Phishing and Scamming in Cryptocurrency

Recognize online scams, protect your digital assets, and avoid falling victim to fraud.

The world of cryptocurrency offers new opportunities for managing, trading, and internationally transferring digital assets. At the same time, this sector also attracts cybercriminals and online scammers who seek to exploit users' knowledge, trust, and—at times—inexperience.

To protect yourself effectively, it is important to understand how phishing and other forms of cryptocurrency fraud operate, how to identify suspicious situations, and what precautionary measures you can take.

In this article, you will learn about the most common types of online scams, the latest fraudulent techniques, and practical steps you can take to better secure your account and digital assets.

1. What is phishing?

Phishing is a form of cybercrime in which scammers impersonate a trusted organization, company, or individual to obtain sensitive information.

This includes:

• Usernames and passwords.
• Personal and financial data.
• Two-factor authentication (2FA) codes.
• Recovery codes and security credentials.
• Wallet addresses, private keys, and secret recovery phrases (seed phrases).

Phishing often occurs via email, text messages (SMS), WhatsApp, social media, fake websites, and messaging apps. The communication is typically crafted to appear as though it originates from a reliable source.

The goal is usually to trick you into clicking a malicious link, visiting a fraudulent website, or disclosing confidential information.

2. What is cryptocurrency scamming?

Scamming is a collective term for various forms of online fraud in which perpetrators attempt to obtain money, cryptocurrency, or other valuable data from victims.

Phishing is one method used for this. Other examples include fraudulent investment offers, fake exchanges, bogus crypto projects, and investment schemes that promise unrealistically high returns.

Cryptocurrency fraud often involves psychological manipulation. For instance, scammers may try to gain trust, create a sense of urgency, or incite fear, prompting victims to act quickly without properly verifying the situation.

3. Common Types of Cryptocurrency Fraud

Below is an overview of common and current fraudulent techniques within the cryptocurrency industry.

3.1 Phishing Scams

Scammers send fake messages or create websites that closely resemble those of legitimate cryptocurrency exchanges, wallets, or financial service providers. Once you enter your login credentials, they may fall directly into the hands of the scammers.

3.2 Fake Exchanges and Wallet Platforms

Fraudulent websites and applications pose as reliable trading platforms or digital wallets. Users are encouraged to create an account and deposit cryptocurrency. Once the funds are received, the scammers may block access to the assets or simply disappear.

3.3 Ponzi and Pyramid Schemes

In a Ponzi scheme, returns for existing participants are paid using funds from new participants, rather than from actual business profits.

In a pyramid scheme, the primary focus is on recruiting new participants who are required to contribute money. Both structures rely on a continuous influx of new participants and are ultimately unsustainable.

3.4 Fake ICOs and Token Offerings

Fraudsters present fictitious or misleading crypto projects and attempt to persuade investors to purchase new tokens. Once a sufficient amount of money has been raised, the initiators disappear or the project is abandoned.

3.5 Pump and Dump Schemes

In a "pump and dump" scheme, the price of a cryptocurrency is artificially inflated through mass promotion, misleading statements, or coordinated buying.

Once the price has risen sufficiently, the initiators sell off their holdings. This can cause the price to collapse rapidly, leaving other investors with significant losses.

3.6 Malware and Malicious Software

Malware is harmful software that can end up on your computer or smartphone without your knowledge. Some programs are specifically designed to intercept passwords, wallet details, and private keys.

A well-known example is "clipboard malware." This software replaces a cryptocurrency wallet address that you have copied with an address belonging to a fraudster. If you then confirm the transaction without verifying the address, your cryptocurrency may be sent to the wrong recipient.

3.7 Impersonation Scams

In this type of scam, fraudsters pose as well-known individuals, companies, influencers, exchange staff, or customer service representatives.

They often use fake profiles, logos, and official-looking communications to build trust.

A common example involves a scammer posing as a staff member who contacts you, claiming there is an issue with your account. They then ask for your password, 2FA code, recovery phrase, or a payment to "resolve" the problem.

3.8 Social Media Scams and Giveaway Fraud

Through platforms such as Facebook, Instagram, Telegram, WhatsApp, and X, scammers circulate messages promising free cryptocurrency, the doubling of funds, or exclusive investment opportunities.

You are often asked to transfer a small amount first in order to claim a larger reward. In reality, you receive nothing in return.

3.9 Rug Pulls

In a "rug pull," the developers or initiators of a crypto project suddenly withdraw the available liquidity from the project or sell off their large token holdings.

This can cause the market value of the token in question to plummet, leaving investors with tokens that are either illiquid or entirely untradeable.

3.10 Cloud Mining and Mining Bot Fraud

Fraudsters promote websites, applications, or so-called "mining programs" that promise high, guaranteed returns.

Users are asked to deposit funds for mining contracts, equipment, or participation in a mining pool. In reality, no actual mining activity takes place.

3.11 Romance Scams and "Pig Butchering"

In this type of fraud, scammers build a personal or romantic relationship with their victim over an extended period, using social media, dating apps, or messaging platforms.

Once trust has been established, they introduce a supposedly lucrative cryptocurrency investment opportunity. The victim is encouraged to invest increasingly larger sums of money on a fake platform.

The profits shown are often entirely fictitious. When the victim attempts to withdraw their funds, they are told that additional fees or taxes must be paid. Ultimately, the scammer disappears with the invested money.

3.12 Fake Airdrops and Giveaway Tokens

Scammers circulate messages promising free tokens or exclusive "airdrops." To claim the reward, you might be asked to visit a website, connect your digital wallet, or sign a transaction.

Some of these websites are designed to gain access to your wallet or trick you into approving malicious transactions.

Important: Receiving a free token does not automatically mean it is safe to trade it or to visit any associated website.

3.13 Wallet Drainers and Malicious Smart Contracts

A "wallet drainer" is a malicious website or application designed to trick users into signing a harmful blockchain transaction.

This can occur, for example, when you connect your wallet to a fake airdrop, a fraudulent NFT marketplace, or a counterfeit DeFi (decentralized finance) application.

By granting a specific "token approval," you may inadvertently allow a smart contract to access your tokens. If you grant such a malicious permission, your digital assets can subsequently be moved or withdrawn without requiring any further confirmation from you. Therefore, only connect your wallet to websites you trust, and always check what permissions you are granting before signing a transaction.

3.14 Address Poisoning: Manipulation of Wallet Addresses

In an "address poisoning" attack, fraudsters send small transactions to your wallet from an address that closely resembles one you have interacted with previously.

The goal is for you to later copy this counterfeit address from your transaction history and accidentally send cryptocurrency to the fraudster.

Always verify the entire recipient address before confirming a transaction. Do not rely solely on the first and last characters of a wallet address.

3.15 SIM Swapping

In a SIM swap attack, fraudsters attempt to take control of your mobile phone number by deceiving your telecommunications provider.

If successful, they can receive text messages and any verification codes sent to your phone number.

This may allow them to gain access to accounts that are secured exclusively via SMS verification.

Whenever possible, use an authenticator app or a hardware security key instead of SMS verification.

3.16 AI Deepfakes and Voice Cloning

With the development of artificial intelligence, fraudsters can now generate realistic videos, images, and voice recordings, or manipulate existing media.

This allows them to impersonate well-known individuals, business leaders, investors, or even family members.

Therefore, a phone call or video message that seems familiar is not necessarily trustworthy.

Exercise extra caution if someone asks you—via a phone call, video, or voice message—to transfer cryptocurrency, share confidential information, or take immediate action.

Always verify such requests through an independent and previously established communication channel.

3.17 Fake Support and Recovery Scams

When someone falls victim to cryptocurrency fraud, other scammers may attempt to exploit the situation.

They approach victims, claiming they can recover stolen cryptocurrency, reverse transactions, or unlock frozen funds.

To do so, they often demand an upfront payment, access to your wallet, or confidential security credentials.

Be extremely cautious: no one can guarantee the recovery of lost cryptocurrency. Do not make payments to unknown parties who promise to recover your funds.

4. How can you protect yourself against phishing and cryptocurrency fraud?

While it is impossible to eliminate online risks entirely, you can significantly reduce the likelihood of becoming a victim by handling your digital assets and personal information with care and awareness.

4.1 Check senders and messages

Do not simply click on links in emails, text messages, or messages from unknown senders.

Carefully check:

• The sender's full email address.
• The sender's username and profile.
• The content and phrasing of the message.
• Any attachments or links.

Be extra cautious with messages that pressure you to take immediate action.

4.2 Check URLs and domain names

Access cryptocurrency platforms via their official websites and verify the domain name before logging in.

Scammers often use domain names that closely resemble the original website but contain slight differences, such as extra letters, hyphens, or different extensions.

For Mercury Iconex, the official websites are:

• Mercury Iconex: https://www.mercuryiconex.org/
• Mercury Iconex Trading Platform: https://www.mercuryiconex.com/

It is best to save the official website as a bookmark in your browser. This reduces the risk of accidentally visiting a fraudulent website.

4.3 Enable Two-Factor Authentication (2FA)

Whenever possible, enable two-factor authentication for your online accounts, including your Mercury Iconex account and your email account.

2FA adds an extra layer of security to your password. When using an authenticator app, you must enter a temporary verification code in addition to your password.

Note: Never share your 2FA code with anyone. No staff member or support representative will ever need this code to assist you. Please refer to our separate knowledge base guide for instructions on setting up 2FA for your Mercury Iconex account.

4.4 Use strong and unique passwords

Use a separate, hard-to-guess password for every online account.

Avoid:

• Using your date of birth or personal information.
• Simple passwords such as "123456."
• Reusing the same password across multiple websites.
• Sharing passwords via email or messaging apps.

A reliable password manager can help you store strong, unique passwords securely.

4.5 Protect your email account

Your email account is often linked to your financial and cryptocurrency accounts. If a fraudster gains access to your email, they could potentially initiate password resets or intercept important account-related communications.

Therefore, secure your email account with a strong, unique password and 2FA.

4.6 Never share your private keys or recovery phrase

Your private key and seed phrase provide access to your cryptocurrency wallet.

Never share this information with anyone, and do not store it in insecure locations—such as in screenshots, unsecured cloud storage, or messaging apps.

No legitimate customer support team will ever need your private key or seed phrase to assist you.

4.7 Check wallet addresses and blockchain networks

For every cryptocurrency transaction, carefully verify:

• The full receiving address.
• The selected blockchain or network.
• The cryptocurrency you are sending.
• The amount and the associated transaction fees.

Using a correct wallet address on the wrong network can result in your funds failing to arrive or becoming difficult to recover.

When dealing with a new or unknown receiving address, it is advisable to perform a small test transaction first, provided it is practical and financially sensible to do so.

4.8 Exercise caution with wallet connections and smart contracts

Only connect your external wallet to websites and applications that you trust.

Before signing any transaction, read carefully what you are authorizing. Be especially cautious regarding requests to grant "unlimited approvals" for your tokens.

Periodically review which applications have permission to access your tokens, and revoke any unnecessary or suspicious permissions using reliable blockchain tools.

4.9 Use security software and keep your devices up to date

Ensure that your computer, smartphone, browser, and security software are updated regularly.

Only download applications from official app stores or the provider's official website.

Do not install unknown browser extensions, software, or files offered to you via messages or advertisements.

4.10 Be cautious when using public Wi-Fi networks

Avoid conducting financial transactions over unsecured public Wi-Fi networks.

If you must use a public network, remain extra vigilant for suspicious login pages or connection warnings. A VPN can provide additional privacy, but it does not guarantee that a network or website is secure.

4.11 Consider a hardware wallet

If you intend to store larger amounts of cryptocurrency for an extended period, you might consider using a hardware wallet.

A hardware wallet stores your private keys on a separate physical device, thereby offering protection against certain types of online attacks.

Please note that a hardware wallet does not provide complete protection against fraud. If you sign a malicious transaction yourself or share your recovery phrase, your funds could still be lost.

4.12 Carefully research investment opportunities

Do not be swayed by promises of guaranteed profits or exceptionally high returns.

Before investing, research the following:

• The project and its underlying technology.
• The identity and background of the initiators.
• The tokenomics and available liquidity.
• The reliability of the website and communication channels.
• Independent reviews and any existing warnings.

Never invest solely based on recommendations from strangers on social media or messaging apps.

4.13 Be alert to AI-generated communication

Do not blindly trust videos, voice messages, screenshots, or messages that appear to come from well-known individuals or organizations.

Always verify financial requests through a second, independent communication channel.

4.14 Monitor your account activity

Regularly check your account activity, transactions, and any security notifications. If you notice an unfamiliar login, a suspicious transaction, or any unusual activity, take action immediately.

If available, use the security and session management features provided by the platform in question.

5. What should you do if you have become a victim of fraud?

If you suspect that your account, wallet, or cryptocurrency has been compromised, it is important to act quickly and carefully.

Follow the steps below:

Step 1 – Stop all further transactions immediately.
Do not send any more cryptocurrency and do not make any new payments to the suspected fraudster.

Step 2 – End any suspicious communication.
Do not click on any further links, do not open any attachments, and do not provide any additional personal or security information.

Step 3 – Secure your accounts.
If your account may have been compromised, change your passwords using a trusted and secure device. Also, secure the email account linked to your trading account.

Step 4 – Contact official customer support.
If your Mercury Iconex account is involved, contact the company exclusively through official Mercury Iconex communication channels. State that you may have been a victim of phishing or fraud.

Step 5 – Preserve evidence.
Do not delete any messages or emails that could serve as evidence. Where possible, keep a record of:

• Screenshots of suspicious communication.
• Email addresses and usernames.
• Website addresses and links.
• Transaction IDs (TXIDs).
• Wallet addresses of the parties involved.
• The date and time of the events.

Step 6 – Report the fraud to the appropriate authorities.
Depending on the situation, you may need to report the fraud to your bank, telecommunications provider, the police, or other relevant authorities.

Important: Cryptocurrency transactions on a blockchain are generally irreversible. Once a transaction has been confirmed, it usually cannot be easily undone. Therefore, exercise extreme caution regarding so-called "recovery services" that guarantee they can retrieve your lost cryptocurrency.

6. Important security rules for Mercury Iconex users

To better protect your Mercury Iconex account and digital assets, we advise you to always follow these basic rules:

Mercury Iconex will never ask you to share your password, 2FA verification code, private key, or seed phrase with any member of our staff. Never share this information via email, phone, WhatsApp, social media, or any other communication channel.

7. Stay alert: digital security starts with you

The cryptocurrency sector is constantly evolving. New technologies bring new opportunities, but also new forms of fraud.

Scammers are continually adapting their methods. While phishing once primarily took place via simple fake emails, fraudsters now use professional-looking websites, impersonated social media profiles, automated messages, and artificial intelligence.

The best protection, therefore, begins with awareness, caution, and verifying information before taking action.

Remember:

• If an offer seems too good to be true, it usually is.
• If someone pressures you to send cryptocurrency immediately, be extra cautious.
• If anyone asks for your password, 2FA code, or seed phrase, cut off contact.
• If you are unsure about the legitimacy of a message, website, or request, verify it first through an independent and official communication channel.

At Mercury Iconex, we believe it is important that users not only have access to digital financial services but also possess the knowledge to use them consciously and responsibly.

Stay informed. Stay critical. Protect your digital assets.

Updated on: 03/11/2026