How to spot a crypto phishing site or fake support agent

Phishing causes more losses to individual crypto users than any smart-contract bug. It works because the fake site is visually identical to the real one; the only differences are the domain and what happens after you sign.

The five common lures

1. Poisoned search ads. You search “binance login”, click the top result (an ad), and enter your credentials on binance-secure-login[.]com.
2. Urgent security emails. “Unusual withdrawal detected, verify within 24h.” The link leads to a clone; a fake 2FA prompt captures your code and the attacker replays it in seconds.
3. Fake support. You complain about a stuck deposit on X or Discord. Within minutes a “support agent” DMs you and asks for a screen share, seed phrase or a “verification” signature.
4. Airdrop and mint sites. A hyped token, a countdown, and a Claim button that asks you to sign a setApprovalForAll or Permit message.
5. Address poisoning. Attackers send tiny transfers from an address whose first and last characters match one you use, hoping you copy it from your history.

Tells that give a fake site away

• Domain. Read it right-to-left from the TLD: binance.com.verify-login[.]net is verify-login.net. Watch for rn instead of m, 0 for o, extra hyphens and unusual TLDs.
• Padlock means nothing. Any site can get HTTPS. The padlock proves encryption, not identity.
• Pressure. Countdown timers, “last chance”, “account will be suspended”.
• Requests that real services never make. Seed phrase, private key, remote desktop, sending funds to “verify” a wallet.
• Wallet prompts that do not match the action. Clicking Connect should never trigger a transaction or a typed-data signature. Read the approvals guide for what each prompt means.

Habits that make you immune

• Bookmark every exchange and dApp you use. Only ever open them from bookmarks.
• Type, never click links from email, DMs or search ads for anything involving money.
• Set an anti-phishing code on every exchange, so genuine emails identify themselves. See the exchange account guide.
• Use a hardware wallet that displays decoded transaction data on its screen. If the screen and the website disagree, the website is lying.
• Keep a separate hot wallet with small balances for anything experimental.
• Treat every unsolicited DM as a scam. Block and report.
• Verify pasted addresses by checking the first and last six characters against a trusted source, and send a small test amount first for large transfers.

If you already clicked

1. Disconnect from the internet if a wallet prompt is open and you have not confirmed it.
2. If you entered exchange credentials: change the password from a clean device, revoke sessions and API keys, and contact the exchange through the app, never through the link you received.
3. If you signed a wallet transaction: revoke approvals immediately and move remaining assets to a fresh wallet.
4. Report the domain to Google Safe Browsing and the impersonated company.

Losses to phishing are rarely recoverable, which is why prevention is the whole game. The security checklist covers every habit above.

Questions

How do phishing sites appear above the real exchange on Google?

Scammers buy search ads for exchange names and register look-alike domains (for example with a hyphen, a different TLD or a swapped letter). Ads appear above organic results, so a user who searches and clicks the first link can land on a clone. Bookmark the real site and never reach it through search ads.

Will an exchange ever contact me first by DM?

No. Exchanges and wallet providers do not initiate contact via Telegram, Discord, X or WhatsApp. Anyone who does is a scammer, even if their profile looks official.

What is a wallet drainer?

A malicious website script that asks your wallet to sign a transaction or message that transfers your assets or grants unlimited token approval. It is usually disguised as a mint, airdrop claim or verification step.