Cryptocurrency payments are secure by design — the blockchain itself has never been hacked. But the people using crypto are targeted constantly by scammers who exploit inexperience, urgency, and trust. When you're buying services online with crypto, knowing the common scams and how to avoid them is essential. This guide covers the most prevalent threats and gives you a practical checklist to stay safe.
Why Crypto Buyers Are Targeted
Crypto transactions are irreversible. Once you send funds, there's no bank to call, no chargeback to file, no transaction to reverse. This is a feature for legitimate commerce (it keeps costs down and eliminates fraud for merchants), but it also means that if you send crypto to a scammer, the money is gone. Scammers know this, and they've developed sophisticated methods to trick people into sending funds willingly.
The Most Common Crypto Scams
1. Fake Websites (Phishing Sites)
This is the most widespread scam in online crypto commerce. Scammers create websites that look identical to legitimate services — same design, same logos, same content — but with a slightly different URL. Instead of streamingfamous.com, it might be streamingfam0us.com (zero instead of "o"), streaming-famous.com (added hyphen), or streamingfamous.net (different domain extension).
These sites replicate the checkout process perfectly, but the wallet address they display belongs to the scammer. You think you're paying for a service, but you're sending money into a void.
How to protect yourself:
- Bookmark the official website and always use that bookmark
- Check the URL character by character before making a payment
- Look for HTTPS and verify the SSL certificate
- Never click payment links in emails, DMs, or social media posts — navigate to the site directly
- Be suspicious of ads at the top of Google search results, as scammers buy ads for fake sites
2. Social Media Impersonation
Scammers create fake social media accounts that mimic legitimate businesses. They copy profile pictures, bios, and even post histories. Then they reach out to potential customers via DM, offering "special deals," "exclusive discounts," or "VIP packages" that require payment to a wallet address.
Variations include fake customer support accounts that respond to public complaints or questions, directing victims to phishing sites or asking them to send crypto directly.
How to protect yourself:
- Never purchase services through DMs or social media messages
- Verify account authenticity by checking follower counts, post history, and verification badges
- Go directly to the official website for all transactions
- If contacted by "support," verify by contacting the company through their official website
3. Address Poisoning
This is a sophisticated attack where a scammer sends a tiny amount of crypto to your wallet from an address that visually resembles an address you've transacted with before. The goal is that when you go to send crypto next time, you'll copy the wrong address from your transaction history — theirs instead of the legitimate one.
These "poisoned" addresses often match the first and last few characters of a legitimate address, relying on users who only check the beginning and end.
How to protect yourself:
- Never copy addresses from your transaction history — always get the current address from the merchant's checkout page
- Verify the complete address, not just the first and last characters
- Use the QR code scanning feature when available
- Bookmark wallet addresses of services you use frequently (if they have static addresses)
4. Clipboard Hijacking Malware
Malware on your computer or phone that monitors your clipboard. When you copy a wallet address, the malware silently replaces it with the attacker's address. You paste what you think is the merchant's address, but it's actually the scammer's.
How to protect yourself:
- After pasting an address, visually compare it to the original — check the first 6 and last 6 characters
- Keep your operating system and apps updated to prevent malware infections
- Use a reputable antivirus/anti-malware tool
- Prefer QR code scanning over copy-paste when possible
- Don't install apps from unknown sources
5. Fake Customer Support
Scammers monitor forums, Discord servers, Telegram groups, and social media for people having payment problems. They impersonate customer support from legitimate companies and offer to "help" — usually by asking you to connect your wallet to a malicious site, share your seed phrase, or send a "test transaction" to verify your wallet.
How to protect yourself:
- Real customer support will never ask for your seed phrase or private keys
- Real customer support will never ask you to send crypto to verify your wallet
- Only contact support through the official website's contact methods
- Be wary of anyone who contacts you first claiming to be support
6. Too-Good-to-Be-True Offers
If someone is offering 1 million Spotify plays for $10, or promising to double your crypto if you send them some first, it's a scam. Legitimate services have realistic pricing because they have real costs. Impossibly cheap prices mean either the service is fake, or the delivery method is fraudulent (bots that get removed, fake accounts that trigger penalties).
How to protect yourself:
- Compare prices across multiple established services to understand normal ranges
- If a price seems impossibly low, it is
- No legitimate service will ask you to send crypto first and promise to send more back
- Be skeptical of "limited time" pressure tactics designed to make you act before thinking
Red Flags Checklist
Before making any crypto payment for an online service, check for these warning signs:
- No physical website — the service only exists on social media, Telegram, or Discord with no professional website
- No contact information — no email, support chat, or other way to reach the company
- Pressure to pay immediately — legitimate services let you take your time. Scammers create artificial urgency
- Requests for seed phrases — never, under any circumstance, share your seed phrase
- No order tracking — after payment, a legitimate service provides order confirmation and delivery tracking
- Unrealistic promises — guaranteed results, instant delivery of massive orders, or prices far below market rates
- Payment only via DM — all payments should go through a proper checkout system, not sent to an address shared in a message
- No online reviews — a service with zero reviews, testimonials, or mentions anywhere on the internet is suspicious
Safe Payment Practices
Follow these habits every time you make a crypto payment:
- Navigate directly — type the URL or use a bookmark. Never follow links from emails, messages, or ads
- Verify the URL — check every character. Look for substitutions (0 for o, l for 1), extra characters, or wrong domain extensions
- Use the checkout system — only pay through the website's built-in checkout process, never by sending crypto to an address someone gave you in a message
- Verify the address — after pasting, compare the first 6+ and last 6+ characters against the original
- Match the network — confirm you're sending on the correct blockchain (Bitcoin, Ethereum, Tron, etc.)
- Save the transaction hash — this is your proof of payment. Keep it until your order is fully delivered
- Verify on a block explorer — check that your transaction was confirmed and sent to the correct address
- Start small — if it's your first time using a service, make a smaller order first to verify legitimacy before committing to a large purchase
What to Do If You Think You've Been Scammed
If you realize you've sent crypto to a scammer:
- Document everything — save the transaction hash, screenshots of the website or messages, wallet addresses, and any other evidence
- Report the fake site — report phishing sites to Google Safe Browsing, your browser, and the domain registrar
- Alert the community — post about the scam (with evidence) on relevant forums so others can avoid it
- Secure your wallet — if you connected your wallet to a suspicious site, revoke all token approvals immediately and consider moving your remaining funds to a new wallet
- File a report — report the scam to the FBI's Internet Crime Complaint Center (IC3) or your country's equivalent
Recovery of sent crypto is extremely rare, but reporting helps authorities track scammers and potentially prevent future victims.
Staying Safe Is Simple
The vast majority of crypto scams are preventable with basic awareness. Verify URLs, never share your seed phrase, use official checkout systems, and approach too-good-to-be-true offers with skepticism. These simple habits protect you from virtually every common scam.
For more on payment security, read our comprehensive crypto payment security guide. When you're ready to make a secure purchase, our payment page walks you through every step of the checkout process.