How do crypto phishing and fake support scams work, and what do official sources say to look for?

What phishing is

CISA says phishing is when criminals try to get us to open harmful links, emails or attachments. These can ask for our personal details or infect our devices.¹ The message may come as an email, a text, a social media message or a phone call. It is usually made to look like it comes from a person or company you trust.¹

Phishing by text message is often called smishing. Phishing by voice call is called vishing.²

The signs CISA lists

• Urgency or emotion, especially warnings of something terrible if you don't act at once.¹
• Requests for personal or financial information.¹
• Shortened links from sources you don't trust.¹
• Addresses that are almost right. Criminals often use an email address that looks like a real company's, with a few characters changed or left out.²
• Poor spelling used to be a sign. CISA now warns that, with AI, some phishing emails have perfect spelling and grammar, so look for the other signs.¹

Fake websites

A phishing link often leads to a copy of a real website. The FBI warns that a misspelled web address, or one with extra characters, may be fake.^4,5 ethereum.org says to always check you are on the right website, especially after clicking a link.³

CISA's advice is to avoid the link. If a message might be real, go to the company's website yourself: search for it, or type the address if you are sure you know it.¹ Its older guidance adds: don't use contact details given on a website linked to the request.²

Fake apps

Crooks also build fake apps. In 2022, the FBI warned against downloading investment apps you can't check are genuine.⁴ The North Korean hackers in Lesson 1 got staff to install fake trading apps. The US agencies' advice was to download only from a reputable or primary source.⁶

Fake support

ethereum.org describes a common trick. Scammers pose as support staff for a wallet, exchange or blockchain. They look for people asking for help in public chats, then message them privately.³ It says that, as a rule, real staff never contact you through private, unofficial channels. It also says never to give anyone remote access to your computer.³

MetaMask, a wallet maker, says the same about itself. As of October 2026, MetaMask says it never sends private messages offering support, has no support phone number, and that anyone asking for your Secret Recovery Phrase is trying to scam you.⁷ Your recovery phrase is the master key to your wallet. ethereum.org says no legitimate service, support agent or website will ever ask for it.³ Module 8 covers support scams and SIM swaps in more detail.

Giveaways and "safe" wallets

• Giveaways. A post promises to send back double any crypto you send. ethereum.org says giveaways are always scams.³
• Free money. The FTC says promises of free cash or crypto are always fake.⁸
• "Move your money to safety." Scammers posing as a company or government may tell you to send crypto to a wallet address they give you, "for safe keeping".⁸
• Paying in crypto. The FTC says only scammers demand payment in cryptocurrency.⁸