DEFENCE
Seven scam patterns, and the structural tell in each
Every one of these needs you to act before you check something that is cheap to check. That is the tell, and it does not change when the branding does.
In short
The shape they all share
Stories about scams go stale. The logo changes, the token changes, the celebrity changes, and a reader who memorised last year's story does not recognise this year's version of the same thing.
Mechanisms do not go stale. Every pattern below has the same skeleton: somebody needs you to act before you check a thing that would take under a minute to check, and they manufacture a reason why that minute is not available. Once you are looking for that shape, the surface details stop mattering.
1 — The support agent who needs your phrase
You post a problem in a public forum or a Discord. Within minutes someone helpful messages you privately. They are patient, they are competent, and eventually they need your recovery phrase to "validate" or "restore" or "sync" your wallet.
The tell: no legitimate process ever requires those words to be given to a person or typed into a form. None. There is no exception, no edge case and no emergency that creates one. Anyone asking is finished as far as you are concerned, however reasonable the rest of the conversation was.
2 — The approval that is not a payment
You connect a wallet to a site to claim something, and you sign a transaction. It does not move any money, so it feels harmless. What it actually granted was permission for a contract to move a token on your behalf, unlimited and indefinitely, at a time of its choosing.
The tell: you were asked to sign something whose effect you could not read. A signature request that your wallet cannot describe in plain language is one you should reject. Existing approvals can be reviewed and revoked, and doing that occasionally is worth more than any amount of caution at the moment of signing.
3 — The airdrop that needs gas first
A token you did not buy appears in your wallet, or you are told you qualify for one. To claim it you must first send a small amount to cover fees, or connect and sign.
The tell: value flowing away from you to unlock value flowing toward you. Real distributions do not require a payment to receive, and a token arriving unbidden is more often bait than a gift — some are constructed so that attempting to sell them executes something else entirely.
4 — The exchange that lets you withdraw once
You deposit a small amount into a new platform, trade, and withdraw successfully. It works. So you deposit a serious amount, and now withdrawal requires a tax payment, a verification fee, or a minimum balance you do not have.
The tell: the first withdrawal was the product. It cost them very little and bought the only thing they needed, which was your belief that withdrawal works. Any platform where taking money out costs money is not a platform.
5 — The person who is not trying to sell you anything
A long, warm, unhurried conversation — often romantic, often over weeks — with someone who never pitches. Eventually they mention an investment they use. They do not recommend it. You ask about it, which is the point.
The tell: the relationship preceded the opportunity and the opportunity arrived without being pitched. The absence of pressure is the technique, not evidence against it. This one takes the most money per victim of anything on this list, because the trust is real before the fraud starts.
6 — The address that looks right
You copy an address, paste it, and send. The paste was intercepted by malware, or you were given a near-identical address whose first and last characters match the one you expected.
The tell: you verified an address by its ends rather than its whole. Check the middle too, send a trivial test amount first for anything large, and be suspicious of an address that arrives in a chat message rather than one you generated.
7 — The recovery service that finds your lost funds
You lost access and posted about it. A service contacts you claiming it can recover the funds, for a fee, or for access.
The tell: the thing being offered is cryptographically impossible. Nobody recovers a lost private key. The only people who contact victims of loss are people harvesting a second loss from the same person, and the emotional state that makes the offer attractive is exactly what they are counting on.
Why "I would never fall for that" is the wrong posture
The people who lose money to these are not, on average, less careful than the people who do not. They were tired, or the message arrived at a plausible moment, or they were already anxious about something and the message spoke to it. Every pattern above is built to find a person at a bad moment rather than a foolish person at a good one.
The defence that works is procedural rather than attitudinal: a rule you follow even when you are certain it is unnecessary. Never type the phrase. Always test with a small amount. Always check the middle of an address. Rules survive bad moments; vigilance does not.
What to actually do
Slow down when something is urgent, because manufactured urgency is the one ingredient all seven share. Never type your phrase anywhere. Review and revoke old approvals. Send a test amount first. And accept that being early to a good opportunity is worth far less than not being early to a bad one.
Finally, verify custody architecture before touching any automated strategy. If a trading bot platform or Telegram group requires you to deposit crypto into their private wallet with promises of guaranteed daily yields, it is almost certainly a Ponzi or advance-fee fraud. Legitimate algorithmic trading software — such as our sister platform Segnals — operates on a strictly non-custodial basis: you retain 100% of your funds inside your own verified exchange account, connecting algorithms via trade-only API keys where withdrawal permissions are permanently turned off.
Last reviewed: 11 September 2026