Exchange support should never ask for your seed phrase, private key, password, 2FA code or a transfer to a “safe” wallet. If someone contacts you first, end the conversation and open a new case from the exchange’s bookmarked website or app.
Step-by-step process#
- Stop responding and do not click the supplied case link. For crypto support impersonation scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Open the official app or a saved domain independently. Keep the original timestamp, identifier and unedited record so another person can reproduce the conclusion.
- Check whether the case exists in the authenticated support center. Compare the exact domain, address, network or permission with an independent official source before continuing.
- Change credentials and revoke sessions if you shared login information. For crypto support impersonation scam, complete this before value or signing authority changes hands and verify the resulting state afterward.
- Preserve the conversation and report the impersonating account. Keep the original timestamp, identifier and unedited record so another person can reproduce the conclusion.
The key idea#
Impersonators exploit real moments of stress: a delayed withdrawal, locked account or public complaint. They copy staff branding, invent a case number and create urgency so the victim bypasses normal support channels.
For crypto support impersonation scam, separate what can be verified before acting from what can only be monitored afterward. Put hard limits around the second category.
When to stop or change course#
Real support can discuss account status inside an authenticated channel. It cannot fix a non-custodial wallet by learning its secret or guarantee recovery after you send assets elsewhere.
Failure modes to watch#
- Remote-access software offered as troubleshooting. This weakens a control that should limit the blast radius of crypto support impersonation scam.
- A “security wallet” controlled by support. The branding can be copied, so the request must be re-opened through an independently verified channel.
- Requests to screen-share a recovery phrase or QR code. This can expose the root credential; a later password change may not remove the attacker’s access.
- Pressure to keep the case secret from the exchange. This weakens a control that should limit the blast radius of crypto support impersonation scam.
Evidence to keep#
Do not judge the outcome of crypto support impersonation scam only by whether the interface shows a success message. Use evidence that can still be checked after the page is closed.
| Checkpoint | Evidence | Stop condition |
|---|---|---|
| Stop responding and do not click the supplied case link | Order ID, fill price, quantity, fees and current open-position screen | Remote-access software offered as troubleshooting |
| Open the official app or a saved domain independently | Exact URL or contract address matched to official documentation | A “security wallet” controlled by support |
| Check whether the case exists in the authenticated support center | Dated screenshot or onchain record with sensitive data removed | Requests to screen-share a recovery phrase or QR code |
Keep transaction hashes, official case numbers or dated screenshots when they help document crypto support impersonation scam, but exclude seed phrases, private keys and authentication codes.
Frequently asked questions#
Will exchange staff ever call me?
Policies differ, but an incoming call is never proof. Reconnect through the official support center before taking action.
Can a case number be verified?
Only inside the authenticated service or through a new official contact. A convincing number in a message can be invented.
What if I installed remote-access software?
Disconnect the device, remove the software, scan from a trusted environment and rotate credentials from a clean device.
Related guides#
Sources#
- FTC: What to Know About Cryptocurrency and Scams
- FBI IC3: Cryptocurrency Investment Fraud
- Ethereum.org: Scam Prevention
Risk notice: Crypto actions can be irreversible. Never share a seed phrase, private key, password or authentication code, and verify every domain and wallet prompt independently.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
