Crypto Phishing: Fake Exchange Sites and Support Calls

How crypto phishing and fake exchange sites work

Criminals build websites that copy real exchanges and wallets, sometimes with a web address that differs by one letter, and promote them through search ads, emails, and texts. Others call or message pretending to be an exchange's security team and claim your account is under attack. You are asked to log in through a link, read out a one-time code, or enter your wallet's recovery phrase. With that information, they take over the account or wallet and move the crypto out.

Warning signs of a crypto phishing scam

An unexpected call, text, or email saying your exchange account is locked or hacked.
A link to log in rather than an instruction to open the app yourself.
A search ad at the top of results that leads to a slightly misspelled site.
Any request for your password, two-factor code, or 12- or 24-word recovery phrase.
Pressure to act immediately to 'secure' your funds.
Requests to install software or move funds to a 'secure wallet'.
Sender addresses or domains that are close to, but not exactly, the real company's.

How to avoid crypto phishing

Bookmark your exchange and wallet sites and use only those bookmarks or the official app.
Skip sponsored search results when logging in to financial sites.
Never share a recovery phrase with anyone; no real company will ask for it.
Use an authenticator app or security key instead of text-message codes.
Hang up on callers who say your account has a problem and contact the company through its official site.
Use a unique, strong password for each exchange and your email.

Entered your details on a fake site? What to do now

If you still have access, change your passwords and two-factor settings from a clean device, and move any remaining funds to a new wallet you control.
Contact the real exchange through its official site or app to lock the account and report the theft.
Preserve evidence before anything disappears: screenshots of chats, profiles, websites and app screens, plus receipts, emails, and a written timeline. Do not delete conversations or the app. Save the fake website address, emails, texts, and phone numbers.
Report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, even if the amount is small. Include wallet addresses, transaction IDs (hashes), amounts, dates, and every website, app, username, and phone number involved. See /guidance/report-crypto-theft-fbi-ic3.
Follow the first-72-hours checklist at /guidance/crypto-stolen-first-72-hours.
Watch for recovery scams. Anyone who contacts you offering to get your crypto back for an upfront fee, or who claims to work with the FBI or IC3, is likely a scammer. IC3 says it will never ask for payment to recover lost funds or refer you to a company that does. See /guidance/can-stolen-crypto-be-traced.

Phishing and fake support: common questions

How do I contact my exchange’s real support?

Open the exchange’s official app, or type its address yourself or use a bookmark, and use the help pages there. Don’t call numbers from search ads, texts or emails: phone numbers found that way can be fake. No real company will ask for your recovery phrase. See how to reach real exchange support.

Someone from my exchange’s “security team” asked for my password or a code. What do I do?

Hang up or stop replying. Never share passwords, two-factor codes or your recovery phrase. Contact the company yourself through its official app or website.

I typed my recovery phrase into a website. What now?

Assume the wallet is compromised. From a clean device, move any remaining funds to a new wallet with a new recovery phrase immediately, then follow our first-72-hours checklist.

My exchange account was taken over. What should I do first?

If you still have access, change your password and two-factor settings from a clean device. Contact the real exchange through its official site or app to lock the account and report the theft, then report it to the FBI at ic3.gov.

Crypto phishing statistics

IC3 received 7,164 phishing/spoofing complaints with a cryptocurrency connection, with $111,025,191 in reported losses, in 2025. (source)

Request a case review

This guide is general information, not legal or financial advice. ChainWatch is not a law firm and does not guarantee fund recovery.

Sources

The information on this page was checked against the sources listed in September 2026. Laws, agency guidance, company policies and contact details change, so please verify the current information with the original source before you act.