Fake crypto apps and phishing sites: how to spot them before you lose money

Most people who lose crypto to fraud don’t have their blockchain hacked. They’re tricked into handing over access: downloading a fake app, typing their seed phrase into a fake site or signing a transaction they didn’t understand. This guide shows how those tricks work, using official warnings, and how to check any app or website before you trust it.

Fake investment apps

In July 2022, the FBI warned financial institutions and investors that criminals were creating fraudulent cryptocurrency investment apps. The criminals contacted US investors, claimed to offer legitimate crypto investment services and convinced them to download fake mobile apps. At that point the FBI had identified 244 victims and estimated losses of about $42.7 million.

The FBI described cases such as:

• An app using the name and logo of a real US financial institution, which took about $3.7 million from at least 28 victims between December 2021 and May 2022. When some victims tried to withdraw, they were emailed that they had to pay taxes first. After paying, they still couldn’t withdraw.
• An app using the name of a former legitimate exchange that had apparently closed in 2018.
• An app that told a victim he’d been enrolled in a program requiring a $900,000 minimum balance, and that his assets would be frozen unless he deposited it.

The pattern is the same one the FBI sees in crypto investment fraud generally, the largest source of reported losses to Americans in 2025: contact out of the blue, a professional-looking platform, fake profits, and fees to withdraw. See crypto scams and where to report them.

The FBI’s advice for checking an app

• Be wary of unsolicited requests to download investment apps, especially from people you haven’t met in person or whose identity you haven’t verified.
• Verify the app before downloading: confirm the company actually exists, check whether it has a website, and make sure any financial documents fit the app’s stated purpose.
• Treat apps with limited or broken functionality with skepticism.

Cloned websites

Fake sites copy real exchanges and wallets down to the last pixel. They reach you through:

• Search ads placed above the real result.
• Links in messages, emails or social media, including link previews that look legitimate. ethereum.org warns that scammers exploit link previews to make you think you’re visiting a real site.
• Look-alike domains that change one letter or add a word.

Once there, you’re asked to log in (stealing your password and 2FA code), “verify” your wallet with your seed phrase, or connect your wallet and sign a transaction.

Fake search ads

The FBI has warned that criminals buy search engine ads using domain names similar to real businesses. The ads lead to pages that copy the real site, including sites that look like genuine exchange platforms and ask for your login and financial details, giving the criminals access to your funds. Some ads also push malware disguised as legitimate software downloads.

The FBI’s tips:

• Check the URL before clicking an ad: a malicious domain may differ by a typo or a misplaced letter.
• Type the address of a business or financial institution into your browser instead of searching for it.
• Consider an ad-blocking extension when searching.

Clone firms

In the UK, the FCA warns about clone firms: scammers who pretend to be real, authorized firms. They may:

• copy a genuine firm’s website, changing small details such as the phone number;
• give you a real firm’s details but the wrong phone number, or use look-alike email addresses, sometimes from Outlook or Gmail;
• quote a genuine firm’s firm reference number (FRN) and even encourage you to look it up.

The FCA says clone firms sometimes offer cryptocurrencies that are non-tradable, worthless, overpriced or non-existent, and may contact you after you’ve searched online for loans or investments. Its advice: find the firm on the FCA’s Firm Checker, check it’s authorized for what it’s offering you, and use only the contact details shown there. If they don’t match, call the FCA on 0800 111 6768.

Phishing messages and fake support

ethereum.org describes support scams in which fake staff find people in public chat channels and message them privately, building trust to get their keys or funds. Genuine staff, it says, will never contact you through private, unofficial channels.

Common phishing messages:

• “Unusual login detected, verify your account here.”
• “Your wallet needs to be synchronized, enter your recovery phrase.”
• “You’re eligible for an airdrop, claim now.” See crypto airdrops explained.
• “Your withdrawal is on hold until you pay a fee.”

No genuine company will ever ask for your seed phrase. See seed phrase security.

Malicious transactions and approvals

On Ethereum and similar networks, a site doesn’t need your seed phrase to empty your wallet. It only needs your signature on the wrong transaction, for example an unlimited token approval that lets a contract move your tokens. ethereum.org advises against allowing unlimited spend limits and explains how to revoke approvals. Read what your wallet shows before you sign, and stop if anything is unclear.

How to verify any app or site: a checklist

1. Start from the official register, not from a link you were sent:
   • UK: the FCA’s Financial Services Register. Use the website and phone number listed there; scammers create “clone firms” that copy real firms’ details.
   • Canada: the CSA’s lists of authorized and banned platforms.
   • US: state licensing records and the company’s official site. See how to check if an exchange is registered.
2. Type the address yourself or use a bookmark you created. Don’t use search ads to reach financial sites.
3. Get the app from the official website’s link to the app store, and check the publisher name.
4. Check the domain character by character before logging in or connecting a wallet.
5. Never enter your seed phrase anywhere except your own wallet when you’re restoring it yourself.
6. Use a security key or authenticator app for 2FA, not SMS. See SIM swaps and 2FA.
7. Test withdrawals early with a small amount. A platform that makes withdrawals hard is a warning sign.

If you’ve already been caught

• Stop sending money, including any “fees” or “taxes” to unlock funds.
• Move remaining crypto to a new wallet with a new seed phrase, and change passwords and 2FA on your accounts.
• Report it to the authorities and to the platform you sent funds from. The FBI encourages victims of fake crypto apps to report to its Internet Crime Complaint Center (IC3). See where to report for the UK and Canada too.
• Beware of recovery scams: people offering to get your money back for a fee.