3.10[Security, Custody & Trust](https://wealtii.com/learn) # Crypto Phishing: How to Recognize and Avoid Attacks By [Zayd Ahmed](https://wealtii.com/editorial-policy#zayd-ahmed), Founder & CEO, Wealtii · Published 12 February 2026 · Last reviewed 21 October 2026 **Crypto phishing** is a scam that impersonates a trusted exchange, wallet or support agent to trick you into revealing your password, 2FA code or recovery phrase, or into signing a malicious transaction. You can spot most attempts by their urgency, unexpected links, look-alike web addresses and any request for your recovery phrase. ## How common is crypto phishing? Phishing and spoofing was the most-reported crime type to the FBI's Internet Crime Complaint Center (IC3) in 2025, with 191,561 complaints. Complaints that combined phishing with cryptocurrency numbered 7,164, with $111.0 million in reported losses, and fake technical or customer support schemes involving crypto cost a further $1.23 billion (FBI IC3 2025 Internet Crime Report). Reported figures understate the real total, because many victims never file a report. ## What are the main types of crypto phishing? | Type | What it looks like | Defence | | --- | --- | --- | | **Search-ad clones** | A sponsored result for "wallet download" or "exchange login" leads to a copy of the real site | Use bookmarks; type addresses yourself | | **Email and text alerts** | "Unusual login detected" or "withdrawal pending" with a link to "secure" your account | Open the app or site directly, never the link | | **Fake support** | An "admin" messages you after you post a question in Telegram, Discord or X | Real support does not open private chats first | | **Wallet drainers** | A fake airdrop, mint or claim page asks you to connect and sign | Use a burner wallet; reject unexpected approvals | | **Address poisoning** | Tiny transfers from an address that matches the first and last characters of one you use | Copy addresses from a saved contact, not your history | | **Fake apps and extensions** | A copycat wallet in an app store or browser extension store | Install via the developer's official website link | | **Voice and video impersonation** | A call from your "exchange" or a deepfake of a known figure | Hang up; call back on a number you look up yourself | Phishing is one tactic among many; our catalogue of [common crypto scam types](https://wealtii.com/learn/common-crypto-scams) covers investment fraud, rug pulls and recovery scams. ## What are the warning signs of a phishing message? CISA lists four classic signs: urgent or emotional language, requests for personal or financial information, untrusted shortened links, and incorrect addresses such as amazan.com. CISA also warns that polished grammar no longer rules out phishing, because AI tools write convincing text. Crypto adds its own signs: - Any request for your 12 or 24-word [recovery phrase or private key](https://wealtii.com/learn/private-keys-and-seed-phrases), for any reason. - Instructions to "validate", "synchronise" or "rectify" your wallet on a website. - Requests to read out or forward a 2FA code; see why [phishing-resistant 2FA](https://wealtii.com/learn/two-factor-authentication-crypto) stops this. - A surprise token, NFT or airdrop with a link to "claim" it. - A QR code that opens a login or wallet-connect page. - Pressure to act before a deadline, account suspension or "tax" payment. ## How do you check a link or signature request before acting? 1. **Read the domain from right to left.** In login.exchange.com.secure-check.io, the real domain is secure-check.io. 2. **Use your own route in.** Open the app, a bookmark, or an address you type, rather than the link you were sent. 3. **Read the wallet prompt.** Check whether it is a transfer, an approval or a permit, which token, and what spending limit. 4. **Check the contract.** A block explorer shows whether a contract is new, unverified or flagged. 5. **When unsure, reject.** A genuine opportunity will still be there after you check through official channels. ## What should you do if you clicked a phishing link? - **Entered a recovery phrase:** treat the wallet as compromised and move funds to a new wallet with a new phrase now. - **Signed an approval:** revoke it with a block explorer's token approval checker and move valuable assets. - **Entered a password or 2FA code:** change the password, reset 2FA, sign out other sessions and check withdrawal settings. - **Report it:** the FTC asks people to forward phishing emails to reportphishing@apwg.org and texts to 7726, and to report at ReportFraud.ftc.gov. For a full recovery plan, read [what to do after a crypto hack](https://wealtii.com/learn/what-to-do-if-hacked). ### Messages that claim to be from Wealtii Wealtii support is ticket-based and reachable at support@wealtii.com. Treat any message using the Wealtii name that asks for your password, a 2FA code or a recovery phrase as phishing, and reach your account by typing wealtii.com into your browser. The [Wealtii security page](https://wealtii.com/security) describes how sign-in verification works. ## Frequently Asked Questions ### What is the most common crypto phishing scam? Fake login and support pages are the most common. A message or search ad leads you to a copy of a real exchange or wallet site, which collects your password, 2FA code or recovery phrase. Fake support agents on Telegram, Discord and X use the same trick in private messages. ### Can I lose crypto just by signing a message? Yes. Some signatures are not simple logins but permissions, such as token approvals, permit signatures or NFT approval-for-all requests, that let a contract move your assets later. Read what your wallet says you are approving, and reject any request you did not expect. ### Will a wallet or exchange ever ask for my recovery phrase? No legitimate wallet provider, exchange or support agent needs your recovery phrase. You only type it into your own wallet app or hardware device when restoring a wallet. Any website, form, email or person asking for it is attempting theft. ### Where do I report a crypto phishing attempt? In the US, forward phishing emails to reportphishing@apwg.org, forward scam texts to 7726, and report the attempt at ReportFraud.ftc.gov. If you lost money, also file a complaint with the FBI at ic3.gov. Report fake accounts to the platform where you saw them. ## Sources & References 1. [CISA — Recognize and Report Phishing](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing) (accessed 21 Oct 2026) 2. [FTC — How To Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) (accessed 21 Oct 2026) 3. [FBI Internet Crime Complaint Center — 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) (accessed 21 Oct 2026) 4. [NIST — Phishing guidance](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing) (accessed 21 Oct 2026) Disclaimer: This content is for educational purposes only and does not constitute financial, tax, or legal advice. Digital assets are volatile and carry risk of loss. Wealtii is early-stage and not regulated. ## Further reading from official sources - [CISA: Secure Our World](https://www.cisa.gov/secure-our-world) - [NIST: Digital Identity Guidelines](https://pages.nist.gov/800-63-3/) [Zayd Ahmed](https://wealtii.com/editorial-policy#zayd-ahmed) Founder & CEO, Wealtii Computer Science Engineer | 5+ Years in DeFi & Digital Assets ## Compare Wealtii's three index funds Crypto, tokenized gold and tokenized US stocks from $10, with 0% platform fees during our early-adopter promotion. Wealtii is not regulated and digital assets can lose value — read the [risk disclosure](https://wealtii.com/risk-disclosure) first.