Crypto scams: how they work and how to spot them

In 2025, the FBI’s Internet Crime Complaint Center received 181,565 complaints involving crypto, with 11.4 billion dollars in losses, 22% more than the year before. People aged 60 and over reported more than 4.3 billion dollars of it, more than a third. Those are only the losses people reported.

Most of that money wasn’t hacked away: investment scams alone accounted for almost two-thirds of it. A scam doesn’t need to break anything. It needs you to trust someone long enough to send the money yourself, or to hand over what moves it: your recovery words, a login code, a signature or control of your screen.

Pig butchering: an investment that starts as a friendship

The name is the scammers’ own, according to FinCEN, the US Treasury’s financial crimes unit: they call their victims “pigs”, fattened with attention before the “butchering”.

It starts with a text to a wrong number, a match on a dating app or a message on social media. A long, friendly conversation follows, usually on a messaging app, until the new friend mentions how well they do trading crypto and offers to show you. The site or app they point you to looks real, shows your money growing and may even let you take a little out. When you try to withdraw the rest, there are taxes or fees to pay first. Then the friend disappears.

Americans reported losing 7.2 billion dollars to crypto investment fraud in 2025, more than to any other kind of crime, according to the FBI; people aged 60 and over lost almost 2.8 billion of it. Anyone can be taken in. In August 2024, a former bank chief executive in Kansas was sentenced to more than 24 years in prison for embezzling 47.1 million dollars from his bank, which he had wired in 2023 to a pig butchering scheme. The bank failed, and its investors lost 9 million dollars.

Many of the people typing the messages are victims too. According to the FBI, these scams are run mostly by organized crime groups in Southeast Asia, with victims of human trafficking as forced labor. In October 2025, US prosecutors charged the chairman of Prince Group, a conglomerate based in Cambodia, with wire fraud and money laundering conspiracy, accusing the group of forcing trafficked workers, in compounds ringed by high walls and barbed wire, to run the scams, often under threat of violence.

Since January 2024, the FBI has been finding victims in its complaint data and warning them before they lose more. Of the 3,780 it notified in 2025, 78% didn’t know they were being scammed.

Fake support, and fake officials

Another opening is a call, a text or a pop-up about a problem: a hacked account, a suspicious charge, a virus. The caller claims to be your bank, an exchange, a tech company or the government, and the fix means moving your money somewhere “safe” or installing an app that lets them control your screen. In September 2023, the FBI warned of a version it calls the phantom hacker: a fake technician, a fake bank and a fake government official in turn, who get the victim to move their savings to a “safe” account, by wire, in cash or in crypto, and to tell no one.

In 2025, the FBI’s complaint center counted 1.2 billion dollars in losses involving crypto to fake technical and customer support, and 281 million to people posing as government officials.

One call can be enough. In August 2024, callers posing as Google’s support, then as the exchange Gemini’s, told a man in Washington that his account had been compromised, got him to reset his two-step login and share his screen through a remote desktop app, and used it to reach the private keys to his bitcoin: more than 230 million dollars, according to prosecutors. In September 2026, the man they describe as the group’s ringleader pleaded guilty to racketeering conspiracy, the 11th of 18 defendants to plead guilty.

Recovery scams: the second hit

People who have lost money get targeted again, by someone offering to get it back. In 2025, the FBI’s complaint center received 10,516 complaints about recovery scams, with 1.4 billion dollars in losses, a figure that can include what the first scam took.

They pose as law firms, as recovery companies or as government agencies, sometimes invented ones, and they may know exactly how much you lost and when. Some claim to be the FBI’s complaint center itself. There’s a fee or a “verification” to pay first, often in crypto.

The FBI is plain about it: no law firm is an official partner of a US government agency, and its complaint center never contacts victims directly and never asks for payment to recover funds.

Fake apps and fake sites

A scam can live inside an app that looks real. In July 2022, the FBI warned that criminals were persuading people to install fake crypto investment apps, some carrying the name and logo of a real US financial institution; it had identified 244 victims and about 42.7 million dollars in losses.

An official app store isn’t proof. In September 2024, the security company Check Point found a fake WalletConnect app in Google Play, published in March as a calculator to get through review. Downloaded more than 10,000 times, it took more than 70,000 dollars from over 150 people by asking them to “verify” their wallet with signatures that let it move their tokens. The guide on losing your phone covers apps that searched people’s photos for recovery phrases, and SIM swaps, in which someone takes over your phone number.

Fake sites copy real ones at an address a letter or two off, and some buy ads to sit at the top of search results: in December 2022, the FBI warned that such ads were impersonating crypto exchanges in particular. And a lookalike address planted in your transaction history can catch you when you copy it: the guide on sending and receiving digital dollars explains this address poisoning.

Deepfakes and giveaways

The giveaway is an old trick: a famous name promises to send back double whatever you send. AI has given it a face and a voice. In June 2024, a YouTube channel with a large following, rebranded to pass as Tesla’s, streamed a deepfake of Elon Musk for hours, promising to double any crypto sent through a QR code on the screen. The Atlantic Council’s Digital Forensic Research Lab traced more than 50,000 dollars sent to the scammers’ addresses during the stream.

In December 2024, the FBI warned that criminals were using AI to make images of celebrities and videos that promote investment fraud, and to pose as company executives in live video calls. Investment fraud complaints that mentioned AI reported more than 632 million dollars in losses to the FBI in 2025. No one doubles the crypto you send them.

Jobs that make you pay

Task scams offer easy work, usually in an unexpected text or WhatsApp message: liking videos or rating products in an app, for commissions that pile up on screen. Then a set of tasks needs a deposit of your own to finish, and so does withdrawing what you’ve earned, which was never real. Reports of task scams to the US Federal Trade Commission went from about 5,000 in all of 2023 to about 20,000 in the first half of 2024, and crypto, according to the FTC, is the currency of choice. In 2025, the FBI’s complaint center recorded 288 million dollars in losses involving crypto to job scams. The FTC’s rule: never pay anyone to get paid.

Cash into a bitcoin ATM

Many fake support and impersonation scams end at a bitcoin ATM, a kiosk that turns cash into crypto. The caller says your savings are at risk, sends you to withdraw cash and feed it into a particular machine, and texts you a QR code to scan there, which sends the money to their wallet. Scammers have called the machines “safety lockers”, according to the FTC.

In 2025, the FBI’s complaint center received 13,460 complaints about crypto ATMs, with 389 million dollars in losses, 58% more than in 2024. People aged 60 and over lost 257 million of it, two-thirds.

The stories change; the tells don’t.

A stranger who steers you to an investment. A new friend, a “mentor”, a group of insiders. The FTC’s advice is never to mix online dating and investment advice.
A hurry. An account about to be emptied, an offer about to close, a deadline to invest.
A secret. You’re told not to tell your bank, your family or anyone else, for your own safety.
A promised return. Only scammers guarantee profits or big returns, the FTC says. Profits you can see but can’t take out without paying first are the same sign.
A request for your recovery words, a code or an app. No genuine company asks for your recovery words or the login codes it sends you, and an app that shares your screen hands over everything on it.
Payment in crypto, gift cards or cash at a machine. Only scammers demand payment in crypto, according to the FTC, and no real business or agency will send you to a bitcoin ATM.

Side by side

	How it starts	What they ask for
Investment “friend”	A wrong number, a dating match, a message on social media	Deposits on a site or app they recommend, then fees to withdraw
Fake support or official	A call, a text or a pop-up about a problem	Your money moved somewhere “safe”, or an app on your device
Recovery service	An offer to get back what you lost	A fee, up front
Fake app or site	An ad, a link, an app store listing	Your recovery words, your login or a signature
Giveaway	A livestream or a post from a famous name	Crypto, to be “doubled”
Job or task	A message offering easy work	Deposits to finish tasks or to withdraw your pay
Bitcoin ATM	A caller who says your savings are at risk	Cash fed into a machine, to a code they send

If it happened to you

Stop paying. No tax, fee or deposit will release money a scammer holds. Asking for one is usually the scam’s last move.
Save everything. The FBI asks for the addresses you sent to, the amounts, the transaction IDs and the dates and times, and for how you met the scammer, the apps and sites involved and any phone numbers.
Report it. In the United States, to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. The FBI’s complaint center takes reports from abroad too: in 2025 it received them from more than 200 countries. Report it to the police where you live, and tell the exchange or the ATM operator you used.
Lock what’s left. If you gave away your recovery words or let someone install an app, assume they can still reach what remains, and move it to a new wallet, created on a device they never touched.
Expect a second call. Treat anyone who offers to recover the money for a fee as the next scam.

Report it even if the money seems gone. A card payment or a bank transfer goes through companies that can stop or reverse it; a crypto transfer doesn’t. No third party sits between the two sides or approves it, the FBI explains, and the recipient often moves the money abroad quickly. As the FTC puts it, you can usually get it back only if the person you paid sends it back. Reports let the FBI connect cases, follow the money on public ledgers and, sometimes, freeze it.

How to protect yourself

Treat any unexpected contact about your money as a scam until you’ve checked it yourself. Hang up, and call back on a number you looked up, not one you were given.
Keep your recovery words to yourself. Type them only into the wallet you’re restoring, never read them to anyone, and never install an app because someone asked you to.
Don’t take investment advice from anyone you’ve only met online, and don’t put money anywhere that won’t let you take it out without paying first.
Stop when anyone tells you to pay in crypto, by gift card or at a bitcoin ATM. Only scammers do.
Slow down, and tell someone you trust before you send. Scams run on hurry and secrecy, and a second opinion breaks both.
Check every address you send to, character by character, against one you got from the recipient directly.
Keep savings where a single signature can’t move them: a setup in which a second key holds to limits you set, and can make a large withdrawal wait, gives you time to notice a scam, and the guide on hardware wallets, multisig and collaborative custody sets out the test.