If you are looking for a list of items that Investor.gov alerts “require you to capture” when reporting a crypto investment scam, the supplied FTC source does not contain one. The article “How To Recognize and Avoid Phishing Scams,” published October 11, 2024, describes how phishing messages work and the stories scammers use. It does not describe Investor.gov alerts, government reporting forms, or any evidentiary checklist. This piece stays inside that boundary: what the source actually establishes, and what it leaves open.
What the source confirms about phishing messages
The core mechanism is credential and data theft. According to the source, scammers use email or text messages to try to steal your passwords, account numbers, or Social Security numbers (c01). If they get that information, they could get access to your email, bank, or other accounts (c02), or sell your information to other scammers (c03). The source states that scammers launch thousands of phishing attacks like these every day and that they are often successful (c04).
The source also notes that scammers update their tactics to match news or trends (c05). What follows is a set of common tactics, not a complete or current catalog. That distinction matters for anyone building an evidence record: the tactic list is illustrative, while the underlying trick is consistent.
The stories scammers use
Phishing emails and text messages often tell a story to trick you into clicking a link or opening an attachment (c06). The message may look like it comes from a company you know or trust, such as a bank, a credit card or utility company (c07), or an online payment website or app (c08). The source lists several storylines a scammer might use (c09):
- Claiming they noticed suspicious activity or log-in attempts, which they have not (c10).
- Claiming there is a problem with your account or payment information, which there is not (c11).
- Saying you need to confirm personal or financial information, which you do not (c12).
- Including an invoice you do not recognize, which is fake (c13).
- Asking you to click a link to make a payment, where the link carries malware (c14).
- Saying you are eligible for a government refund, which is a scam (c15).
Look-alike branding and the logo problem
The source uses a worked example of an email that looks real at first glance but is not (c16). It explains that scammers who send such emails are hoping you will not notice it is fake (c17). It then identifies signs that the email is a scam even though it looks like it comes from a company you know and even uses the company’s logo in the header (c18).
For reputation and identity work, this is the most directly usable observation in the source: a recognizable name and a copied logo are not proof of authenticity. The source treats branding as something a scammer can reproduce, not as a verification signal. That is an observation drawn from c18, not an instruction to label any message with a familiar logo as fraudulent.
Applying this to crypto identity checks
The source’s examples are banks, card issuers, utilities, and online payment sites. It does not mention crypto exchanges, wallets, or support desks. By analogy only, a digital-asset user may see the same story patterns — a claimed login attempt, an account problem, a request to confirm details — presented under a familiar brand. That is inference, not something the source states.
What the source does support is a narrow, testable reading: treat the story and the branding as separate claims. The message asserts an event (“suspicious activity,” a payment problem, a refund). The source repeatedly flags those assertions as false in the phishing examples it describes (c10–c15). Combined with the logo observation (c18), the practical takeaway is to verify the claimed event through a channel you choose, not one supplied inside the message. The source does not say how to do that for crypto platforms, so any specific platform procedure would need its own evidence.
What the source does not say
Several things a reader might expect are absent, and should not be filled in from memory or assumed:
- No Investor.gov content. The source does not mention Investor.gov, its alerts, or what any such alert requires you to capture. That reader question cannot be answered from this evidence.
- No evidentiary checklist. The source provides no list of fields (sender address, headers, timestamps, attachments) to preserve when documenting a message. Any such list would be outside this evidence.
- No reporting channel. The source in this pack does not name a reporting destination or form.
- No crypto-specific claims. Nothing in the source addresses exchanges, wallets, tokens, or crypto investment solicitations.
- No statistics beyond the stated claim. The source says attacks are launched “thousands” of times every day and are often successful (c04); it supplies no precise counts, success rates, or dollar losses.
An evidence-first reading
A defensible position for a digital-asset user is to separate three layers. First, the story: what the message claims happened (c06–c15). Second, the identity signal: the name and logo presented, which the source shows can be faked (c18). Third, your own next step: verify through an independent channel and preserve the original message in its unaltered form. The third layer is not specified by this source; the first two are.
Because the source does not define an Investor.gov capture standard, anyone who needs that standard should consult the actual alert or form. Claiming that this FTC article satisfies that requirement would overstate the evidence. What it does provide is a clear description of how phishing messages deceive, which is a useful frame for evaluating a suspicious message — not proof of any particular platform’s guilt, and not a recovery promise.
The boundary is worth restating plainly: this article maps the source’s claims to a verification frame. It does not establish that any named company, platform, or message is fraudulent, and it does not describe Investor.gov requirements. Where the evidence stops, the honest answer stops with it.