How to spot fake crypto apps, websites and phishing

What is phishing?

Phishing means impersonating a real organisation to steal your password, OTP or seed phrase. In crypto the damage is worse, because stolen coins are almost impossible to recover.

Common tricks

Fake apps

They copy the name and logo of a well-known exchange or wallet, often installed as APK files from Facebook ads or Telegram links. The app shows a balance, but you can never withdraw.

Fake websites

Addresses that differ from the real one by a character or two, such as blnance instead of binance, or extra words added to the real name. Even Google ad links can be fake.

"Airdrops" and "free tokens"

"You have won $500 in tokens, connect your wallet to claim." Connect your wallet and sign one approval, and the scammer gains the power to move your coins.

Fake customer support

Post about a problem on social media and an "official support" account messages you right away. Real companies never come to your inbox asking for your seed phrase or remote access.

Clipboard malware

It silently swaps a copied wallet address for the scammer's.

Protection checklist

• Type addresses yourself or use saved bookmarks instead of clicking links.
• Install apps only from official stores, and check the developer name.
• Never enter your seed phrase, password or OTP via a link in a message.
• Ignore unknown "airdrops" and "free tokens".
• Check the first and last characters of an address before sending.
• Turn on two-factor authentication and put a PIN on your SIM card.

Phishing SMS messages in the name of bKash or Nagad ("your account will be closed") use exactly the same tricks. Never give anyone your PIN or OTP.

Key points

• Real companies never ask for your seed phrase, PIN or OTP.
• Check addresses yourself instead of clicking links.
• "Free tokens" are almost always a trap.