How to tell a fake crypto site or app from the real one

Fake platforms are not usually caught by looking carefully at the page. They are pixel copies — the real CSS, the real images, sometimes the real support chat proxied through. Judging by appearance is judging on the one dimension the attacker fully controls.

What follows are checks on things they cannot control.

Reading a domain the way a browser does

Browsers do not read domains left to right, and neither should you. The rule: find the first single slash after the protocol. Work backwards from there to the second-to-last dot. What lies between is the registrable domain — the part someone had to buy.

Two additional traps worth knowing about:

• Character substitution. A lowercase L and a capital I are hard to tell apart in many fonts, as are rn and m. Some alphabets have characters that render identically to Latin ones, and browsers usually but not always display these as punycode.
• Search advertisements. A sponsored result at the top of a search page is a purchase, not an endorsement. Fake exchange sites have repeatedly appeared above the genuine one for the exchange's own name.

The padlock proves the connection, not the company

This is the most widespread misunderstanding in the whole area, and it is worth being blunt about.

The padlock means traffic between you and the server is encrypted. That is it. It says nothing about who owns the server, whether they are honest, or whether the business exists. Certificates are free and issued within seconds to anyone who controls a domain — including the person who registered binance-support.help this morning.

Encrypted connection to a fraudulent site is an encrypted connection to a fraudulent site. The padlock has done its job perfectly and told you nothing you needed to know.

Apps: the developer field is the check

Fake applications reach app stores regularly. They copy the name, the icon, and the screenshots, and they are usually removed — after a window during which people install them.

What to check, in order:

1. The developer or publisher name on the listing. Compare it against what the platform's official site says its publisher is. Not the app name — the publisher line underneath.
2. Review count and history. A genuine major exchange app has an enormous number of ratings accumulated over years. A few hundred recent five-star reviews is a signature, not a recommendation.
3. Arrive from the official site. Best of all: follow the download link from the platform's own website, reached through your bookmark. That way you never search the store at all.

And a rule with no exceptions attached: never install a crypto application from a file sent to you, a link in a message, or a website offering a version that is "newer than the store one". Sideloading on the instruction of a stranger is the endgame of several documented scams.

What a fake site does once you are on it

Knowing the sequence helps, because the tell often arrives after the page has already convinced you.

The simplest version harvests and stops: you enter a password, nothing happens, and you try again on the real site. The credentials are used later, elsewhere.

The more effective version relays in real time. The fake site passes what you type straight to the genuine one and shows you whatever comes back. It asks for your password, then for your two-factor code — and because the code is being used within its short validity window, the login succeeds on the real platform in the attacker's session. This is why an authenticator app is not a complete defence and a security key is, since a key checks the domain it is talking to and will not answer a lookalike.

The wallet version does not ask for anything secret at all. It asks you to connect a wallet and approve a transaction, and the approval is not the one described on screen — it grants permission to move tokens later, sometimes long afterwards. The signature request is the moment to slow down, and if the wallet cannot show you in plain language what you are approving, the correct answer is to reject it.

The one behaviour common to all three: a fake site always needs an action from you. Visiting a page does not empty an account. Typing, approving, or installing does.

The check that makes the others unnecessary

Everything above is detection, and detection has a hit rate below one hundred per cent because you will eventually be tired or distracted.

Prevention is better and it is one habit: have exactly one route in, and use it every single time. A bookmark you made carefully once, or an app you installed once from a verified listing. Never a search, never a link, never a message, no exceptions for convenience.

Someone who does this cannot be phished into a fake site, because they never arrive by a route an attacker can inject. It converts an ongoing judgement problem into a one-time setup task. Our source verification checklist is that setup task written out, including how to confirm the support channel and the app publisher the first time.

If you are at the point of creating that bookmark, the registration walkthrough starts exactly there, because it is the step everything else depends on.