the agent says the account will be frozen in 30 minutes unless he verifies, and adds that he may need to move funds to a "safe address" while the issue is fixed.
Every step fails one of the five checks: the agent contacted him first; the portal's domain is not the exchange's; there is a deadline; it asks for a 2FA code; and moving funds to a "safe address" is simply sending them to the scammer. The real fix would have been to open the exchange from his bookmark and start a chat from the in-app help centre.
The five-check decision table
| Check | Safe answer | Stop if you see |
|---|---|---|
| 1. Who started the contact? | You opened support from the official app or bookmarked site | A DM, call, text or email reached you first |
| 2. Is the domain exact? | Matches your bookmark letter for letter | Extra words, swapped letters, unusual endings, link shorteners |
| 3. Is there pressure or a fee? | Normal timelines, no payment to receive your own money | "Frozen in 30 minutes", deposit to unlock, move to a "safe address" |
| 4. What are they asking for? | Ticket number or user ID inside the official channel | Seed phrase, private key, password, 2FA code, screen sharing, remote-access app |
| 5. What does the signature do? | You can name the site, network, action and amount | An approve or permit for a token you did not plan to trade, or an unlimited amount |
On check 5: under the EIP-20 standard, an approval lets the named spender withdraw tokens from your balance multiple times up to the approved amount (checked 2026-11-01). A large or unlimited approval to an unknown contract is therefore a standing permission to drain that token later. The token approvals lesson shows how to review and revoke them.
Step-by-step: what to do the moment something feels off
- Stop replying. Do not click further links and do not install anything the other person suggests.
- Open the exchange or wallet yourself from a bookmark, and check notifications or open a ticket in the official help centre. If the exchange offers a verification tool, such as Binance Verify for websites, email addresses and Telegram IDs, check the contact there.
- Take screenshots of the chat, profile, links and any addresses before the account disappears.
- If you typed a password or 2FA code anywhere, change the password, reset 2FA and review active sessions and API keys; the account security setup lesson lists every setting.
- If you signed something, revoke suspicious approvals and check your address in a block explorer (using a block explorer).
- If a seed phrase leaked, assume the wallet is lost: create a new wallet on a clean device and move remaining funds immediately.
- Report the impersonating account to the platform where it contacted you and to the exchange's official support.
If an exchange account really is restricted, follow its official process; our research note on safe steps for a frozen Binance account shows what a legitimate route looks like.
Common mistakes and risks
- Posting account details publicly. Your user ID, email and the problem you describe are bait for impersonators. Ask through the official ticket system.
- Trusting a verified-looking badge or a logo avatar. Profiles are easy to copy.
- Sharing your screen "so they can guide you". Screen sharing can expose codes, balances and seed phrase backups.
- Paying to release a withdrawal. That is a scam pattern covered in spotting scams, not a support process.
- Assuming an approval is harmless because nothing left yet. The drain can come hours or days later.
FAQ
Will a real exchange ever message me first?
Exchanges do send notices through their official email, app and SMS, but they do not need your password, 2FA code or seed phrase. Verify any message inside the app before acting.
Someone in a group chat says they are an admin. How do I check?
Do not trust the chat label. Use the project's or exchange's official website to find its listed channels and verification tool, and never continue in DM.
Is it safe to give my user ID to support?
Inside the official ticket system, usually yes. In a DM it helps the impersonator look more convincing, so keep it there only.
I already gave my 2FA code. Is it too late?
Act immediately: change your password, reset 2FA, sign out other sessions and check withdrawals. Speed matters because the code expires quickly but the session it opened may not.
Bottom line
Fake support depends on you staying in their channel. Five checks break the script: who started it, the exact domain, pressure or fees, what they ask for, and what you would sign. When anything fails, leave the chat and open support yourself. Next, set up 2FA properly and visit the Beginner Center for the full security path.
Education only, not investment advice. Rules checked 2026-11-01.
