How to protect yourself from crypto scams.

AutoFXRebateHow to protect yourself from crypto scams

Crypto theft usually takes seconds: a seed phrase typed into the wrong box, or a signature you did not read. Your protection has to be in place before that moment, as habits you follow without thinking.

Keep your seed phrase off every screen

Your seed phrase is the master key to a self-custody wallet. Whoever has those words has your coins, from any device, anywhere.

• Write it on paper or metal, and store it somewhere private and safe from fire and water.
• Never photograph it, save it in cloud notes, or email it to yourself.
• Never type it into a website, chat or form. The only place it belongs is a wallet you are restoring yourself.
• No exchange, wallet maker or support agent will ever ask for it.

Lock down your exchange accounts

• Use a long, unique password for each exchange, kept in a password manager.
• Turn on two-factor authentication with an authenticator app or a hardware security key.
• Avoid SMS codes where you can. In a SIM swap, a scammer persuades your phone carrier to move your number to their SIM card, and your codes go to them.
• Ask your phone carrier whether it offers an account PIN or a lock against moving your number, and turn it on.
• Open your exchange from a bookmark or its official app, never from a link in an email, a text or a search ad.
• Turn on a withdrawal allowlist if your exchange offers one, so funds can only leave to addresses you saved in advance.
• Set an anti-phishing code if your exchange offers it. It is a word you choose that appears in every genuine email from the exchange, so a fake email stands out.

Split your money between hot and cold storage

A hot wallet keeps its keys on a device connected to the internet, such as a phone app or a browser extension. A cold wallet keeps the keys offline, usually on a hardware device.

Coins left on an exchange are online too, and the exchange holds the keys. The lesson on types of crypto wallet compares them.

Keep in a hot wallet only what you can afford to lose to one bad click. Here is an illustrative split:

1. You hold $5,000 of crypto in total.
2. You keep $300 in a browser wallet for trading and trying new apps, and $4,700 on a hardware wallet.
3. A drainer site empties the browser wallet. You lose $300, which is 6% of your holdings.
4. If everything had sat in the browser wallet, the same click would have cost $5,000.

A hardware wallet keeps your keys off your computer. It will still sign a harmful transaction if you approve it on the device, so read the device screen before you press the button.

Check every transaction before you sign

• Send a small test to any new address first, confirm it arrived, then send the rest. If the network fee is $1 in this example, the test adds $1 to a $2,000 transfer.
• Read what a site asks you to sign. An approval lets a contract move your tokens later, so approve only the amount you need and revoke old approvals you no longer use.
• Take token contract addresses from the project's official site, never from a search ad or a reply in a chat.
• Copy addresses from the source, never from your transaction history, which address poisoning targets.
• Compare the start, the end and a chunk in the middle of the address. Lookalike addresses are built to match the ends.

Slow down when someone else sets the pace

• Treat any unsolicited message about money as a scam until you check it through a channel you found yourself. That includes messages from strangers, "support agents" and friends whose accounts may be hacked.
• Set yourself a waiting rule, such as 24 hours, before any transfer someone else asked for. A genuine opportunity will still be there tomorrow, while a scam depends on speed.
• Talk to someone you trust before you send money. Scammers ask you to keep quiet because a second pair of eyes often spots the trick.

The lesson on how to spot a crypto scam lists the warning signs to watch for.

If something goes wrong

1. Stop sending money, whatever new fee or deadline appears.
2. If you signed a drainer's approval, revoke it at once. If your seed phrase leaked, move what is left to a new wallet with a new seed phrase.
3. Change your exchange password and 2FA, and contact the exchange through its official site. If stolen coins reach an exchange, it may be able to freeze them.
4. Record transaction IDs, addresses, usernames and dates, and report to the police and your financial regulator.
5. Ignore anyone who offers to recover the coins for a fee.

The forex lesson on what to do if you have been scammed covers reporting and evidence in more detail.

Keep learning

Chapter 4What are the most common crypto scams?01The most common crypto scams are fake investment platforms that show profits you can never withdraw, schemes that promise fixed returns, impersonators running fake giveaways or support chats, phishing sites and wallet drainers that steal access, and rug pulls. They all rely on one fact: a confirmed crypto transfer cannot be reversed.Chapter 4How to spot a crypto scam.02To spot a crypto scam, check four things. The offer: a guaranteed or high fixed return. The person: a stranger who contacted you first and wants speed or secrecy. The platform: an unknown app that wants a fee before you can withdraw. The payment: a request for your seed phrase, a wallet approval or a transfer to a personal address.