Bitcoin Basics

Avoiding Bitcoin Scams

Bitcoin itself has never been hacked. People lose bitcoin because someone talks them into sending it, or into handing over the words that control it. Scammers like bitcoin for the same reason you might: a payment is final. There is no bank to call, no chargeback, and no fraud department that can pull the money back. That makes knowing the tricks in advance the only real protection, and the good news is that there are not many tricks. Almost every scam is one of the dozen below wearing a new costume.

The one rule. Nobody legitimate will ever ask for your recovery phrase: not your wallet’s maker, not an exchange, not the government, not tech support, not us. The 12 or 24 words are your bitcoin. Anyone who asks for them, for any reason, however official or urgent or kind, is stealing from you. There are no exceptions to this, so you never have to judge a situation: the request itself is the proof.

Five signs you are being scammed

  1. They contacted you. A call, text, email, direct message, or a friendly stranger on a dating app. Real companies and agencies do not open conversations about your bitcoin.
  2. There is a clock. Your account will be closed, a warrant is out, the offer ends tonight. Urgency exists to stop you from thinking or asking anyone.
  3. Returns are promised. “Guaranteed,” “risk-free,” a fixed percent per day or week. Nobody can promise that, and anyone who could would not need your money.
  4. You are told to keep it quiet, or coached on what to say to your bank or the clerk at a bitcoin ATM. Honest transactions do not need a cover story.
  5. Payment must be in bitcoin, gift cards, or a wire. The IRS, the courts, the police, utilities, and Microsoft do not take bitcoin. Someone insisting on it has chosen the payment that cannot be reversed.

One sign is enough to stop. Hang up, close the tab, and check through a route you chose yourself: the phone number on the back of your card, the address you type by hand, a person you trust.

The scams, one by one

“Verify your wallet” and fake support

You ask a question in a forum, a Discord or Telegram group, or under a company’s post, and within minutes “support” messages you privately. Or an email says your wallet needs to be “validated,” “synchronized,” or “migrated,” with a link to a form. Every version ends at a page asking for your recovery phrase. Real support never messages first and never needs those words. A close cousin is the letter or email, sometimes after a real data breach, saying your hardware wallet is compromised and enclosing a “replacement” or a link.

Fake wallet apps, fake exchanges, and search ads

Scammers buy search ads and publish look-alike apps and sites, often one letter off the real name. You “log in” or “restore your wallet” and hand over your password or phrase. Get to wallets and exchanges from the maker’s own website, typed by hand or bookmarked, never from an ad, and check the developer name and review history before installing any app. A brand-new exchange with better prices than everyone else is not a bargain; it is a front that will show you a growing balance and never let you withdraw it.

The government, the utility, your bank’s “fraud department”

A caller says you owe taxes, missed jury duty, have a package with drugs in it, or that your bank account is compromised and your money must be moved somewhere “safe.” The instructions end at a bitcoin ATM, with the caller staying on the line and telling you what to say if the clerk asks. No government agency, court, utility, or bank will ever tell you to withdraw cash and feed it into a bitcoin machine. That single fact defeats this entire category. Many bitcoin ATMs now carry a warning sticker saying exactly this; believe the sticker.

The relationship that turns into an investment

Often called “pig butchering,” and the most financially destructive scam of all. It starts with a wrong-number text or a match on a dating or social app. Weeks of friendly, patient conversation follow. Eventually your new friend mentions how well they are doing trading crypto, thanks to an uncle or a special platform, and offers to show you. You start small, the site shows profits, you are even allowed to withdraw a little, and so you put in more. When you try to take out real money there are “taxes” and “fees” to pay first, and then the site and the friend disappear. The platform was fake from the first screen. Someone you have never met in person who steers the conversation toward investing is running this script, however real the affection feels.

Giveaways and “send one, get two back”

A video or post, apparently from a famous founder or company, promises to double any bitcoin sent to an address, for a limited time. The accounts are hacked or fake, and increasingly the video is a convincing deepfake. No one gives away money by asking you to send money first. Related: “airdrops” and QR codes that lead to a site wanting your wallet connected or your phrase entered.

Guaranteed returns, cloud mining, and “investment clubs”

A program pays a fixed daily or weekly return on your bitcoin, often with bonuses for recruiting friends. Early members really are paid, with later members’ deposits, which is what makes them sincere and persuasive recruiters. It is a Ponzi scheme and it ends the same way every time. Bitcoin pays no interest by itself. Any yield has a source and a risk, and a promoter who cannot explain both in plain words is not offering an investment.

Job offers and “tasks”

You are recruited for easy online work: rating products, “optimizing” apps, processing payments. The dashboard shows earnings piling up, but to unlock them you must first deposit your own crypto, again and again. A variation asks you to receive money and forward it as bitcoin, which makes you a money mule moving stolen funds, a crime even if you did not know. Real employers pay you; they do not charge you to be paid.

Blackmail emails

An email claims to have hacked your computer and recorded you, and demands bitcoin. It may include one of your real old passwords to seem credible. That password came from a past data breach of some website, not from your computer. These are sent by the million. Do not pay or reply; change that password anywhere you still use it, and turn on two-factor login.

Recovery scams: the second hit

After a loss, victims are contacted by “recovery agents,” “blockchain investigators,” or fake lawyers who promise to get the money back for an upfront fee, or who need your recovery phrase “to trace the funds.” Scammers sell lists of their victims to each other for exactly this. Nobody can reverse a bitcoin transaction, and genuine law enforcement does not charge you. Anyone who finds you with an offer to recover your money is the same crime, round two.

Swapped addresses

Malware can replace a bitcoin address you copied with the thief’s when you paste it, and “address poisoning” plants a look-alike address in your transaction history hoping you will copy it later. The defence is a habit: check the first and last several characters of every address on the screen you are sending from, and send a small test amount first. More on this in Keeping Your Bitcoin Safe.

In person

Be wary of a helpful stranger who offers to set up your wallet for you: whoever sees the recovery phrase owns the coins, and a wallet that arrives “pre-configured” with a phrase already printed on a card is a trap. And do not tell people how much bitcoin you have. Most theft is digital, but the simplest attack is someone who knows you hold a lot and knows where you live.

Keeping your private keys safe

When you hold bitcoin in your own wallet, what you really hold is a secret number called a private key. Your wallet shows it to you as a recovery phrase (also called a seed phrase): 12 or 24 ordinary words, in order. Anyone with those words can recreate your wallet on their own device and spend everything in it, from anywhere, without your phone or your password. Lose the words and your device, and the bitcoin is gone for good. So there are two jobs: stop anyone else from seeing the words, and make sure you never lose them. Wallets and Self-Custody explains the ideas; this is the checklist.

  • Write the words on paper, by hand, in order, when the wallet first shows them. Check every word twice. For an amount that matters, stamp or engrave them on a metal plate, which survives fire and water.
  • Never make a digital copy. No photo, no screenshot, no note on your phone, no email to yourself, no cloud drive, no typing them into a document “just for a minute.” Phones and cloud accounts are what thieves break into, and malware looks for exactly this.
  • Never type them into a website, ever. The only place a recovery phrase is entered is a wallet app or device you are deliberately restoring, that you installed yourself from the maker’s own site.
  • Keep two copies in two separate, private places, such as a home safe and a safe deposit box or a trusted relative’s home. One copy is a single fire or flood away from nothing.
  • Use a hardware wallet once the amount would hurt to lose. It keeps the key on a separate device that never exposes it to your computer. Buy it directly from the manufacturer, never second-hand or from a marketplace seller, and never use one that arrives already set up.
  • Test your backup before you trust it. With a small amount in the wallet, wipe it and restore it from your written words. Better to find a mistake in your handwriting now than in five years.
  • Do not get clever. Splitting the phrase into pieces, scrambling the order, or adding a secret extra word are all ways people lock themselves out. Simple, written down, in two safe places, beats ingenious.
  • Make sure someone can find it if you cannot. A sealed letter with your will, telling a person you trust that the bitcoin exists and where the instructions are, without putting the words themselves in the will, which becomes a public record.

If your bitcoin is on an exchange rather than in your own wallet, you have no recovery phrase to protect; your password, your email account, and your phone number are the keys instead. Keeping Your Bitcoin Safe covers locking those down.

If it has already happened

  1. Stop sending. The “fee to release your funds” is part of the scam. There is no amount that unlocks anything.
  2. If your recovery phrase may have been seen, create a brand-new wallet with new words and move whatever is left to it immediately. The old wallet is compromised forever.
  3. If you paid from a bank account or card, or fed cash into a bitcoin ATM in the last few hours, call your bank and the ATM operator’s number on the machine at once. Occasionally a payment can still be stopped.
  4. Tell the exchange you used, if any. They can freeze an account or flag the receiving address.
  5. Report it: to the FTC at ReportFraud.ftc.gov, to the FBI’s Internet Crime Complaint Center at ic3.gov, and to your local police for a report number. Keep screenshots, addresses, transaction IDs, and messages. Recovery is rare, but reports are how these operations get shut down, and you may need the paperwork for your taxes.
  6. Expect the recovery scammers next, and ignore them.
  7. Tell someone you trust. These crimes are run by professionals with scripts refined on thousands of people, and they catch doctors, engineers, and police officers. Shame is what keeps victims quiet and keeps the scam working.

Next