Crypto Scams: The Nine Patterns That Still Work

Crypto scams look endlessly novel and are structurally repetitive. Beneath the changing surface there are perhaps nine patterns, each with a tell that gives it away early, and almost every loss reported publicly fits one of them.

Learning the shapes is more durable than learning the current names, because the names change every quarter and the shapes do not.

1. The recovery phrase request

Any request for your seed phrase, in any context, from anyone. Support, migration, validation, an airdrop claim, a wallet upgrade. There is no legitimate version. The elaborate justification attached is the scam, not a reason to reconsider.

2. The approval drain

You sign what looks like a routine confirmation on a site that looks right. Nothing happens. Weeks later the tokens are gone, because you granted a contract permission to move them. This is the mechanism behind most EVM wallet losses, and it is covered fully in token approvals. The tell: an approval prompt when you expected a swap.

3. The impersonated support agent

You post publicly about a problem and receive help within minutes from an account with the right logo. It moves to private messages, walks through a diagnostic, and arrives at a screen asking you to import a wallet or approve a transaction. The tell: they contacted you.

4. The fake site above the real one

A paid search result for the exact product you use, with a pixel-accurate clone behind it. The tell: you arrived by clicking rather than by bookmark. Our guide on spotting fake crypto apps covers the checks in detail.

5. The giveaway that requires a deposit

Send 0.1 ETH, receive 0.2 back — endorsed by a hacked or impersonated account with a convincing follower count, often over a live video. The tell is arithmetic: nobody doubles money for strangers, and the promise is identical whether it is 2016 or now.

6. The romance and long-con investment scam

Weeks of genuine-seeming conversation, then an investment platform that shows growing returns and permits small withdrawals — until the large one requires a tax payment, then a fee, then a deposit. This pattern takes the largest sums of any on this list because it recruits trust before it asks for money.

The tell is structural: an investment opportunity that arrived through a relationship rather than a search, on a platform nobody you know has heard of, with a dashboard that only exists on their site.

7. The token you cannot sell

You buy, the chart rises, and every sale reverts — the contract permits buying and blocks selling for anyone but the deployer. The tell: an unaudited token contract with no verified source, promoted urgently, where the only liquidity is a pool the deployer controls.

8. The rug pull

A functioning project with real liquidity, until the team removes it or mints an unlimited supply. The tells are permissions rather than promises: an unlocked liquidity pool, an unrenounced mint function, upgradeable contracts controlled by a single key. All of that is public before you buy, which is why our DeFi protocol table scores who can change what.

9. The recovery service

The cruellest pattern: after you have been scammed, someone offers to recover the funds for an upfront fee. Blockchain transactions are irreversible, and nobody can retrieve them for a fee. Victims of the first eight are the target market for the ninth.

Why the same patterns keep working

None of these require technical sophistication, and that is precisely why they persist. They exploit ordinary reasoning under pressure: an authority that seems legitimate, a deadline that seems real, a person who has been kind to you for six weeks. The blockchain part is incidental — it only determines that the transfer cannot be reversed once made.

That irreversibility is what makes crypto attractive to this industry. A card payment can be charged back and a bank transfer can sometimes be recalled; an on-chain transfer is final within minutes. Every pattern here is a way of getting an ordinary person to make an irreversible decision quickly, and the countermeasure is almost always to slow down rather than to become more expert.

If it has already happened

Move any remaining funds to a fresh wallet before doing anything else, since an unidentified approval or a compromised key is still live while you investigate. Then revoke approvals on the affected address, document the transaction hashes from a block explorer, and report to your national fraud authority and to any exchange the funds reached — occasionally a receiving account can be frozen if you are quick.

Do not engage with anyone who contacts you afterwards offering recovery. Victim lists circulate, and pattern nine exists precisely to collect a second payment from people who have already lost once.

What all nine have in common

• Urgency: a window that closes, a price that moves, a support ticket that expires.
• Contact you did not initiate, or arrival by a route you did not choose.
• A request to sign, send or reveal something before you have had time to check it independently.
• An outcome that is guaranteed, which no real investment is.

A useful test before any irreversible action: could you explain this decision, out loud, to someone who is not involved and not excited? Most of these patterns collapse at that sentence, which is why isolation is a tool the people running them work hard to maintain.

Which is why the defences are boring and durable: arrive by bookmark, refuse every phrase request, read what you sign, and treat urgency itself as the warning. If a decision cannot survive twenty-four hours of delay, that is information about the decision.