Last fact-checked: October 6, 2026. Laws, tax rules, and platform policies can change; confirm with the regulator or official notice.
Short Answer: Most Crypto Scams Control the Process, Not the Blockchain
Many crypto scams do not hack your wallet. They persuade you to transfer funds voluntarily. The scammer builds trust, creates urgency, then demands more money for withdrawal, tax, verification, account unfreezing, or a guarantee deposit. FTC, CFTC, SEC, and Taiwan 165 all warn that social media, dating apps, investment groups, and fake platforms are common attack surfaces.
Remember one rule: if a platform asks for more money before allowing withdrawal, treat it as high risk.
7 Common Crypto Scam Scenarios
| Scenario | Common Script | Red Flag | What to Do |
|---|---|---|---|
| Fake exchange | Download this app or use this private URL | Domain looks unofficial, support only through private chat | Stop deposits and verify official domains |
| Investment group | Mentor signals, assistant reminders, guaranteed profits | Profit screenshots everywhere, no open discussion | Do not hand over accounts or send to their address |
| Romance investment scam | Online partner teaches crypto investing | Relationship pressure plus investment advice | Treat as a scam pattern and check FTC/CFTC warnings |
| Withdrawal tax trap | Pay tax, guarantee, or verification fee first | No payment, no withdrawal | Do not add funds; preserve evidence |
| Fake support | Account abnormal, provide seed phrase | Remote control, private keys, codes requested | Official support will not ask for seed phrases |
| Recovery scam | 100% recovery for wrong-chain funds | Upfront fee or wallet signature required | Use only the receiving platform's official process |
| AI trading bot | Daily fixed yield, zero risk | No strategy details, only dashboard numbers | Verify company, cash flow, and withdrawal ability |
12 Red Flags
- Guaranteed profit, principal protection, insider information, or risk-free returns.
- The platform can only be downloaded from a link sent by the other person.
- Support exists only in LINE, Telegram, WhatsApp, or private accounts.
- You cannot freely deposit or withdraw through your own bank or exchange.
- You are told to buy USDT and send it to a specific address.
- Withdrawal requires tax, verification, unfreezing, guarantee, or credit-score payments.
- The dashboard shows large profits but actual withdrawal fails, or small withdrawals work at first and larger ones are blocked.
- The person pushes a deadline, quota, or limited opportunity.
- You are asked to install an APK, configuration profile, remote-control tool, or unknown app.
- They request seed phrases, private keys, exchange passwords, or 2FA backup codes.
- The website lacks company information, compliance details, public fees, support center, or risk disclosures.
- When questioned, the person pressures you not to ask family, banks, or official channels, or frames any question as ignorance, fear, or failure to cooperate with risk control.
Platforms Recommended in Investment Groups
Investment groups on LINE, Telegram, WhatsApp, Facebook, Instagram, or YouTube ads are common entry points for fake crypto platforms. The group may include a mentor, assistant, students, profit screenshots, daily signals, AI trading models, a polished app, and a responsive support account.
The FBI explains that crypto investment fraud often reaches victims through dating apps, social media, professional networking sites, or encrypted messaging apps such as WhatsApp and Telegram. The SEC has also addressed schemes involving social media investment clubs and fake crypto platforms.
Group members may not be real. Fraud groups can stage interactions: one account asks questions, another posts profit, another claims a successful withdrawal, and another pressures newcomers to follow quickly. The purpose is not education; it is to make you feel late.
Watch for these group-specific signals:
- A stranger quickly moves the chat to LINE, Telegram, or WhatsApp.
- Many members post profits, but none of their identities can be verified.
- You buy crypto on a legitimate exchange, but the "investment" means sending it to a new platform or wallet.
- The mentor says the platform holds an overseas license, but offers only a screenshot or their own lookup link.
If you cannot independently verify identities, trading records, and platform legitimacy, group atmosphere is not evidence. For Telegram groups specifically, see Is a Telegram Crypto Investment Group a Scam?.
If you already deposited, do not confront the group first and do not pay another deposit. Follow the "First 30 Minutes" and "Evidence and Reporting" steps below.
AI Trading Bots: A Tool or a Profit Promise?
Trading tools can be real. A grid bot, for example, is a trading tool, not a scam by itself. Guaranteed returns are the problem. The CFTC warns that scammers exploit AI interest to market automated trading and crypto schemes with unreasonable or guaranteed returns.
Every strategy has market risk, liquidity risk, slippage, fees, and model failure risk. A grid bot can lose money in trending or volatile markets.
How to evaluate the product:
- Reject guaranteed monthly returns, fixed income, or risk-free arbitrage claims.
- Keep funds in your own exchange account, not a private wallet or unknown platform.
- If you must use API keys, allow trading only, disable withdrawals, and keep the ability to revoke access.
- Test with a small amount and a stop plan. Do not borrow to add more.
- Save strategy rules, fee disclosures, risk warnings, and actual trade records.
Common mistakes: looking only at backtest charts without drawdown and failure scenarios, and increasing leverage after a few profitable weeks.
How to Verify an Exchange
Do not judge only by web design. Fake sites can show fake charts, fake support, and fake withdrawal records. Verify from outside the platform, not from its own about page, license screenshot, or support statements:
- Do not click stranger links. Type the official URL or use a saved bookmark. A group admin's link is not an official link.
- Cross-check the official domain through search engines, official social channels, App Store, or Google Play. Look for strange spelling, short URLs, recently registered domains, and brand impersonation.
- Check whether the legal name, support email, announcements, and social accounts match, and whether the support email uses the official domain.
- Check whether the platform publishes fees, terms, risk disclosures, company information, and support channels.
- Search the platform name with scam, withdrawal, complaint, or fraud keywords.
- For Taiwan, check the FSC Securities and Futures Bureau VASP page to see whether a business has completed AML registration. If a platform claims to legally serve Taiwan but cannot be matched to a company and tax ID, be very cautious. Registration is still not a profit guarantee.
- Install apps only from official stores or official website entry points, not through TestFlight, APKs, or enterprise profiles.
Common misreadings:
- SSL lock: it only means the connection is encrypted, not that the platform is legitimate.
- Having an app: the FBI warns that fraudulent investment apps can appear through online searches or app stores, so an app alone is not proof.
- A small withdrawal worked: a failed small withdrawal to an account you control is a clear warning. A successful one is not proof of safety, because some scams allow small withdrawals to build trust before blocking larger ones.
Legitimate platforms may require KYC and account reviews, but they do not ask you in private chat to transfer funds to a support address to unfreeze withdrawals. If someone tells you to keep it secret or not ask your bank or family, stop.
Withdrawal Tax Traps
Scam platforms often say you made a profit but must pay tax before withdrawal. Taiwan's FSC has warned that scammers use claims such as guaranteed profit and high return with low risk, then demand unfreeze payments, deposits, or taxes.
A fast rule: if a platform says, "Send more money first, then you can withdraw your existing money," stop paying and switch to evidence preservation, independent verification, and reporting.
Separate two concepts:
- Real tax compliance: you report income under applicable tax rules and deal with tax authorities or professionals.
- Scam script: the platform demands USDT, a guarantee deposit, credit score payment, or verification fee before withdrawal.
| Script | Why it is risky | What to do |
|---|---|---|
| Pay tax before withdrawal | Tax is often used as a fake excuse for an advance fee | Stop paying and save the wallet address |
| Account frozen, pay to unfreeze | Fake platforms use frozen-account language to keep control | Ask for formal documentation and verify independently |
| Large withdrawal requires a deposit | Real reviews usually ask for documents, not a new transfer | Do not send more funds; organize TxIDs |
| You will lose access if you do not pay today | Urgency is used to bypass judgment | Screenshot the threat and slow down |
| Support moves you to Telegram or LINE | Real platforms usually use official tickets or authenticated support | Re-enter through the official website |
Normal review vs. scam collection:
- Normal review: identity documents, source-of-funds questions, transaction purpose, official support tickets, and a review period.
- Scam collection: send more crypto to a new wallet, use only private chat apps, promise instant withdrawal after payment, refuse verifiable company information, and threaten a countdown.
Many victims lose additional funds because the platform keeps moving the goalpost: tax, unfreeze fee, VIP fee, audit fee, or compliance deposit. Treat each new fee as a new risk event.
Tax guide: Taiwan crypto tax guide.
First 30 Minutes After Sending Funds
| Time | What to do |
|---|---|
| 0-5 min | Stop sending money. Do not pay tax, guarantee, or unlock fees, even if one more transfer is supposed to fix it |
| 5-10 min | Screenshot all chats, platform pages, URLs, support names, group members, and payment pages |
| 10-15 min | Save TxIDs, receiving addresses, token, network, amount, date, and time |
| 15-20 min | Change exchange, email, and chat passwords; reset 2FA; check for remote-control software |
| 20-30 min | Contact official support at the sending exchange; contact your bank if a bank transfer or card was used; contact 165 or police |
If the transfer is still internal or pending, speed matters. If it is already on-chain, still preserve the TxID and report. Contact both the exchange and law enforcement: exchanges may tag addresses or assist, and law enforcement is the formal reporting channel.
Common mistakes in this window:
- Deleting chats before preserving evidence.
- Telling the suspected scammer you are reporting, which may cause them to delete websites, groups, or chats.
- Posting ID and account details in public groups.
Evidence and Reporting
Complete evidence helps banks, exchanges, police, or investigators trace funds, but blockchain transactions are generally irreversible.
Back up everything locally and in cloud storage. Do not leave screenshots only inside a chat app.
| Type | What to save | Why it matters |
|---|---|---|
| On-chain data | TxID, asset, network, sending address, receiving address, time | Shows the crypto transfer path |
| Platform data | URL, app source, login page, account dashboard, support page | Helps identify fake platforms |
| Chat data | LINE, Telegram, WhatsApp, social DMs, with timestamps and context | Shows solicitation and payment demands |
| Money records | Bank transfers, card payments, exchange deposits, purchase and withdrawal records | Connects fiat money to crypto flows |
| Identity clues | Usernames, phone numbers, emails, referral codes | Helps compare cases |
| Ad data | Facebook, Google, YouTube, Threads ad links and screenshots | Useful for reporting and takedown requests |
| Payment demands | Any tax, guarantee, unfreezing, or verification payment demand | Documents the advance-fee script |
| Case records | Police report number, bank case number, exchange support ticket | Makes follow-up easier |
How to Organize TxIDs
A TxID is the transaction identifier on a blockchain. You may find it in an exchange withdrawal record, wallet history, or blockchain explorer. Do not paste only the hash. Add context:
- Asset, such as USDT, BTC, or ETH
- Network, such as TRC-20, ERC-20, or BEP-20
- Time and amount
- Sending and receiving addresses
- Exchange or wallet name
- Screenshot showing why the transfer was made
This helps support teams and investigators understand where the funds left from, where they went, and whether there were later transfers.
Reporting Order
- Contact the platform you actually used to pay. If you bought crypto on a legitimate exchange and sent it out, open an official support ticket with the TxID, receiving address, screenshots, and fake platform URL. Do not use links supplied by the suspected scammer.
- Use official Taiwan reporting channels. The 165 anti-fraud website has reporting, tip-off, and scam-ad reporting entry points, and you can call the 165 anti-fraud hotline for consultation.
- Prepare an English summary for cross-border services. If a foreign exchange, wallet service, or social platform is involved, include date, platform URL, wallet address, transaction hash, amount, scam script, and screenshots available.
If the scammer says reporting will permanently lock your account, treat that as pressure. Save the threat, report through official channels, and do not delete records because of it.
If a legitimate exchange has frozen your own account, that is a different process. See Exchange Account Frozen? Causes and Appeal Process.
Avoid Recovery Scams
After a scam, another scammer may pretend to be a lawyer, hacker, exchange employee, police officer, government official, or recovery company. The CFTC warns that recovery fraud often targets victims this way. They may claim your funds have been traced or frozen and only need one more fee to release them.
Use these rules:
- No one can guarantee recovery of on-chain funds, and no one can hack crypto back from a blockchain.
- Anyone demanding an upfront fee to recover funds is highly suspicious.
- Never provide seed phrases, private keys, 2FA, or exchange passwords.
- Do not allow strangers to remotely control your phone or computer.
- Do not sign wallet transactions you do not understand.
- If someone claims to be an official, look up the official contact yourself and call back. Do not use links or phone numbers they provide.
- If you ask for help online, share only necessary transaction data. Do not post personal ID, account data, email, or security information.
- Use official support, 165, police, banks, and licensed professionals.
Some cases do progress through exchanges, law enforcement, or chain analysis, but upfront-fee private recovery services are high risk.
Official Sources
- Taiwan 165 Anti-Fraud
- Taiwan FSC MoneyWise anti-fraud resources
- FTC: What to know about cryptocurrency scams
- FTC: Online love interest teaching investing is a scam warning
- CFTC: Relationship investment scam
- CFTC: Digital asset frauds
- SEC: Social media investment fraud alert
FAQ
Q: The dashboard shows real profits. Can it still be fake?
A: Yes. A fake platform can display any number. Withdrawing a small amount to an account or wallet you control is the first real test, but success does not prove safety; some scams allow small withdrawals before blocking larger ones.
Q: Is paying tax before withdrawal always a scam? The platform says regulation requires it.
A: Do not pay first. Tax compliance is handled through tax authorities or professionals, not by sending USDT to a private support address. Ask for verifiable formal documentation and check official sources yourself.
Q: I already paid one extra fee. Should I try again?
A: Usually no. Stop paying, preserve evidence, contact the exchange you used, and report the incident.
Q: Can a transfer be cancelled, or can an exchange recover USDT I already sent?
A: Usually no, and recovery is not guaranteed. If the transfer is still internal or pending, act fast. If it is on-chain, give the TxID and address to the sending exchange and police as early as possible.
Q: Should I contact police or the exchange first?
A: Do both. Exchanges may tag addresses or assist; law enforcement is the formal reporting channel.
Q: Someone says they can recover my assets, or claims to be an official. Should I trust them?
A: Be extremely cautious. Guaranteed recovery, upfront fees, seed phrase requests, or wallet signatures are common recovery-scam signals. Verify anyone claiming to be an official by calling back through a contact you looked up yourself.
Q: The site has an SSL lock and an app. Is that enough?
A: No. SSL only means the connection is encrypted, and fake apps exist. Verify the domain, company details, and regulator records independently.
Q: The mentor says the platform has an overseas license. Can I trust that?
A: Do not trust screenshots. Check the regulator's official website yourself and avoid links provided by the promoter.
Language: 繁體中文版本