Spot Scams and Build a Safe Learning Routine

Scams often begin with an ordinary conversation or an apparently helpful message. The attacker wants you to act before you verify. You do not need to memorise every scam name to defend your learning routine. Focus on the request: what authority, money or private information is someone asking you to hand over, and how did you independently confirm that request?

Education only. Crypto assets can lose substantial value or become worthless. No lesson requires buying an asset, depositing money or sharing real passwords, private keys or recovery words.

See why crypto attracts scammers

Pickpockets love crowded markets: everyone is distracted, and a stolen wallet vanishes into the crowd. Crypto gives scammers similar conditions online. It moves fast, crosses borders in minutes and, as the loss and safety lesson in Level 0 showed, a confirmed transfer generally cannot be reversed.

The US Federal Trade Commission (FTC) offers one rule worth remembering: only scammers demand payment in cryptocurrency. A real tax office, utility company or employer will not insist you pay in crypto.

Scammers use many stories, but a few patterns repeat. The most damaging one starts with a friendly message.

Recognise the relationship investment scam

Imagine a stranger who befriends you at a bus stop, chats every day for weeks, and only then mentions a "sure" investment their uncle runs. By then you trust them. That slow build is the heart of this scam.

The FBI describes a clear sequence. Contact begins on social media, dating apps, messaging groups or a "wrong number" text, and soon moves to a private messaging app. The scammer builds trust with flattery and shared stories, sometimes using deepfake video. Then comes the pitch: crypto trading, an "AI" programme or gold.

The US Commodity Futures Trading Commission (CFTC) lists six warning signs: the new friend wants to move to a private app; they message often but can never meet; they claim to be wealthy from crypto or currency trading; they recommend a trading website that only accepts crypto; they tell you to send funds to their wallet or platform; and you seem to make a lot of money quickly.

The pitch may lead to a platform, and those platforms deserve a closer look.

See through fake platforms and withdrawal fees

A fake trading platform can display whatever numbers its operator chooses. A rising balance or an early withdrawal may be part of the deception rather than evidence of real trading. The next request often asks for more money to unlock a withdrawal, pay an invented tax or repair an account.

Legitimate services can have disclosed charges, and a self-custody transaction may need a native network fee. The red flag is an unsolicited, unexplained advance-payment demand combined with claimed profits or authority. Verify the actual fee process independently. Paying a stranger because a screen says tax does not satisfy a real tax duty.

Fake support messages claim that an account needs urgent repair. Pump groups encourage coordinated purchases while insiders may sell. A claim that a market strategy cannot lose conflicts with the risks of price, access and counterparties. Evaluate the actual service and its rights, rather than treating a convincing conversation as evidence that the investment exists.

Open diagram at original size ↗

Read diagram as text

First contact → move to a private app → build trust → investment pitch → small deposit and an allowed early withdrawal → fake profits and pressure to add more → a claimed withdrawal fee or tax, then silence.

The image flags the private-app move and the small early withdrawal. A dashed branch marks a follow-up recovery scam promising to recover lost money for a fee.

Spot impersonation, fake giveaways and fake support

Impersonation means pretending to be someone you already trust. The FTC warns that scammers pose as well-known companies, banks, government agencies and celebrities, contacting people by text, email, social media or pop-up warnings, and demanding payment in crypto.

A common version is the fake giveaway: a post, often using a famous face or a hacked account, promising to send back double whatever you send. No genuine giveaway asks you to pay first. Another is fake support: you post a problem online, and a "helpdesk agent" messages you privately, pointing you to a fake website or asking for screen access or recovery words.

Impersonation borrows trust. The next group of scams sells a promise of growth instead.

Avoid doubling fake mining and recruitment schemes

Some schemes promise fixed daily or weekly returns: "earn 2% a day", "double your money in a month". Often they claim the profit comes from secret trading, "mining" machines you rent, or an AI robot. In a Ponzi scheme, early investors are paid with later investors' money, so it collapses when new money slows. Many add multi-level marketing: bonuses for recruiting friends and family.

A related trap is the pump-and-dump group, where organisers hype a small token so that members buy, then sell their own holdings at the top. The token research lesson in Level 5 explains these in detail. "Cloud mining" offers are covered in the mining and fee lessons in Level 1.

All of these promise a fixed, high return with little risk. As the ownership and paper practice lesson in Level 0 showed, crypto prices fall as well as rise, so steady profit does not fit the asset. Scams can also arrive through ordinary payments between people.

Do not use the message's phone number, link or QR code as the verification route. A sender name, profile picture or blue badge can be copied or obtained; it is not enough by itself. A password manager may help notice an unfamiliar domain, but it cannot certify an application's safety. If you cannot establish the source independently, pause rather than letting the message supply both the claim and its supposed proof.

Recovery words and private keys are not normal support information. Someone who obtains them may gain authority over assets, even without the device or account password. A legitimate-looking form that asks for them should stop the process. Remote-access software is also powerful: it can expose screens, files and account sessions. Do not install it because an unsolicited caller claims it is necessary for a refund or wallet repair.

A signature request may be dangerous even when no network fee is shown. Some signatures authorise orders or permissions that can be used later. At this level, use a simple rule: if you cannot explain the message and the authority it grants, do not approve it. Level 2 will separate connecting, signing, sending and approving in detail. Familiarity with a site's colours does not replace inspection of the action.

Read the action rather than the promise

An address copied from recent transaction history may belong to an attacker who inserted a lookalike entry. This is often called address poisoning. Shortened displays can hide differences in the middle of a long address. Obtain the destination through the intended recipient's verified instructions and compare the full information. A QR code is a method of encoding information, not a certificate of identity.

Urgency narrows attention. A message that threatens immediate loss, promises a vanishing opportunity or asks you not to tell anyone is trying to shorten your checking time. Make a pause routine: identify the sender, name the requested action, identify the authority involved, verify independently and decide whether the action is necessary. A genuine issue should be assessed through the provider's actual procedures, not through the caller's deadline.

Handle P2P and mobile money payments with care

In a peer-to-peer sale, a platform may hold crypto in escrow while the buyer pays through a bank or payment service. That arrangement protects only what its rules actually cover. A screenshot, SMS alert or urgent message is not proof of settled receipt.

Check your own account through its genuine application and follow the platform's identity, payment and dispute procedures. A payment from a different person's account can involve fraud or later disputes. Some payment methods remain reversible after a visible credit. Ask the payment provider what finality means for that method.

Do not release escrow solely because someone is rushing you, and do not move the deal into private chat for a discount. If details do not match, pause and use the platform's official process. This course asks you to analyse the scenario, not conduct a real trade.

Use a notebook with three headings: what I understand, what I still need to verify and what I will not do. Keep examples fictional and omit private account details from screenshots. Schedule short study sessions, complete the practice answers and revisit difficult terms. Before any optional real-world activity, repeat the relevant safety checks rather than assuming that passing a quiz makes every application safe.

If you suspect a scam, stop engaging with the requester, preserve non-secret evidence such as messages and transaction identifiers, and use independently verified provider or local reporting channels. Do not pay an unsolicited recovery agent. Some incidents need urgent technical help, but urgency should not give an unknown person your secrets. The incident lesson later in the course supplies a more specific response tree. For now, your best first action is to prevent the next harmful authorisation.

Everyday example

What to remember

Lesson completion check

References and further reading