How to Spot a Fake Crypto Exchange: Warning Signs and Checks

TL;DR
– Most fake exchanges are not random websites. They are the last step of a long con: someone builds trust with you for weeks, then sends you to a “platform” that only exists to take your deposit.
– The losses are large. The FBI’s IC3 counted $7.228 billion lost to cryptocurrency investment fraud in the US in 2025, the biggest source of reported losses that year.
– The clearest warning sign is a withdrawal problem. If a platform shows big profits but wants a “tax”, “fee” or “unlock deposit” before you can withdraw, it is a scam.
– You can check a firm in minutes. In the EU, look it up in ESMA’s MiCA register. Elsewhere, use regulator warning lists and IOSCO’s I-SCAN.
– After a scam, expect a second scam. Fake “recovery” firms and fake law firms target people who have already lost money.

Contents
1. How fake crypto exchanges work
2. What the numbers say
3. Warning signs of a fake crypto exchange
4. How to check if a crypto exchange is legitimate
5. What to do if you already sent money
6. Watch out for recovery scams
7. FAQ

A fake crypto exchange has a logo, a login page, moving charts and a growing balance. It has no real trading behind it. Your deposit goes to the people running it, and the screen shows whatever they want. Here is how these platforms operate, how to spot and check them, and what to do if it has already happened.

How fake crypto exchanges work

There are three common versions. They often overlap.

1. The relationship scam (“pig butchering”). The US Treasury’s FinCEN described this pattern in a 2023 alert. The name comes from the scammers’ own logic: they “resemble the practice of fattening a hog before slaughter.” Contact usually starts with a text, a social media message or a dating app, sometimes disguised as a wrong number. The scammer builds a friendship or romance over weeks, then mentions a crypto opportunity. You are directed to “websites or applications designed to appear legitimate, but which are fraudulent.” When you try to withdraw, “the scammer may demand that the victim pay purported taxes or early withdrawal fees.” When you can no longer pay, they disappear.

2. The cloned site. A copy of a real exchange’s website on a slightly different address: one extra letter, a different ending, a hyphen. The goal is to steal your login details or get you to deposit to an address the criminals control.

3. The fake trading app. An app that shows live-looking prices and a profitable account. The FBI describes victims being told to send cryptocurrency to fake platforms, shown fake profits, and then asked to pay taxes and fees before they can withdraw (IC3 2025 report).

What the numbers say

The figures below are reported losses, so the real totals are likely higher.

The FBI states plainly that “cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025.” Chainalysis adds that impersonation scams grew “more than 1400% compared to 2024.” Fewer victims are needed when each one pays more.

Warning signs of a fake crypto exchange

No single sign proves a scam. Two or three together should stop you.

A padlock in the browser only means the connection is encrypted, not that the people at the other end are honest.

How to check if a crypto exchange is legitimate

These checks take less time than the scammer spent being nice to you.

EU. MiCA, the EU’s Markets in Crypto-Assets Regulation, sets uniform rules for crypto-assets. ESMA keeps an interim register that includes a file of “Authorised crypto-asset service providers (Title V)” and a separate file of “Non-compliant entities providing crypto-asset services” (ESMA). Firms that operated under national law before 30 December 2024 could continue under transitional rules only “until 1 July 2026 or until they are granted or refused a MiCA authorisation.” ESMA notes the register is refreshed weekly, so a very recent decision may not show yet. Search for the exact legal name, then make sure the website you are on is really that firm’s.

Everywhere. IOSCO’s I-SCAN collects alerts that securities regulators submit, covering unlicensed firms and impersonators. IOSCO says the information “is submitted by IOSCO members,” so treat it as a list of warnings, not a list of approved firms.

US. A FinCEN registration entry is a minimum, not a seal of approval. It tells you the firm filed paperwork. It does not tell you the firm is safe.

Then type the exchange’s address yourself instead of clicking links, and compare it with the one in the regulator’s record. If someone hands you a platform no regulator has heard of, you have your answer.

If you want the bigger picture of how money is actually made (and lost) in this space, see how to make money in Web3, which covers the risks plainly.

What to do if you already sent money

1. Stop paying. No “fee” or “tax” will release your balance. The balance was never real.
2. Save everything. Screenshots, chat logs, wallet addresses, transaction IDs, the website address, phone numbers.
3. Contact the exchange or bank you sent the money from. They may be able to flag the receiving address. The FTC is honest about the odds: “Once you pay with cryptocurrency, you can usually only get your money back if the person you paid sends it back.”
4. Report it. In the US, report to IC3 and the FTC at ReportFraud.ftc.gov. In the EU, report to the police and your financial regulator.
5. Secure your accounts. Change passwords and 2FA on any account whose details you shared.

Watch out for recovery scams

The FBI warns that victims of crypto investment scams “are also targeted in recovery scams, claiming to help recover lost funds.” In 2025 the IC3 recorded 10,516 complaints about recovery scams, with $1.4 billion in losses. The report notes these losses may include money lost in the earlier scam that led to the recovery contact (IC3 2025 report).

An FBI public service announcement from August 2025 describes fictitious law firms that impersonate real lawyers or firms, cite made-up government agencies and add victims to WhatsApp group chats. Its red flags include:

• Claims of partnership with government agencies. The FBI says “There are no law firms which are officially authorized partners of US Government agencies.”
• Requests for payment in crypto or gift cards. “The US Government does not request payment for law enforcement services provided.”
• Knowledge of the exact amounts and dates of your earlier transfers.
• Refusal to show credentials or a licence, or to appear on camera.

So, a stranger who knows exactly how much you lost and only needs a small fee to return it. Generous.

FAQ

About the Author

Vyara Stefcheva

Vyara Stefcheva is the founder and editor of Egorithms and an independent marketing expert. She follows how technology, AI and algorithms change the way people find, choose and buy, and writes about what that means for businesses and for the people who use them.

She has spent her career building marketing and business strategies for more than 300 brands across three continents. She built and exited a marketing agency and now works independently. She has taught more than 20,000 people through lectures, courses and corporate training, and speaks at conferences about AI and the future of the internet.

On her YouTube channel she tests new AI and marketing tools as they launch and gives each an independent verdict: adopt, watch or ignore.

See author's posts