Common crypto scams explained

Common crypto scams fall into four families, sorted by what is taken from you: money you send willingly, an approval or a key that lets someone else move your funds, goods you release against a payment that is not what it seems, and the address your payment was meant to reach. Each family has a different point of control, and each pattern inside it is stopped by one specific check made before value moves.

That sorting matters more than any list of names, because the names change and the mechanics do not. A business needs to know which of the four things is at stake in the step it is about to take, and which check belongs to that step.

This article describes each pattern as the target sees it and gives the control that defeats it. The loss figures come from United States agencies and the regulator material from the United States, the United Kingdom and Australia, each named where it is used. It is general information, not legal advice.

What are the four families of crypto scams?

The four families of crypto scams are defined by what the other side ends up holding: your money, your signing authority, your goods or your payment's destination. Sorting a request into one of the four tells you where the control sits.

• Your money, sent willingly. You make a real payment, to a real address, on purpose, because you were given a false reason: a return, an instruction from someone you trust, or a fee that unlocks something. Investment schemes, impersonation and advance-fee or recovery schemes belong here. The control is on the decision: who is asking, confirmed through a channel you chose.
• Your approval or your keys. You do not send anything. You give away the ability to send: a seed phrase typed into a page, a signature that grants a spending permission, or remote access handed to someone presenting as support. The control is on the signature: what exactly is being authorised.
• Your goods. You are the one being paid, and you release goods or a service against a payment that never arrived, arrived in a worthless token, or arrived and was later frozen. The control is on receipt: what your own wallet shows, read by you.
• Your address. Both parties are honest and the payment is real, but the destination was swapped between the moment it was shared and the moment it was used. Address poisoning and clipboard substitution belong here. The control is on the data: the address used is compared with the address of record.

The families overlap in practice: an investment scheme often ends with a request to sign something. The classification still holds, because each step of a transaction puts only one of the four things at stake.

What do the official figures say about crypto scam losses?

The official figures say that reported crypto scam losses are large, concentrated in investment schemes and heaviest among older people. In its 2024 Internet Crime Report, the FBI's Internet Crime Complaint Center counted 149,686 complaints involving cryptocurrency, with reported losses of $9.3 billion, 66% more than the year before.

Investment fraud dominates by value: the same report records 41,557 cryptocurrency investment fraud complaints and $5.8 billion in losses.

The United States Federal Trade Commission publishes its own count, drawn from reports by consumers rather than from complaints to the FBI, so the two sets of figures cannot be added together. In data released in March 2025, the commission said consumers reported losing more than $12.5 billion to fraud of all kinds in 2024, of which $5.7 billion went to investment scams, the largest category. It added that people lost more money to scams paid by bank transfer and cryptocurrency than by all other payment methods combined.

More than 90% of the losses with a stated age fall on people aged 30 and over, the age of owners, partners and finance leads. Every one of these figures counts only what was reported to one agency in one country.

Which scams take your money or your keys, and what stops each?

Six patterns take either money you send willingly or the authority to move your funds, and each one is stopped by a single check made before you pay or sign.

In the first three rows the payment itself is technically flawless: the address is correct, the amount is the one you intended, and nothing in the wallet will warn you, because the fault is in the reason for paying. That is why the control is a call-back or a register lookup, made outside the conversation in which the request arrived.

The last three rows take authority instead of money. A seed phrase is the master secret from which every key in a wallet is derived, so whoever holds the words holds every account under them, permanently. The only remedy is a new wallet. A token approval is narrower: it is a permission, recorded onchain, that lets a named contract move a named token from your address up to a stated amount. Revoking it stops further movement and returns nothing already taken. Both are things you grant, and a grant deserves the same scrutiny as a payment.

Suppose, as an illustration, that a business wallet holds $140,000 of a dollar stablecoin and is about to pay an $84,000 invoice. A wrong payment puts $84,000 at stake. An unlimited approval signed on the way puts the whole $140,000 at stake, 1.67 times the invoice, plus anything of that token the address receives later. The signature prompt is the larger decision of the two.

What do regulators say about investment, impersonation and recovery schemes?

Regulators in several countries say the same three things in their own words: a guaranteed return is the mark of a scheme, a registered name can be borrowed, and a person who has lost money will be approached again.

The Federal Trade Commission's consumer guidance on cryptocurrency, last revised in February 2025, puts two tests in plain terms: only scammers demand payment in cryptocurrency in advance, and only scammers guarantee profits or big returns.

The Securities and Exchange Commission's investor education office describes relationship investment schemes, in which a contact made online or by text builds trust over time before proposing an investment, and notes that many involve crypto assets. It also warns that people impersonate the commission itself and well-known financial figures in messages and group chats, and that a filing with the commission is not evidence of approval or registration.

In the United Kingdom, the Financial Conduct Authority's page on crypto investment scams, updated in February 2026, describes adverts that lead to professional-looking sites where prices and returns may be invented. It advises checking a firm by name or reference number on its register and confirming that the contact details match the entry. It adds that most crypto activity is not regulated in the United Kingdom, so the ombudsman and the compensation scheme generally do not apply.

On recovery schemes, the Commodity Futures Trading Commission classifies them as a form of advance-fee fraud aimed at people already harmed. Its advisory lists the signs: payment requested before any service, fees described as a donation, a retainer or overdue taxes, and a caller who knows a great deal about your loss. The Australian Competition and Consumer Commission, through its Scamwatch service, adds a figure that explains why: one in three people who have been scammed are scammed more than once.

Which scams take your goods or redirect your payment?

Five patterns either obtain goods against a payment that is not what it appears to be, or redirect an honest payment to another address.

Fake payment proof works because the seller looks at what the buyer shows instead of what the seller's own wallet shows. The control is a rule that no image counts. A lookalike token is the same problem one level down: a token's name and symbol are free text that anyone can choose, and its contract address is the only identifier that cannot be duplicated.

The frozen payment is different in kind, because nobody forged anything. The terms of some dollar stablecoins allow the issuer to freeze the balance of an address, and exchanges and payment platforms can hold a deposit while they review where it came from. The proportionate answer for a high-value sale is to identify the buyer, ask where the funds come from, and keep the file.

The two address patterns leave both parties as victims of a third. Address poisoning places a near-identical address in a transaction history, where a hurried payer may copy it; clipboard substitution changes the address between copy and paste. In both, a check of the first and last few characters passes, so the comparison has to cover the full string.

Why are onchain payments final, and what does that change for the order of checks?

Onchain payments are final because no party in the system has the authority to reverse a confirmed transfer, and that moves every check to before the payment instead of after it. A card payment or a bank debit sits inside a scheme with dispute rules and an operator who can apply them. A transfer on a public blockchain is a signed instruction executed by the network; once it is confirmed, the only way the value comes back is that the holder of the receiving address sends it.

The Federal Trade Commission states the consequence in its consumer guidance: cryptocurrency payments do not come with legal protections, and they typically are not reversible.

On a reversible rail, part of the control work can sit after payment. On a final rail, identity, address and amount are confirmed before signing, a small first transfer proves the address before the bulk follows, and goods move only when the seller's own wallet shows the payment.

A worked example, with illustrative figures. A dealer sells equipment for $84,000, payable in a dollar stablecoin: a 25% deposit of $21,000 on signing and a balance of $63,000 before collection. The buyer first sends $25, which is 0.03% of the price, and the dealer confirms by phone, on the number in the signed contract, that $25 arrived at the address in that contract. The remaining $20,975 of the deposit follows to the same address. Before collection the buyer sends the $63,000 balance, and the dealer finds it in the dealer's own wallet, checks the token's contract address and only then releases the equipment. The three transfers total $84,000.

Each step protects a different party. The $25 test and the call protect the buyer's $20,975 and $63,000 from a substituted address. The wallet and contract check protects the dealer's $63,000 of equipment from a proof that is not a payment.

What is the ten-point routine before sending and before releasing goods?

The routine has ten points: six before you send a payment and four before you release goods or services against one.

Urgency is itself a finding: every pattern in this article depends on a check being skipped, and time pressure is how that is arranged. A second reader for the address and the amount is the cheapest control available.

How does a business build these checks into its payment process?

A business builds these checks into its process by fixing two things in writing before any payment is due: the addresses of record and the people allowed to sign.

For each counterparty, one address is stored with the date it was confirmed and the channel used. A change of address is treated like a change of bank details: never accepted on the strength of the message that announces it, and confirmed by a call to a known contact. Your own receiving address belongs in your contracts and invoices, so your payer has a record to compare against.

The wallet that holds operating funds should not be the wallet used to connect to unfamiliar sites, and the people who can sign from it should be named.

Where one payment has to be divided among several parties, the number of addresses to verify multiplies, and so does the exposure to a substituted one. A payment router addresses that case. Shaka is one such router: each party's share is set as a percentage of the deal and each recipient can sign their share before the client pays, the destinations are fixed and signed before the payment so the money cannot be redirected at the last minute, the client pays once, and every party is paid at the same moment in one transaction. It routes the payment and never holds the funds. The checks on who the counterparty is and why the payment is due remain yours.

Where do you report a crypto scam?

You report a crypto scam to the national fraud reporting service of your country, to the financial regulator where an investment or a firm is involved, and to the platform that sent or received the funds. Reporting is the precondition for any freeze, and a failed attempt is worth reporting too.

The United States list is the one the Federal Trade Commission gives in its own guidance, which adds the exchange you used to send the money.

Whatever the country, a useful report contains the same items: the transaction references, the sending and receiving addresses, the amounts and times, every message exchanged, and the names, numbers and accounts the other side used.

What is realistic to recover after a crypto scam?

Recovery after a crypto scam is realistic mainly when funds are frozen at a regulated intermediary within days, and it becomes unlikely once they have moved on.

The intermediaries that can act are exchanges, payment platforms, banks on the fiat side of a transaction, and in some cases the issuer of a stablecoin. They act on a report from you and, usually, on a request from law enforcement. The FBI's Internet Crime Complaint Center describes this in its 2024 report: its recovery team handled 3,020 complaints that year with a 66% success rate, and the report stresses that the process works when complaints are filed as quickly as possible. A transfer between two self-held wallets offers no such point of intervention.

The practical order is therefore fixed. Within the hour, tell the exchange or platform you sent from, and your bank if a wire or card funded the purchase. The same day, file with the national reporting service and keep the reference. Then secure what remains: a new wallet if keys may be exposed, revoked approvals, a checked device. Civil action against an identified party belongs with a lawyer.

The Federal Trade Commission notes that lists of people who have already paid are bought and traded, so a recovery offer typically follows a loss, from a caller who presents as a law firm or an agency. Legitimate lawyers and forensic firms exist and charge for their work; they do not approach victims first or promise a result. If a letter about restitution arrives, the Commodity Futures Trading Commission advises verifying it with the agency or court through contact details you find yourself.

What a business can realistically expect is a small chance of recovery that falls with every hour. The checks earlier in this article cost minutes, and they are the only part of the sequence where the outcome is still in your hands.