Phishing
A message, call or website that pretends to come from someone you trust, to get you to hand over a password, a login code, your recovery words or a signature.
The bait is an email, a text, a call or an ad that seems to come from a bank, an exchange, a wallet maker, a delivery company or a government agency. It usually brings a reason to hurry, such as a locked account, a failed payment or a security alert, and a link to a copy of the real site.
With crypto, the copy asks for one of three things. Your password and the code sent to your phone, to empty your account at an exchange. Your recovery words, which let the thief rebuild your wallet anywhere. Or, on a page that asks you to connect your wallet, a signature that gives it the right to move your tokens; the tools built for this are called drainers. Whatever it gets, once the money has moved, no one can reverse the transfer.
Phishing and spoofing drew more complaints to the FBI’s Internet Crime Complaint Center than any other crime: 191,561 in 2025. In December 2022, the FBI warned that criminals were buying search ads that led to copies of real sites, crypto exchanges in particular, to collect people’s logins. According to ScamSniffer, which tracks drainers, they took about 84 million dollars from 106,106 victims in 2025, down from 494 million dollars in 2024, counting only what it could trace.
In practice:
- No genuine company asks for your recovery words. Anyone who does is trying to steal them.
- Reach sites by typing the address or from a bookmark, not from a link or an ad.
- Read what a wallet asks you to sign, and don’t sign what you don’t understand.
The guide on crypto scams covers the other ways people are tricked into sending money. Address poisoning and SIM swaps are close relatives.