Upload identity documents only inside a verified service’s authenticated KYC flow after confirming why the data is required, who processes it and how it is protected. A document request sent by chat, email attachment or an unrelated form can enable identity theft as well as crypto fraud.
Before you take action#
A passport selfie and proof of address can be reused to open accounts, defeat weak recovery checks or build more convincing impersonation attacks. The harm may continue after the crypto transaction ends.
For fake KYC scam, the visible interface shows only part of the system. Confirm the identity, asset, network and authority involved before treating a familiar label as proof.
Execution checklist#
- Verify the exact legal entity and domain. Compare the exact domain, address, network or permission with an independent official source before continuing.
- Read the privacy notice and retention policy. Compare the exact domain, address, network or permission with an independent official source before continuing.
- Navigate to verification from inside the signed-in account. For fake KYC scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Watermark a copy when the provider permits it, naming purpose and date. For fake KYC scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Keep evidence of what was submitted and request deletion where applicable. Complete this through the verified product interface, then test the control instead of assuming it is active.
What can still go wrong#
- KYC requested to release an unsolicited prize. This weakens a control that should limit the blast radius of fake KYC scam.
- A form hosted on a generic file-sharing domain. The branding can be copied, so the request must be re-opened through an independently verified channel.
- Support asking for documents in direct messages. The branding can be copied, so the request must be re-opened through an independently verified channel.
- Uploading extra documents not listed in the official workflow. The branding can be copied, so the request must be re-opened through an independently verified channel.
A safer default#
Do not use a service if it cannot explain its processor, jurisdiction or secure submission channel. Compliance requirements do not justify sending ID to an unverified recipient.
Proof that the task is complete#
Do not judge the outcome of fake KYC scam only by whether the interface shows a success message. Use evidence that can still be checked after the page is closed.
| Checkpoint | Evidence | Stop condition |
|---|---|---|
| Verify the exact legal entity and domain | Exact URL or contract address matched to official documentation | KYC requested to release an unsolicited prize |
| Read the privacy notice and retention policy | Dated screenshot or onchain record with sensitive data removed | A form hosted on a generic file-sharing domain |
| Navigate to verification from inside the signed-in account | Dated screenshot or onchain record with sensitive data removed | Support asking for documents in direct messages |
Keep transaction hashes, official case numbers or dated screenshots when they help document fake KYC scam, but exclude seed phrases, private keys and authentication codes.
Frequently asked questions#
Is KYC itself a scam?
No. Regulated services may have legitimate identity obligations. The risk is an unverified requester or insecure collection method.
Should I email a passport to support?
Only if the verified provider explicitly documents that method; an authenticated upload portal is generally safer.
What if I sent ID to a scammer?
Report identity theft to the relevant authority, notify affected financial institutions and monitor accounts for misuse.
Related guides#
Sources#
- FTC: What to Know About Cryptocurrency and Scams
- FBI IC3: Cryptocurrency Investment Fraud
- Ethereum.org: Scam Prevention
Risk notice: Crypto actions can be irreversible. Never share a seed phrase, private key, password or authentication code, and verify every domain and wallet prompt independently.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
