Crypto scams and regulation: how to spot fraud and check a provider

The most common crypto scams are investment frauds that start with a friendly contact online (pig-butchering), fake exchanges and trading apps that display invented profits, recovery scams that target people who have already lost money, and pump-and-dump schemes that inflate a small coin before insiders sell. They work because crypto transfers are fast, global and usually irreversible. Your best defences are to treat any unsolicited investment approach as a red flag, to check every provider on the official registers before sending money, and to never share a seed phrase or install software at a stranger's request.

Regulation helps, but it has limits. In the EU, the Markets in Crypto-Assets Regulation (MiCA) now requires crypto-asset service providers to be authorised. It does not make crypto assets safe, does not cover every product, and does nothing to stop a fraudster outside its reach from contacting you. This guide covers both sides: the scams and the rules.

Risk warning: crypto assets are highly volatile and largely unregulated outside the scope of the EU's MiCA regulation. Losses from scams and from ordinary price falls are usually not covered by any compensation scheme. You can lose all of the money you put in.

Why crypto attracts fraud

• Transfers cannot be reversed. There is no chargeback on a blockchain. Once coins leave your wallet, getting them back depends on finding the recipient and persuading a court or a cooperating platform to act.
• It is global and pseudonymous. A fraudster can operate from one country, use servers in another and target victims in a third.
• Prices really do move a lot. Stories of huge gains are partly true, which makes invented ones believable.
• The technology is unfamiliar. Wallets, tokens, networks and smart contracts give scammers jargon to hide behind.
• Fake platforms are cheap to build. A website can show any balance it likes.

Many of the same patterns apply in forex. Our guide to forex scam red flags covers signal sellers, account managers and clone firms in detail; here we focus on the forms that are specific to, or most common in, crypto.

The common scams

Pig-butchering (relationship investment fraud)

The name comes from the idea of fattening a pig before slaughter. It usually begins with a message that looks like a wrong number, a dating-app match or a new contact on social media. Over days or weeks the scammer builds a friendship or romance, then mentions their success with crypto trading and offers to show you how.

You are directed to a platform or app that looks professional. You make a small deposit and see it grow. You may even be allowed one small withdrawal to build trust. Then you are encouraged to deposit more, sometimes by borrowing or remortgaging. When you try to withdraw a large amount, you are told you must first pay a tax, a fee or a "security deposit". The money was never invested, and the platform simply displays numbers.

Signs: a new contact who quickly brings up investing, refuses video calls or has excuses for not meeting, steers you to a specific platform you had never heard of, and asks you to keep it private.

Fake exchanges, apps and investment platforms

Some are copies of well-known exchanges with slightly different web addresses. Others are invented brands with polished websites, fake reviews and fake licence numbers. Some fake apps have even appeared in official app stores. The pattern is the same as above: deposits go in, invented profits appear, and withdrawals are blocked by fees or "verification" charges.

Clone firms and impersonation

Scammers copy the name, registration number and address of a genuinely authorised firm, but use their own website, phone number and bank or wallet details. The register check will look fine unless you compare the contact details. Our guide to clone firms explains the tactic.

Recovery scams

After a loss, victims are contacted by "recovery agents", "blockchain investigators" or people claiming to be from a regulator, law enforcement or a law firm. They promise to trace and return the lost crypto for an upfront fee. They often know details of the original loss, because victims' contact lists are sold or because it is the same group. Regulators do not charge to recover money, and no legitimate service can guarantee recovery.

Pump-and-dump schemes

Promoters accumulate a thinly traded coin, then hype it through social media, chat groups and paid influencers. As new buyers push the price up, the promoters sell. The price collapses, and late buyers are left with the losses. Variations include tokens whose creators can block selling, mint unlimited new supply or withdraw the liquidity pool (a "rug pull"). See our guide to Ethereum and altcoins for why liquidity in small tokens can vanish.

Giveaway, airdrop and impersonation scams

"Send 1 coin and receive 2 back" schemes, often using fake videos or hacked accounts of well-known people, are always scams. Fake airdrops and token claims lure you to a site that asks you to connect your wallet and approve a transaction that drains it.

Fake support and seed phrase theft

Fraudsters monitor public complaints and reply posing as exchange or wallet support. The conversation ends with a request for your seed phrase, remote access to your computer or a link to a fake "wallet validation" page. Read crypto wallets and custody for why the seed phrase must never be shared.

Trading bots and "AI" platforms

Promises of automated trading bots or artificial-intelligence systems that generate steady daily returns are a modern version of an old fraud. No legitimate product can promise certain returns. Our guide to expert advisors and trading bots explains why even genuine automated systems lose money.

Worked example: how a pig-butchering loss builds

The figures below are illustrative, but the pattern matches what regulators and police describe.

• Week 3: after weeks of friendly messages, you deposit €500 on the platform your contact recommends. The account shows €620 a week later.
• Week 5: you withdraw €100 successfully. Trust rises. You deposit €5,000.
• Week 8: the dashboard shows €14,000. Your contact suggests a "special opportunity" requiring a €10,000 minimum, and you add €8,500 to reach it.
• Week 10: you ask to withdraw €20,000. The platform says you must first pay a 20% "tax" of €4,000. You pay it. It then says your account is flagged and needs a €6,000 "anti-money laundering deposit".

At this point you have sent €18,000 and received €100. The €20,000 balance was never real. Every further payment is lost too. The only thing that stops the loss growing is to stop paying, preserve the evidence and report it.

The red flags in one list

• Unsolicited contact that turns to investing.
• Promises of high, steady or guaranteed returns.
• Pressure to act quickly or keep it secret.
• A platform you cannot find on any official register, or whose details do not match the register.
• Requests to pay by crypto, gift cards or transfer to a personal account.
• Requests for your seed phrase, private keys or remote access to your device.
• Fees, taxes or deposits demanded before you can withdraw.
• Anyone offering to recover lost money for an upfront fee.

What MiCA does in the EU

MiCA, Regulation (EU) 2023/1114, is the EU's framework for crypto assets that are not already covered by existing financial-services law. Its rules on stablecoins (asset-referenced tokens and e-money tokens) applied from 30 June 2024, and the rest, including the rules for service providers, applied from 30 December 2024. Our guide to stablecoins covers the stablecoin side.

Crypto-asset service providers (CASPs)

Firms that offer crypto services, such as running a trading platform, exchanging crypto for money or other crypto, holding crypto for clients, executing orders, giving advice or managing portfolios, must be authorised as CASPs by a national regulator, or be an already-regulated financial firm that has notified its regulator. Authorisation in one member state lets a CASP serve clients across the EU (passporting). Authorised CASPs must meet requirements on governance, capital, conflicts of interest, complaints handling and the safeguarding of client assets.

The transitional period

Article 143(3) of MiCA allowed firms that were providing crypto services under national law before 30 December 2024 to continue until 1 July 2026, or until they were granted or refused authorisation, whichever came first. Each member state could shorten that period or not apply it at all, and many did, so the end date varied by country. As of November 2026, that transitional window has closed everywhere: a firm serving EU clients needs MiCA authorisation (or must otherwise be permitted under the regulation).

Other MiCA protections

• Crypto-asset white papers. Issuers offering most crypto assets to the public must publish a white paper with prescribed information and risk warnings.
• Market abuse rules. MiCA prohibits insider dealing, unlawful disclosure of inside information and market manipulation in crypto assets, which covers schemes like pump-and-dumps within its scope.
• Marketing rules. Communications must be fair, clear and not misleading, and identifiable as marketing.

What MiCA does not do

• It does not make crypto assets safe or stop prices falling.
• It does not provide a compensation scheme for crypto losses.
• It does not cover crypto assets that are already financial instruments. Crypto CFDs, for example, are derivatives regulated under MiFID II, with ESMA-based leverage caps of 2:1 for retail clients. See crypto CFDs vs buying crypto.
• It largely excludes fully decentralised services with no identifiable provider.
• It cannot stop a fraudster outside the EU from contacting you.

The UK position

The UK is outside MiCA. Crypto firms carrying on certain activities have had to register with the FCA for anti-money-laundering purposes since January 2020; registration is not full authorisation and does not bring investor protection. Since 8 October 2023, crypto promotions to UK consumers have had to follow FCA rules, including risk warnings, a ban on refer-a-friend incentives and a 24-hour cooling-off period for first-time investors with a firm. The sale of crypto derivatives to retail clients has been banned since 6 January 2021, and the FCA has said that ban remains even after it allowed retail access to exchange-listed crypto exchange-traded notes from 8 October 2025. The UK is building a fuller crypto regime; check the FCA's website for the current position.

How to check a crypto provider

Do this before you send any money, and repeat it if anything about the firm changes.

1. Find the legal entity. Look at the website footer and terms for the company name, registration number and country. If you cannot find them, stop.
2. Check the national regulator's register in the country where the firm says it is authorised. Our regulator registers page links to the official registers for CySEC, the FCA, BaFin and others.
3. Check ESMA's MiCA register. ESMA publishes an interim register of authorised CASPs, and a list of non-compliant entities, on its website. ESMA does not grant the authorisations itself; national regulators do.
4. Match every detail. The website address, email domain, phone number and physical address should match the register entry. A mismatch is the signature of a clone.
5. Check warning lists. National regulators and IOSCO publish warnings about unauthorised firms. Search the firm's name and web address on them.
6. Confirm the services. Authorisation covers specific services. A firm authorised to provide custody may not be authorised to offer, say, portfolio management.
7. Contact the firm through the details on the register, not through links or numbers you were sent.

The same discipline applies to CFD brokers offering crypto; our guide to how to check a broker licence walks through it step by step.

If you think you have been scammed

• Stop sending money, whatever reason you are given.
• Do not share any more information or install anything the scammer suggests.
• Contact your bank or card provider immediately if you paid by card or bank transfer; early action sometimes helps.
• If you used a legitimate exchange to send crypto, report it to that exchange quickly with the transaction details; occasionally funds can be frozen if they land on a cooperating platform.
• Report it to the police and to your national financial regulator. In the UK, fraud reports go to the national fraud reporting service.
• Keep evidence: messages, website addresses, wallet addresses, transaction IDs and payment records.
• Expect recovery scams and ignore anyone who contacts you offering to get the money back for a fee.

Common mistakes

• Trusting a professional-looking website or app. Design costs little; a matching register entry is what matters.
• Treating a successful small withdrawal as proof of legitimacy. It is often part of the script.
• Assuming a MiCA-authorised firm makes the asset safe. Authorisation is about the provider, not the price.
• Paying a fee to unlock a withdrawal. Legitimate firms deduct charges from your balance; they do not demand new payments first.
• Keeping it secret out of embarrassment. Scammers rely on isolation. Talking to someone you trust breaks the spell.

For the wider context, see what cryptocurrency is and our risk warning.

Frequently asked questions

What is a pig-butchering scam?

It is a long-running investment fraud in which a scammer builds a friendship or romance online, then introduces the victim to a fake crypto platform. The platform shows invented gains to encourage larger deposits, then blocks withdrawals with demands for fees or taxes. The name refers to fattening the victim up before taking everything.

How do I know if a crypto exchange is legitimate in the EU?

Identify the legal entity, check it on its national regulator's register and on ESMA's MiCA register, and confirm that the website and contact details match the entry exactly. Also check regulators' warning lists. If the firm is not listed, do not use it.

When did MiCA come into force for crypto service providers?

MiCA's rules for crypto-asset service providers applied from 30 December 2024. Firms that were already operating under national law could continue during a transitional period that ended on 1 July 2026 at the latest, and earlier in member states that shortened it.

Can I get my crypto back after a scam?

Sometimes, but rarely. Crypto transfers are generally irreversible, so recovery usually depends on law enforcement tracing the funds to a platform that can freeze them. Report quickly to your bank, the platform you sent from, the police and your regulator, and never pay a recovery service an upfront fee.

Does MiCA protect me if a crypto coin I bought goes to zero?

No. MiCA regulates issuers and service providers, requires disclosures and prohibits market abuse, but it does not protect you against price falls and there is no compensation scheme for crypto losses.

Are crypto pump-and-dump schemes illegal?

Market manipulation in crypto assets within MiCA's scope is prohibited in the EU, and similar conduct can breach laws elsewhere. That does not stop schemes from happening, especially in small tokens and outside the EU, and buyers who join late typically bear the losses.