Fake support
It is not sophisticated and it does not need to be. Somebody answers your question, and by the end of the conversation your wallet is empty.
If you asked us to name the one thing that takes the most money from ordinary people in crypto, it would not be a hack, a collapse or a bad trade. It would be somebody being helpful in a chat window.
The shape is always the same
You have a problem — a stuck transaction, a failed deposit, a wallet that will not connect. You ask about it somewhere public: a Telegram group, a Discord server, a reply under a post. Within minutes, somebody answers.
They are polite and competent. They use the project's name and picture. They know the terminology. They ask you to continue in a private message, because "we do not discuss account details in public" — which sounds exactly like a real support policy, and is the first move in every version of this.
Then comes the request. It is one of three things, and after that the money is gone.
- The recovery phraseFramed as a "wallet validation", a "restore" or a "sync with our system". The moment you type it anywhere, the wallet belongs to them.
- A link to a support pageA convincing copy of the real site, asking you to connect your wallet and approve one small transaction that empties it.
- Remote access to your screenFramed as faster than explaining. They watch you type, or find the phrase already sitting in a file.
Real support answers, it never initiates
If a message arrives before you opened a ticket, it is not support. That single test catches almost every case, and it does not require you to judge whether the person sounds legitimate.
Why competent people fall for it
Because the assumption behind the whole thing is reasonable. Everywhere else in your life, a company that sees you struggling and reaches out is providing good service. Banks call. Airlines email. Support agents appear in chat widgets. The instinct is correct in every other context.
The second reason is timing. These messages arrive when you already have a problem and are already anxious about money that appears to be stuck. Someone who solves that feeling gets a great deal of trust very quickly, and the scam is designed to arrive exactly at that moment.
The third is that impersonation is now effortless. The display name, the avatar, the bio and the pinned link can all be copied in under a minute. On Telegram, a username one character different from the real one is invisible in a busy thread.
Where it happens
Telegram. The largest venue by a wide margin. Groups are public, membership lists are readable, and asking a question in one is effectively broadcasting that you have funds and a problem. Bots scrape these groups for exactly that.
Discord. Same pattern, plus fake "verification" bots and announcement channels that look official because the server has thousands of members.
X and Reddit. Reply-based. You post a complaint about an exchange, and three accounts with support-shaped names reply within a minute, all pointing to a page that will ask you to connect a wallet.
Search results. The oldest variant and still effective. A paid advertisement above the real result, on a domain one letter different, serving an identical login page.
Asking for help in public is itself the trigger
You do not need to click anything to become a target. Posting "my withdrawal is stuck on X" in an open group is enough, and the replies will start arriving within minutes.
What actually protects you
Not vigilance, and not being able to spot a fake. The fakes are good and getting better, and any rule that depends on you judging quality under stress will eventually fail.
What works is a rule that does not require judgement at all.
- You start every support conversationThrough the app or the site you navigated to yourself. Never through a link, a reply or a message that came to you.
- Nobody hears your recovery phrase, everThere is no legitimate reason. Not a restore, not a validation, not a migration. No exceptions means you never have to evaluate the exception.
- Private messages are where you leave, not where you continueA stranger who immediately wants to talk in private is removing the witnesses.
- Nothing is decided in the first ten minutesAnything that cannot survive an hour of you checking was never going to help you.
If you already replied
Replying is not the loss. Typing the phrase, signing the transaction or handing over the screen is the loss.
If you gave nothing away, stop the conversation, block, and report the account in the real group. If you gave the phrase, treat every asset in that wallet as compromised right now and move what you can to a new wallet created on a clean device — the page on what to do when funds are gone covers the order to do it in.
And if the losses are already real: nobody who contacts you afterwards can recover them. That offer is the second scam, aimed at the same person, and it is covered in the same page.