Crypto scams: how to spot them, a practical guide for individuals and SMEs

Scams linked to cryptocurrencies almost always work the same way: they exploit haste, trust or ignorance of a technical mechanism. Because transactions cannot be undone, prevention is far more effective than remedy. This guide summarises the most common mechanisms, as described in the Bitcoin and Ethereum documentation, and practical rules for individuals and small businesses.

Three principles that cover almost everything

Bitcoin.org lists three. First, transactions are irreversible: verify before sending. Second, check the entire destination address and not just the first or last characters. Third, no legitimate person, business or support team will ever ask for your recovery phrase or private key. The Ethereum documentation confirms the same point: someone posing as an agent who can return lost funds in exchange for private keys is preying on people not understanding that the network has no such function.

The most common mechanisms

Among the types of scam listed by Bitcoin.org, the most relevant for a beginner are these:

• Fake support and fake recovery: someone presents as support for a wallet or platform, often after a public question, and asks for the recovery phrase or remote access. A variant targets those already scammed and promises to recover the funds for an upfront fee; according to the source, no legitimate firm guarantees recovery.
• Phishing and fake websites: emails and links leading to replicas of sites to steal credentials or get malware installed. They can also appear as sponsored search results or as fake apps in app stores.
• Look-alike addresses (address poisoning): the attacker sends small transactions from addresses resembling those you normally use, hoping the victim copies the wrong address from the history. Check the whole address and use a saved address book.
• Investment scams: a relationship built over weeks or months, often through social media or dating apps, leading to a fake platform. The first small withdrawals work, then come requests for fees or taxes that never end. Bitcoin.org identifies this category as the largest among losses reported to law enforcement.
• Counterfeit hardware wallets: devices sold on third-party marketplaces, sometimes with a recovery phrase already known to the attacker. Buy only from the manufacturer or an authorised reseller, check the packaging and generate the recovery phrase yourself.
• Giveaways and false identities: promises of gifts or false identities, including ones generated with artificial intelligence, to push you into sending funds.

What the authorities say

ESMA, in its response of 30 September 2026 to the MiCA review, observes that online fraud is cross-border, because fraudulent domains can be registered and promoted outside the victims' jurisdictions, and proposes explicit powers for national authorities to order the removal of scam or unauthorised websites. It also asks for rules on influencers and third parties promoting crypto-assets and for more cost transparency. In Switzerland FINMA publishes a warning list of companies and individuals suspected of unauthorised activity in the financial market; inclusion in the list does not necessarily mean the activity is unlawful, and the absence of a name is not an authorisation (this clarification is ours). To check a provider you can also consult the list of authorised companies.

The fake Ledger Live case

CoinDesk recalls an April phishing campaign with a fake Ledger Live app in an app store, which reportedly drained at least $9.5 million from users who entered their recovery phrase. It shows that even an app found in an official store must be verified, and that no legitimate app asks for the recovery phrase.

Rules for small businesses

Whoever handles digital assets for the company can apply a few common-sense rules, in general use and not taken from a specific source:

• separate whoever prepares a payment from whoever approves it;
• verify destination addresses through a second channel;
• limit the funds in wallets used every day;
• train staff who work with company email and social media to recognise phishing;
• document whom to contact in case of an incident.

If you are hit

Transactions cannot be undone, and no serious service guarantees recovery. The National Cyber Security Centre (NCSC) is the federal government's point of contact for businesses and the population on cybersecurity, and FINMA collects reports on the financial market. It is also worth keeping evidence, addresses and messages and considering a report to the police (general advice).

Sources

• Bitcoin.org, Avoid scams: https://bitcoin.org/en/scams
• ethereum.org, Ethereum security and scam prevention: https://ethereum.org/en/security/
• FINMA, Warnings: https://www.finma.ch/en/finma-public/warnungen/
• NCSC, National Cyber Security Centre: https://www.ncsc.admin.ch/ncsc/en/home.html
• ESMA, response to the consultation on the MiCA review, 30.09.2026: https://www.esma.europa.eu/sites/default/files/2026-09/ESMA75-113276571-1721_Response_to_the_EC_consultation_MiCA_regulation_review.pdf
• CoinDesk, Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen, 12.10.2026: https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen

Information, not advice.