Guide
How to Spot Fake Exchanges and Phishing Scams: Protecting Your Bitcoin
The bottom line: look-alike URLs, fake apps, and fake alerts target your login credentials
The goal of fake exchanges and phishing scams is to steal your login credentials, private keys, and authentication codes. Common tactics include domains crafted to resemble the real thing, counterfeit apps, and fraudulent emails or text messages impersonating your bank or exchange (SMS phishing, or "smishing"). You can prevent most of these attacks with three habits: always open the site from a bookmark, use two-factor authentication, and keep your assets in a hardware wallet.
Key takeaways
- Fake sites impersonate the real thing using look-alike domains (misspellings or a different TLD).
- Never click links in fake emails or texts (smishing). Legitimate services don't prompt you to log in out of the blue.
- Unregistered offshore platforms can be checked against regulators' published lists. Withdrawal-refusal problems are common with them.
- The core defense is bookmark access + two-factor authentication + a hardware wallet.
What to look for
| Check | The safe way to do it |
|---|---|
| URL | Don't open from search ads or notifications—open from your own bookmark |
| Domain | Check for misspellings, extra hyphens, or an unfamiliar TLD |
| App | Verify the link on the official site and the publisher in the official app store |
| Email/SMS | Don't click links; log in directly from the app or a bookmark |
| Registration | Check the regulator's registered-operator list / unregistered-operator list |
The "top-of-results" ad can sometimes be a fake site. Don't access exchanges through ads—use the bookmark you normally rely on.
A typical phishing scenario
- A fake email or text arrives saying something like "Your account has been locked" or "Suspicious login detected."
- A link designed to make you panic sends you to a fake login page that looks just like the real one.
- The ID, password, and two-factor code you enter are stolen on the spot.
- The attacker immediately logs in to the real site and drains your assets.
The moment a page tries to get you to enter your seed phrase (recovery phrase) or private key, it's a scam. No legitimate service will ever ask for these.
How to protect your Bitcoin
- Access sites only from bookmarks, and never click links in emails or texts.
- Enable two-factor authentication (ideally an authenticator app or a security key).
- For long-term holdings, move funds off exchanges using secure storage and a hardware wallet.
- Avoid unregistered offshore operators and verify their registration with regulators (withdrawal-refusal cases have been reported).
- If you send funds to the wrong place, see what to do when you send to the wrong address. For the full picture of these tactics, see Bitcoin scams and how to avoid them.
Frequently asked questions
Q. How can I spot a fake exchange? A. Look-alike domains and counterfeit apps are the telltale signs. Don't enter through links in ads or emails—verify using your bookmark and the regulator's registered-operator list.
Q. Am I safe if I use two-factor authentication? A. It lowers your risk, but phishing can steal your authentication code along with everything else. The premise is that you never share your code with anyone and never click suspicious links.
Q. What should I do if a screen asks me to enter my seed phrase? A. It's a scam. Legitimate services never ask you to enter your seed phrase or private key. Close it immediately.
Q. Is it okay to use overseas exchanges? A. Unregistered operators have frequent problems such as refusing withdrawals. Always confirm that they are properly registered with regulators.
Sources
- Financial Services Agency, "Names of parties conducting crypto-asset exchange business without registration": https://www.fsa.go.jp/policy/virtual_currency/angoushisan_mutouroku_j.pdf
- Financial Services Agency, "Be cautious when dealing with unregistered operators": https://www.fsa.go.jp/ordinary/chuui/highrisk.html
- Bitcoin.org (security basics): https://bitcoin.org/ja/secure-your-wallet
A note on investing
This article is for informational purposes only and is not investment advice. Bitcoin carries risks including price volatility, hacking, and loss. Make investment decisions at your own responsibility and only with funds you can afford to lose. Tax rules and regulations can change, so always confirm the latest details from official primary sources.
Sources
FAQ
- How can I spot a fake exchange?
- Look-alike domains and counterfeit apps are the telltale signs. Don't enter through links in ads or emails—verify using your bookmark and the regulator's registered-operator list.
- Am I safe if I use two-factor authentication?
- It lowers your risk, but phishing can steal your authentication code along with everything else. The premise is that you never share your code with anyone and never click suspicious links.
- What should I do if a screen asks me to enter my seed phrase?
- It's a scam. Legitimate services never ask you to enter your seed phrase or private key. Close it immediately.
- Is it okay to use overseas exchanges?
- Unregistered operators have frequent problems such as refusing withdrawals. Always confirm that they are properly registered with regulators.
This article is informational only and is not financial, investment, or trading advice. Prices are reference snapshots and may be outdated. Always do your own research.
