The scams that reach you before you have even opened an account

Pig butchering. Rug pull. Giveaway scam. Romance scam. Approval phishing. The names arrive faster than anyone can learn them, and that is the whole trouble with learning them: by the time one is well known enough to appear on a list, the people running it have changed the surface.

Underneath, the structures barely change. There are three that reach beginners, and this page is about learning to recognise the shape while the name is still new. Scale first, because it matters for calibration: the FBI's Internet Crime Complaint Center recorded 181,565 cryptocurrency-related complaints for 2025, totalling more than $11bn in reported losses, with investment fraud accounting for the largest share. That is the IC3's own annual report, not an industry estimate, and reported losses are always a floor rather than a ceiling.

Structure one: they build a relationship first

This is the one that takes the most money per victim, and it does not start with crypto at all.

It starts with a wrong number, a friendly reply on a language-exchange app, a professional connection who admires your work, a dating profile that matches suspiciously well. What follows is weeks — sometimes months — of ordinary conversation. Real questions about your day. Sympathy when something goes badly. Photos. Voice notes. Nothing is asked for.

The investment appears the way it would in a real friendship: sideways. A mention of a cousin who works in trading. A screenshot that was not really meant for you. Reluctance to explain when you ask. By the time there is a platform, you are the one asking to be included.

Then the platform works. The first deposit shows a gain. A withdrawal succeeds — usually a small one, and this is the step that closes the sale, because you have now personally proven that money comes back out. Deposits get larger. And at some point, withdrawal requires a fee, a tax, a verification deposit, an unfreezing payment. That requirement never ends.

The tell that survives every variant: the money moves outside the platform's own rails. You are asked to send funds to an address, or through an app that is not the platform's, or to a person. Real exchanges do not ask you to send crypto to an individual to fund your account, and no legitimate service asks you to pay a fee before releasing your own balance.

Structure two: they borrow an identity you already trust

Cheaper to run, faster, aimed at volume. Somebody arrives already trusted because they claim to be someone trustworthy.

The common wearers of that borrowed identity:

• Exchange support. Messages you first, usually after you posted publicly about a problem. Real support does not initiate contact in your direct messages, and it never needs your password, your two-factor codes, or remote access to your screen.
• A regulator or law enforcement. Contacts you about an investigation, a frozen asset, or a compliance step, and requires payment or a transfer to resolve it. Agencies do not collect money by chat.
• A recovery service. Finds you specifically because you were visibly scammed — often by monitoring the comments under scam-related posts. This is a second harvest on people already hurt, and it is discussed in the checklist for after the fact.
• A public figure. A stream, a post, a giveaway. Send X, receive 2X. This one is old and it still works because the production values keep improving.
• The exchange itself. A site or app that looks exactly right, reached through an ad or a message rather than through your own bookmark. That has its own page, because the countermeasures are mechanical.

The structural weakness of borrowed identity is that it cannot survive you going to the source independently. Not clicking their link. Not calling the number they gave you. Opening the app you already had, or typing the address you already knew, and asking there. Every impersonation collapses at that step, which is why so much energy goes into making you feel that stepping away would be rude or would cost you the opportunity.

Structure three: they promise a number

The purest form. No relationship, no borrowed badge — just a rate. Two per cent daily. Guaranteed eight per cent monthly. A doubling in ninety days. Sometimes with a slick platform, an app, referral tiers and a conference video.

The number is not incidental to the pitch. The number is the pitch, and it is also the flaw, because certainty is the one thing no investment can offer. Anything that generates return does so by taking risk. A fixed, guaranteed, market-independent return means either the risk is hidden from you or the returns are coming from the next person's deposit.

The useful move here is not to memorise a list of warning signs but to ask questions and watch how they are handled. Our claim checker is built around exactly that: you tick what you were told, and it shows you which structure those phrases belong to and what usually happens next.

Four questions that do the work:

1. Where does the return come from? A real answer names a mechanism and its risk. A fake answer names a technology — arbitrage, AI, high-frequency, market-making — with no explanation of who is on the other side.
2. Who holds the money and where are they registered? A real answer gives a legal entity and a jurisdiction you can search in a public register.
3. What happens in a bad month? A real answer describes a loss. Any answer implying there are no bad months has answered the question.
4. Can I withdraw everything tomorrow, and what does that cost? A real answer is a number and a timeframe, and it does not change based on how much you have deposited.

Why the first withdrawal always works

This deserves its own section, because it is the single step that converts a sceptical person into a committed one, and almost nobody sees it coming.

Early in the sequence you will be encouraged to withdraw. Not discouraged — encouraged. You take out a small amount, it arrives, and something changes in your reasoning that is very hard to reverse afterwards. You now have personal, first-hand evidence that the money comes back. Every subsequent doubt runs into that memory.

What actually happened is that a small sum was returned to you out of your own deposit, or out of somebody else's, at a cost of a few percent of what the operation expects to take. It is a marketing expense with an extraordinary return, and it is deliberately offered before the deposits get large.

Which is why "I tested it and it worked" is not the reassurance it feels like. The test is part of the product. The meaningful test is attempting to withdraw a substantial amount, unprompted, at a moment nobody suggested — and the response to that request is where the structure shows itself.

Where these approaches actually find you

People picture a suspicious email. The volume has moved elsewhere, and knowing where changes what you watch for.

• A message to the wrong number. An apologetic opener, a pleasant exchange, and a conversation that continues because it would be rude to stop. This is the standard entry point for the relationship structure and it is run at enormous scale.
• Replies underneath posts about crypto. Ask a public question about a platform and you will be contacted privately within minutes, sometimes by several accounts. Automated monitoring makes this cheap.
• Professional networks. A recruiter, a peer, someone praising your work. The framing is business rather than romance, which is what makes it effective on people who are certain they are immune to romance framings.
• Group chats you were added to. Trading groups, education groups, a signals channel. Most of the members are the operation. The rest are targets, and the enthusiasm is manufactured.
• Search advertisements. The paid slot at the top of a results page for an exchange's own name. Reaching your platform through a search is the habit that exposes you here, which is why the fake-site file spends most of its time on arrival routes.
• Video and audio that looks like someone you recognise. Synthetic media has made the celebrity-endorsement structure considerably cheaper to produce, and the giveaway version of it has not gone away.

The common thread is that almost none of it looks like an advertisement. It looks like a person, in a place you already were, being ordinary.

The four tells that survive every variation

Whatever the structure, whatever this year's name, an approach that is going to cost you money will almost always do these things. Not one of them — a genuine offer can accidentally do one. The combination is the signature.

If you remember nothing else from this page, remember that the last row is where the money is lost, and that it always requires your active cooperation. Nobody can drain an account you have not handed over. The first three tells exist to make the fourth feel reasonable.

What actually protects a beginner

Not vigilance — vigilance fades, and these operations are patient. What protects people are a few arrangements made in advance, when nobody is pressuring you.

• One route in, and it is yours. Bookmark the platform you use. Reach it only through that bookmark or an app installed from an official store listing you have verified once. Never through a search advertisement, never through a link someone sent you. This single habit defeats most impersonation.
• A rule about seed phrases that has no exceptions. There is no legitimate situation in which anyone needs your recovery phrase. Not support, not a regulator, not a wallet, not a migration, not a validation, not an airdrop. No exceptions means you never have to evaluate the argument.
• A twenty-four hour rule for anything with a deadline. If an opportunity cannot survive one night's delay, it was not an opportunity. This costs you nothing on real ones.
• One person you tell. A friend, a sibling, anyone. Not for their financial judgement — for the fact that describing the situation out loud to someone who is not inside it is the most reliable scam detector there is. Every version of these structures works by keeping the target's reasoning private.
• Phishing-resistant two-factor authentication. Codes sent by SMS can be intercepted. An authenticator app or a hardware key is better, and setting it up takes minutes.

The last one is worth doing on day one rather than later, because the day you need it is the day you cannot arrange it. If you are at the point of setting up an account, the registration walkthrough covers the security settings in the order that matters, along with how to confirm you are on the real site before you type anything.