Securing your accounts and avoiding scams
A concrete routine to protect your accounts, wallets and transactions against phishing.
The essentials
Securing your access
Use a password manager and a different password for each platform and for the associated email. Turn on two-factor authentication and keep the backup codes separately. Also protect your phone, your computer and the email address used to reset your other accounts. Keep software up to date and install apps from official sources.
Your recovery phrase is shared with nobody. Support will never ask for it to open a ticket, recover a deposit or verify your identity. A signature or permission given to a contract can also be dangerous even if you've never revealed the phrase.
Prefer an authenticator app or a security key over SMS codes: a scammer who obtains a duplicate of your SIM card also receives your codes. The guide 2FA, SIM swap and account security compares the methods.
The most common crypto scams
Fake sites and malicious ads
A site copies a well-known platform or wallet exactly, with an address that differs by a single letter. It sometimes appears at the top of search results thanks to a paid ad. The goal: get you to type your password, your 2FA code or your recovery phrase. Always open your services from a bookmark created after checking the address.
Fake support
You ask a question on Discord, Telegram or X, and a "team member" messages you privately to help. They send you to a wallet "sync" or "validation" form. Real teams don't contact users first by private message.
Relationship investment scams
Someone you met on a dating app, WhatsApp or social media gradually tells you about their crypto gains, then guides you to a trading platform. The gains shown are fake. When you try to withdraw, you're asked for "fees", "taxes" or an "unlock deposit". The more you pay, the more they ask.
Fake giveaways and doctored videos
A livestream or an account impersonating a celebrity promises to double any crypto sent to an address. The videos are sometimes generated by artificial intelligence. Nobody doubles crypto: anything you send is lost.
Malicious signatures and drainers
A site asks you to "connect your wallet" to claim an airdrop or mint an NFT, then gets you to sign a permission that lets a contract drain your tokens. See Phishing, drainers and malicious signatures and Approvals: revoking permissions.
Address poisoning
A scammer sends you a tiny amount from an address that starts and ends like one of your contacts'. They hope you'll copy their fake address from your history next time you send. Always check the full address, and copy it from the source rather than from your history.
Rug pulls
A token's creators attract buyers, then pull the liquidity or sell massively. See Spotting a rug pull.
Recognizing common scenarios
| Message received | What you do |
|---|---|
| "Your wallet is locked, validate it with your seed." | Ignore and report. Never type the seed. |
| "Limited offer: log in quickly via this link." | Open the site from your official bookmark and check the announcement. |
| "Send 0.1 ETH, I'll send you back double." | Send nothing: a confirmed transfer usually can't be undone. |
| "An agent can recover stolen funds for a fee." | Beware of a second scam. Keep the evidence and use official channels. |
| "To withdraw your gains, pay the taxes first." | Stop all payments: it's the sign of a fake platform. |
Before every transaction: STOP
Site: is the domain the right one? Token: is it the right contract and the right network? Operation: is it a transfer, an approval or a signature? Permission: what amount and which beneficiary are you authorizing? Add an address check and a test for a large transfer. Take a few minutes to step back if someone is pressuring you.
If you suspect a compromise
If only a platform is affected, change the password from the official site, secure the email, log out other sessions and contact official support. If a suspicious approval was granted, review the permissions on the right network and revoke the dangerous ones; avoid signing anything else on the suspicious site. If the recovery phrase was exposed, consider every account that depends on it compromised: simply changing a password or revoking a permission isn't enough. Create a new wallet with a new phrase on a safe device and move the assets you still control. If you've been robbed, keep the hashes, URLs, screenshots and times: they'll be useful for reporting and for any complaint.
Reporting a scam in France
- Pharos (internet-signalement.gouv.fr): to report a fraudulent site, ad or content.
- Info Escroqueries: the Interior Ministry's free hotline, 0 805 805 817, for advice.
- Cybermalveillance.gouv.fr: for a diagnosis and referral to professionals if a device or account is compromised.
- AMF: its blacklist lists unauthorized sites, and you can report a suspicious offer to it.
- Complaint: at a police or gendarmerie station, or online for certain internet scams. If the funds landed on a regulated platform, report it to that platform too.
Outside France, contact your national police, your cybercrime reporting service and your financial regulator, which usually publishes its own warning list.
Frequently asked questions
How can I recognize a crypto scam?
The most common signs: urgency ("limited offer", "wallet locked"), a request for your recovery phrase, a promise of guaranteed returns, contact by private message and a link that doesn't match the official domain. At the slightest doubt, don't act and test the link with our crypto site checker.
Can stolen crypto be recovered?
Rarely. A confirmed transaction usually can't be undone. If the funds landed on a regulated platform, it can sometimes freeze an account at the request of authorities: file a complaint and keep the evidence (transaction hash, addresses, screenshots). Be wary of "recovery agents" who contact you: it's often a second scam.
What should I do if I gave away my seed phrase?
Consider the wallet compromised. Immediately create a new wallet with a new phrase, on a clean device, and move whatever is left to it. Also revoke suspicious permissions (see Approvals: revoking permissions) and never reuse the old phrase.
Where can I report a crypto scam in France?
You can report a fraudulent site or message on the Pharos platform (internet-signalement.gouv.fr), get help on cybermalveillance.gouv.fr and check the AMF blacklists. If you've lost funds, file a complaint and keep all the evidence.