Ilia Zavialov

Scam types

Ilia Zavialov breaks down the main types of crypto scams, and the single step each one depends on

English version for the United States.

A new coin, a stranger offering investment advice, a call from a bank that already seems to know your account: the costume changes constantly, and the mechanism underneath rarely does. Reporting bodies logged well over a million fraud complaints and tens of billions of dollars in claimed losses in a single year, and the categories behind those totals repeat with only cosmetic variation. This article takes each type of crypto scam apart by mechanism, asking what single action it cannot survive without. Naming that action is more useful than memorising warning signs, since the dependency underneath does not change.

·15 min read·Ilia Zavialov

Cover illustration for the Ilia Zavialov guide to the main types of crypto scams and how each one is built
Cover illustration for the Ilia Zavialov guide to the main types of crypto scams and how each one is built

01The single step every category depends on

Crypto scams are usually described by their costume: a fake exchange, a stranger who trades professionally, a text about a parcel that never shipped. The costume is the least useful part to study, since a replacement always exists once one wears out. What stays constant is the mechanism underneath, and the mechanism decides whether money moves. Looking at scams by mechanism turns a long list of warning signs into a short list of categories.

Nearly every scheme that reaches a cryptocurrency holder belongs to one of three families, each built around a single action performed by the owner. Some need the owner to send funds voluntarily, believing the transfer will return more than it cost. Others need the owner to reveal a private key or a recovery phrase, since the key is the asset itself. A third needs only trust in an unverified address, and removing that action leaves any scheme with nothing to work with.

The scale behind these categories appears in official reporting. The FBI's Internet Crime Complaint Center recorded 1,008,597 complaints and close to 21 billion dollars in claimed losses for 2025, a rise of 26 per cent on the year before. Those figures cover fraud in general, and a large share runs through a crypto payment at some point, which is why the categories below are worth taking apart one at a time.

02Fake investment platforms and the balance that only exists on their screen

A fake investment platform is built around one object: a dashboard showing a balance climbing in value. The interface can be a copy of a real trading platform, a custom site built for a single campaign, or a chat bot that simply sends screenshots on request. None of it touches a real market. The number on screen is set by whoever runs the scheme, rising exactly as fast as the story needs.

The deposit itself is a genuine transfer, sent to an address belonging to the operator, and it is final the moment it confirms. Requests to withdraw are where the platform starts asking for more: a tax payment, a liquidity fee, a verification deposit, each framed as the last step before the balance becomes real. Paying these fees is a rational response to a number that looks exactly like a real balance.

The category earns its place at the top of loss tables because it has no natural ceiling. Investment fraud accounted for 8.648 billion dollars in the FBI's 2025 figures, more than 40 per cent of everything reported, and no other category came close. A romance scheme or a giveaway usually asks for one payment and stops there. An investment platform can ask the same person again and again, since the balance keeps growing with every deposit.

The main categories of crypto scam, how they make contact, and the step each depends on
CategoryHow it reaches youStep it depends on
Fake investment platformAdvertising, a messenger contact, a referral linkYou send a deposit into a balance that cannot be withdrawn
Giveaway, multiplier or long-contact schemeA live stream, a social post, weeks of private messagesYou send funds first to receive a promised return
Recovery serviceContact after a loss becomes visibleYou pay an advance fee for a return that never happens
Job or task scamA message offering flexible remote workYou pay to unlock the next batch of paid tasks
Impersonation of a company or agencyA call, text or email naming a real institutionYou act before checking the number yourself
Voice-cloned contactA phone call using a familiar voiceYou transfer funds on the strength of a voice alone
Fake wallet, support chat or signature requestA search result, a cloned chat, a site asking to connectYou type a recovery phrase or approve an unclear permission
Address substitutionClipboard malware, a message, an altered invoiceYou trust a pasted address without verifying it in full

03Schemes built on sending first: giveaways, multipliers and long-contact trust

A giveaway scheme opens with a promise that looks too small to bother with: send a token amount to a listed address and receive several times that back. The offer is usually attached to a recognisable name, a live stream, or a cloned celebrity account, backed by comments from accounts the same operator controls. The address collects thousands of small sends before it is abandoned, and every one is final.

A multiplier scheme runs the identical logic through a private conversation, one contact at a time. Someone found through a group chat or a comment section offers to double or triple a deposit within a short window, backed by screenshots impossible to verify from outside the chat. The step needed is the same outgoing transfer made in expectation of a larger return, delivered person by person.

A long-contact scheme spends far more time before asking for anything. Contact begins on a dating platform, a professional network or a messaging app, and weeks pass in regular conversation before money is mentioned. The eventual request rarely looks like a scam on its own, a family emergency or a shared investment, and by then the relationship is doing the work a giveaway post would otherwise have to do.

All three variants collapse under the same test: whether the arrangement requires sending value before receiving anything back. A genuine giveaway, a genuine investment and a genuine relationship can all continue without an upfront transfer, so a demand for one is the signal that carries across every version. Recognising the pattern once removes the need to recognize every costume it wears.

04Recovery-service schemes: a second payment for the same loss

Recovery schemes target people who have already lost money, which makes them easier to find than almost any other category of victim. A public complaint, a forum post, or a wallet address already known to have received a scam payment is enough to attract someone offering to trace and return the funds. The pitch borrows the language of real investigative work: blockchain analysis, a legal team, a success fee payable only once funds are returned.

The fee, in practice, is rarely payable only on success. Most versions ask for an upfront payment described as a processing cost, a court filing fee or a tax on the recovered amount, and that payment is the entire transaction. Nothing traces, nothing returns, and the contact becomes unreachable once the payment clears.

The category exploits a real asymmetry: blockchain tracing is a genuine skill, and honest reports describing where stolen funds moved do exist. Such a report changes nothing about who controls the funds, and no established platform sells account or fund recovery as a paid service. Any advance payment attached to a promised return is best treated as a second loss on top of the first.

05Job and task scams: from a normal interview to an endless task queue

Job scams now frequently begin exactly like a normal hiring process. A message arrives through a professional network or a messaging app offering remote work with flexible hours and pay above the local average, sometimes following a short interview conducted entirely over chat. The role is described in general terms, such as data entry or product testing, vague enough to avoid questions about what the job actually involves.

The paid version of the scheme introduces a task queue, usually inside an app or a private web page built for the campaign. Early tasks are small and genuinely paid out, which builds confidence before the platform asks for anything back. Later tasks require the worker to deposit funds to unlock a batch, complete a set within an unrealistic time limit, or pay a fee to release earnings the interface already shows as accumulated.

The growth in this category has been fast enough to reshape reporting figures on its own. Complaints about job scams roughly tripled between 2020 and 2024, with claimed losses rising from 90 million dollars to 501 million dollars over the same period. A task queue can be run at almost no cost per victim, and the same displayed-balance trick that works in a fake investment platform works just as well dressed as a job.

06Impersonation: banks, couriers and government bodies wearing someone else's badge

Impersonation schemes borrow the authority of an institution the target already trusts. A call, text or email arrives naming a bank's fraud department, a parcel courier, a tax office or a benefits agency, often using the real name of that organization and sometimes a spoofed caller ID. The message describes a problem needing immediate action, such as a suspicious charge or a fee owed on a package.

The urgency is a deliberate part of the mechanism. A target given time to call the institution back on a number looked up independently almost always finds there is no problem to solve, so the scheme removes that time. Instructions arrive to move funds into a safe account or buy cryptocurrency, framed as the only way to resolve the problem before a deadline the caller controls.

Reported losses to impersonation are large enough to stand as their own category. Reports describing impersonation passed one million in a single year in the FTC's data, with 3.5 billion dollars in claimed losses, close to one report in every three received. The same script works across companies, banks and government bodies, with only the named institution changed.

The defense sits entirely outside the conversation itself. A number found independently, through a card, a past bill, or an official site typed in by hand, reaches the real institution regardless of what a caller claims. No fraud department resolves a case by asking for cryptocurrency, and no tax office accepts payment in it, which makes the request itself the clearest signal available.

07Voice cloning and the new shape of a convincing phone call

Voice cloning changes what counts as proof during a phone call. A generated clone convincing enough to pass as a real person can now be built from roughly three seconds of audio pulled from a video or a public recording, reaching accuracy of around 85 per cent against the original voice. That is enough material to exist in almost anyone's public footprint without them recording anything for the purpose.

Human judgment does not close the gap on its own. In controlled testing, listeners correctly told a real voice apart from a cloned one only 37.5 per cent of the time, close to guessing at random. A familiar voice, a family member, a manager, a colleague asking for an urgent transfer by phone, carries exactly the weight it always has, even though the call itself no longer proves who is speaking.

The scheme built on top of this is otherwise ordinary: urgency, a request to move funds or buy cryptocurrency, and a reason the usual contact cannot be reached to confirm. What changes is the evidence available to catch it. A callback placed to a number already on file, kept separate from whatever number the caller supplies, restores the check the voice alone can no longer perform.

08Schemes that go after the private key

A different family of schemes skips persuasion about money and goes straight for the credential that controls it. A wallet holds a private key, and that key, or the recovery phrase that encodes it, is the entire asset. Whoever reads that phrase owns the funds it protects, immediately and without needing anything else from the owner.

Fake wallet applications listed in ordinary app stores collect the phrase during what looks like a normal setup or restore process. Cloned support chats, often reached through a search result for a real platform's help page, ask for the same phrase to fix a nonexistent error. Both routes end at the same outcome, a form asking for words no genuine wallet or support team would ever need to see.

A newer version avoids asking for the phrase at all. A site connects to a wallet and requests a signature, presented as a routine login step, though it actually grants permission to move specific tokens out of the wallet. The owner approves what looks like proof of ownership and has, in fact, authorized a transfer the operator can execute whenever it chooses.

Every version in this family depends on the same action: typing a phrase into a form, or approving a signature request without reading what it authorises. A wallet's own interface is the only place either action needs to happen. No legitimate wallet provider or support desk ever asks for the phrase itself, and the request alone identifies the scheme.

09Address substitution and why the same mechanism costs some people more than others

The last major family leaves the owner's key and judgment about the transaction alone, and changes only the destination. Malware sitting quietly on a device watches the clipboard and swaps a copied cryptocurrency address for one the attacker controls the instant it is pasted. Tools exist that generate a replacement address sharing the first and last characters with the original, defeating the quick visual check most rely on.

A second version reaches businesses more often than individuals. An invoice or payment instruction arrives from what looks like a genuine contact, sometimes after a real email thread has been read by an attacker, with new account details substituted into an otherwise normal message. The transfer is authorized correctly by every internal process the business has, since nothing looks unusual except the one detail nobody checked separately.

The mechanism in this family treats every target identically, yet outcomes do not land evenly across age groups. Victims aged 60 and over reported to the FBI lost an average of 38,501 dollars each, against 20,699 dollars across all reported victims, roughly 1.86 times as high. This category sits inside a broader pattern, tending to produce a larger transfer against an older target.

The check that closes this family has nothing to do with age, experience or caution in general. An address or payment detail either comes from a source already verified and trusted, or it is confirmed through a separate channel before anything is sent. Checking only the first and last characters, or trusting a detail that arrived inside a legitimate conversation, is the single gap this scheme is built to fit through.

10Questions and answers

What are the most common types of crypto scams?

The categories that appear most often are fake investment platforms, giveaway and multiplier schemes, romance and long-contact schemes, recovery-service scams, job and task scams, impersonation of a company or agency, and schemes that go after a wallet's key or a copied address directly. Every one of them depends on a single action, whether that is an outgoing transfer, a typed recovery phrase, an approved signature or a trusted address, and taking that action away leaves nothing for the scheme to work with.

How do fake investment platforms trick people into losing money?

They show a dashboard with a balance that rises steadily, and whoever runs the scheme sets that number directly, with no connection to any real market. The first deposit funds that illusion, and every later request to withdraw introduces a new fee that has to be paid before the balance supposedly becomes real money. Investment fraud of this kind accounted for 8.648 billion dollars in the FBI's 2025 figures, more than 40 per cent of all reported losses that year.

Can a cloned voice really be used to steal cryptocurrency?

Yes. A convincing clone can be produced from about three seconds of audio and reaches roughly 85 per cent accuracy against the real voice, and in controlled testing listeners told a genuine voice apart from a cloned one only 37.5 per cent of the time. A phone call alone is no longer proof of who is speaking, which is why an urgent request is worth confirming through a separate channel before any transfer is made.

Why do job scams often ask for cryptocurrency payments?

A task-based job scam pays out small genuine amounts early to build trust, then asks the worker to deposit funds, usually in cryptocurrency, to unlock a larger batch of paid tasks or release earnings already shown in the app. Complaints about job scams roughly tripled between 2020 and 2024 as this task-queue model spread, with claimed losses rising from 90 million to 501 million dollars over the same period.

What is a recovery scam and why is it dangerous?

A recovery scam contacts someone who has already lost money and offers, for an upfront fee, to trace and return the stolen funds. The fee is the entire transaction: nothing is traced, nothing returns, and the contact disappears once payment clears, turning one loss into two.

How can I tell if a crypto wallet or support chat is fake?

Any wallet, app or support chat that asks for a recovery phrase or the words behind it is fake, because no genuine wallet provider or support desk ever needs to see that phrase to help. The same caution applies to a signature request that arrives dressed as a login: reading what a signature actually authorises before approving it catches most of this category on its own.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

11Read next

Back to the blog