Last Updated: 2026-10-26
Reviewed: October 26, 2026. Educational checks and synthetic examples; no personal recovery results or loss statistics are claimed.
An urgent message, a polished dashboard and a familiar name are not evidence that a payment or signature is legitimate. Pause the requested action, verify its origin independently, and identify exactly what control it would grant. No checklist can certify that a project is safe.
Match the request to the risk
Scroll sideways to see every column. Keyboard: focus the table region and use the arrow keys.
| Request | What could happen | Useful check |
|---|---|---|
| “Send your recovery words to validate the wallet” | The recipient can obtain control of the derived keys | Never give wallet secrets to a website, chat agent or caller; use the manufacturer's independently verified recovery instructions |
| “Approve this token to claim a reward” | A spender may obtain a standing token allowance | Inspect spender, asset, amount and permissions; a reward label does not explain an approval |
| “Pay a release tax to withdraw” | Another payment may be demanded without releasing anything | Verify the actual account terms and contact the provider independently; do not pay an unsolicited recovery agent |
| “Move funds to our safe wallet now” | You may transfer assets directly to an impersonator | End the conversation and contact the institution using a known channel |
| “Guaranteed daily income from our AI” | The advertised balance may have no realizable backing | Require an explanation of cash flows, custody, withdrawals and independently checkable results; a screenshot is not that evidence |
The FTC's cryptocurrency scam guidance describes payment and investment impersonation patterns. Its US reporting process is not a substitute for your own jurisdiction's authorities.
A worked approval example
Synthetic scenario: a site advertises a 100-token swap. The wallet asks you to authorize address B to spend an unlimited amount of token A. The site's name and the spender are not the same evidence. Ask why this contract needs that permission and whether it matches the transaction you intended.
A hardware wallet can protect the signing key while still signing a harmful permission you approve. Some allowances or signed permissions can be used later without another prompt. Disconnecting the site may only end the browser connection. It does not necessarily cancel permissions already recorded or signed. Read the hardware-wallet guide for this distinction.
If a request is unreadable or its purpose cannot be established, declining it is a valid outcome. A simulation can add information, but it is not a guarantee about future state, upgradeable code or every execution path. Reviewing a signature also cannot prevent all oracle or contract exploits in protocols where assets are already deposited.
Investigate evidence, not badges
Scroll sideways to see every column. Keyboard: focus the table region and use the arrow keys.
| Signal | What it may help establish | What it cannot establish alone |
|---|---|---|
| Published audit | Which code version and findings an auditor examined | Current deployed code, resolved findings or absence of vulnerabilities |
| Proof-of-reserves snapshot | Particular assets or commitments at a stated time | Complete liabilities, unrestricted control, solvency or withdrawal ability |
| Identified team | A name that can be independently checked | Honesty, competence or ownership of every account using that name |
| Old social profile or active repository | A visible history of activity | That the account was not sold/compromised or that software is safe |
| Withdrawal delay | A request that needs investigation | Fraud by itself; documented holds and operational failures also occur |
| Cover or insurance claim | A policy to inspect | Payment for your particular asset, event or loss |
Read audit scope, contract addresses, version/commit, unresolved issues and follow-up. Read cover exclusions, caps, eligibility, claim process and who owes the obligation. A badge without these details is a reason to leave the question unresolved, not to invent either a safety verdict or a fraud accusation. Host geography, anonymity or low activity can inform questions; they are not proof of misconduct.
Check promised returns without manufacturing a verdict
At 2% compounded daily for 90 days, the multiplier is 1.02^90 = 5.9431: about a 494.31% gain before costs, not growth beyond world GDP. At 1% daily for 365 days, 1.01^365 ≈ 37.78, or about a 3,678% gain. Arithmetic shows the scale of the promise; it does not prove how a particular operator finances it.
Ask where returns originate, who bears losses, whether quoted rates are promotional or capped, and whether withdrawals are actually available under the contract. Do not replace an implausible guarantee with an unsourced “safe” yield range. A real lending or staking mechanism can still lose value, fail or become illiquid.
If you have already interacted
- Stop following new instructions from the suspicious contact. Do not send additional “unlock,” “tax” or “recovery” payments.
- Record transaction hashes, network, addresses, dates, URLs and messages. Preserve originals; redact secrets before sharing evidence. A displayed balance is not proof of assets recoverable on-chain.
- Identify the exposure: payment sent, account login disclosed, seed exposed, or token permission signed. These require different responses. A new password or PIN does not invalidate an exposed seed.
- Reach the wallet/provider through independently verified support. If a permission remains, consult trusted instructions for checking and revoking it. Revocation cannot undo an executed transfer, and a compromised key needs a different plan.
- Report through the relevant local authority and affected provider. Recovery is uncertain. The FTC warns against unsolicited paid recovery offers; someone promising a guaranteed reversal may be targeting the same loss again.
Keep the evidence separate from accusations. “This address received my transfer” is observable. “The named person controls it” requires more evidence. That distinction makes a report more useful to the people who can investigate it.
Disclosure: AITR may receive referral commissions from links elsewhere on the site. This article contains no verified provider endorsement or guaranteed prevention/recovery method. It is educational information, not individual legal, financial or incident-response advice.