Crypto phishing and fake apps: how to spot them before you lose funds
Fake wallet apps, look-alike exchange sites, search ads, fake airdrop pages and AI-written messages: how crypto phishing works and the habits that stop it.
- Checked against the rules: Nov 2026
- Sources cited · No buy or sell calls
Common tricks
- Look-alike websites: a URL one letter off, often promoted through search ads.
- Fake wallet apps: copies of MetaMask, Phantom or Trust Wallet in app stores or as APK files.
- Fake airdrop and points pages: "check your eligibility" pages that ask you to connect and sign.
- Impersonators: fake support on Telegram, WhatsApp or X, and fake exchange emails and SMS.
- AI-written messages and deepfakes: convincing messages, voices or videos of "founders" promoting giveaways.
Habits that stop most attacks
- Bookmark your exchanges and the DeFi apps you use, and open them only from bookmarks.
- Install apps from the official website link or the verified store listing. Avoid APK files.
- Never type your seed phrase into a website, form or chat.
- Read before you sign. If a wallet pop-up asks for unlimited approval or to move assets you didn't expect, reject it.
- Turn on strong 2FA on exchanges and email. 2FA for crypto.
- Use a separate wallet for new apps and airdrops. Farming wallet setup.
If you clicked something
- Entered your seed phrase: move funds to a new wallet now.
- Signed an approval: revoke it.
- Lost funds: what to do in the first hour, including calling 1930.
More in the security hub.
Sources
Was this guide helpful?