Spotting Crypto Scams: 6 Red Flags That Always Hold
CryptoRebateHub Editorial Team
Guaranteed returns, urgency, approval or transfer requests, DM signals, lookalike domains, seed-phrase requests: one flag means verify, two means it is a scam.
Direct answer: Almost every crypto scam, from fake exchanges to romance-investment schemes, relies on at least one of six tells: a promised return, artificial time pressure, a request to approve or transfer funds, unsolicited trading "signals", a lookalike domain or app, or a request for your seed phrase. You do not need to understand the specific scheme. If one red flag appears, stop; if two appear, it is a scam until proven otherwise.
Why six red flags are enough
Scam formats change every few months, but the mechanics do not. The FBI's Internet Crime Complaint Center counted 149,686 cryptocurrency-related complaints with reported losses of about 9.3 billion USD in 2024, out of 16.6 billion USD in total reported internet-crime losses; cryptocurrency investment fraud alone accounted for about 5.8 billion USD (per the IC3 2024 annual report, checked 2026-11-01). Those schemes differ in packaging, yet nearly all of them need the victim to either hand over control of funds or send funds voluntarily. The six flags below are the moments where that handover is requested. Learn to notice the request itself rather than the story wrapped around it.
The six red flags
| # | Red flag | What it sounds like | What it is actually doing |
|---|---|---|---|
| 1 | Guaranteed or fixed high returns | "2% a day", "principal protected", "AI arbitrage, zero risk" | Replacing a market with a promise; the promise is the product |
| 2 | Manufactured urgency | "3 slots left", "offer ends at midnight", "your account will be frozen in 1 hour" | Removing the time you would use to verify |
| 3 | Approval or transfer requests | Unlimited token approval on an unknown dApp; "move funds to a safe account" | Taking spending rights over your wallet or moving coins out of your control |
| 4 | Unsolicited "signals" | Paid call groups, DM mentors, airdrop claims, celebrity giveaway streams | Building trust to set up flag 1 or 3 later |
| 5 | Lookalike domains and apps | One extra letter in the domain, search-ad "official site", APK outside app stores | Harvesting your login, 2FA code or seed on a page you control nothing about |
| 6 | Anyone asking for your seed phrase or private key | "Re-verify your wallet", "sync to claim", "support needs it to recover" | Taking everything in one step; no legitimate service ever needs it |
Each flag is sufficient on its own. A legitimate exchange promotion never needs your seed. A real support agent never asks you to move funds. A genuine project never needs an unlimited approval from a wallet that holds your savings.
Worked example: how the flags stack in a real approach
A typical investment-fraud sequence, as described in the IC3 report categories, runs like this. A friendly contact on a messaging app chats for weeks (grooming, no flag yet). They mention a platform earning steady weekly returns (flag 1). They show screenshots of withdrawals and say the current "pool" closes Friday (flag 2). The platform's domain looks like a well-known exchange with an extra character (flag 5). After your first deposit grows on screen, a "withdrawal tax" or "verification deposit" is required to cash out (flag 3). When you hesitate, a "compliance officer" offers to recover your funds if you connect a wallet and sign (flag 3 again, often flag 6).
Count them: five flags across one approach. Each one individually was explainable; together they are unmistakable. The lesson is to keep a running count rather than judging each message on its own.
Step-by-step: a two-minute check before you click, sign or send
- Name the request. Write down, in one sentence, what you are being asked to do: send funds, approve a contract, log in, enter a phrase, install an app. If the request is "enter your seed phrase", stop here.
- Verify the channel independently. Do not use links from the message. Type the exchange domain yourself or open the app you already have. Binance publishes an official-verification page where you can check whether a domain, email address or staff username is genuine (per Binance's phishing-prevention FAQ, checked 2026-11-01). Other large exchanges have equivalents; look for "verify official channel" in their help centre.
- Check the sender against your anti-phishing code. Binance lets you set a 6–8 character anti-phishing code that appears in its genuine emails and SMS; a message without it is suspect (per Binance's anti-phishing code FAQ, checked 2026-11-01). Set this up now via the account security setup guide.
- Inspect any approval before signing. Read the contract address, the token and the amount. Prefer a per-transaction amount over "unlimited" and revoke approvals you no longer use; the token approvals explainer walks through this.
- Test with a small amount and a withdrawal. For any new platform, deposit the minimum, then withdraw it. A platform that lets money in but not out has answered your question. The first deposit and withdrawal test shows the routine.
- Lock the exits. Enable a withdrawal address whitelist with a time delay and app-based 2FA, so that even a successful phish cannot drain the account instantly. See the withdrawal whitelist guide and what 2FA is.
Mistakes and risks that catch experienced users
- Trusting a verified-looking badge inside the scam's own UI. Only verification tools hosted on the real domain mean anything.
- Assuming a small first profit proves legitimacy. Letting early withdrawals succeed is a standard step in pig-butchering schemes; it is how the second, larger deposit is obtained.
- Clicking a search ad for an exchange. Ads can be bought by anyone; bookmark the real site once and use the bookmark.
- Installing "the app" from a link. Only use the official app store listing, and compare the developer name; the fake apps guide lists the checks.
- Paying a "recovery service". Firms that promise to recover scammed crypto for an upfront fee are overwhelmingly a second scam targeting the same victims.
- Sharing screenshots of your portfolio in public groups. It marks you as a target for the next approach.
- Responding to "support" that contacts you first. Exchanges handle tickets inside the logged-in platform; the fake support checklist covers the pattern.
Related tools and guides
- How to avoid phishing
- Avoiding fake exchange and wallet apps
- Token approvals explained
- Fake support and phishing checklist
- Crypto security checklist: 10 basic rules
- How to spot crypto scams and rug-pull checklist
- P2P buying safety
- Seed phrase security
FAQ
Is a high APY always a scam?
No; some DeFi pools and exchange promotions pay high short-term yields with disclosed risk. The red flag is the word "guaranteed" or a fixed daily percentage with no explanation of where the yield comes from. Ask who pays and why.
My exchange account manager messaged me on Telegram. Is that normal?
Treat it as a scam until verified through the exchange's official verification page or by opening a ticket from inside your logged-in account. Legitimate staff will not object to that check.
I approved a token on a site I now distrust. What now?
Revoke the approval from your wallet or a block-explorer approval tool, move remaining assets to a fresh wallet if the approval was unlimited, and assume anything already approved could be taken. The token approvals guide explains the steps.
Can I get scammed without sending anything?
Yes. Signing a malicious message or approval, entering a seed phrase, or installing a fake app can hand over control without a visible transfer. The six flags cover these cases: flags 3, 5 and 6.
Does a referral code or rebate link indicate a scam?
Not by itself; exchanges run official referral programmes and this site publishes its codes openly. The risk is a referral link that points to a lookalike domain. Always confirm the domain and check the code is applied inside your real account, as described in how to verify a referral code after signup.
Bottom line
You do not need to recognise every scheme. Recognise the six requests they all make: a promised return, a deadline, an approval or transfer, an unsolicited tip, a lookalike page, and your seed phrase. One flag means pause and verify through a channel you opened yourself; two mean walk away. Combine that habit with whitelists, 2FA and small test transactions, and most of the 2024 loss categories in the IC3 report simply cannot reach you.
Educational content only, not legal or investment advice. Scam patterns, exchange security features and official verification tools change; confirm current procedures in your exchange's help centre.
