The useful starting point is simple: before you trust a crypto exchange page, read the domain in the address bar character by character, not the logo or the headline. A fake site is often built to survive a quick glance, and a single switched letter or added word is the cheapest way for an impostor to hide in plain sight.
The consumer guidance behind this article comes from QR-code payment scams. It notes that people have reported scammers covering up legit QR codes on parking meters with a QR code of their own, and that scanning such a code could take you to a fake site designed to steal your money, your personal information, or both. The same habit of checking the destination before you act transfers directly to crypto exchange lookalikes.
Why the domain matters more than the design
A convincing page can copy a real exchange's colors, fonts and wording quickly. The domain is harder to fake at scale because it is the actual address your browser connects to. The source guidance points to a practical control: many QR readers preview the link they will send you to. Make sure there are no spelling mistakes or switched letters in the link before you click.
That rule is not only for QR codes. Treat every exchange link you receive by message, search result, ad or social post the same way. Ask what the exact domain is, and whether you arrived there on purpose or were pushed there by something you scanned or tapped.
A domain-first checklist for exchange lookalikes
- Read the registrable domain, not the subdomain. The part just before the final dot is what identifies the organization. Long prefixes and extra words in front can be decoration.
- Check for switched letters and doubled letters. Compare the domain to the address you already know, letter by letter, especially around common endings.
- Check for added or dropped words. Look at whether the domain inserts a word such as a region, a login term, or a hyphen that the real brand does not use.
- Watch the path and the padlock. A padlock only says the connection is encrypted; it says nothing about who owns the site. The source guidance is about the link itself, so keep your eyes on the address.
- Do not log in from the link. Navigate to the exchange the way you normally would instead of entering credentials on a page you reached from an unsolicited source.
- Update your phone's operating system and apps. The source guidance lists updating the OS and apps to help prevent scammy links from turning into a hack.
- Protect accounts with strong passwords and multi-factor authentication. That is the source's own recommendation for online accounts generally.
Worked example: reading a lookalike domain
Below is a Hypothetical illustration. None of these domains is asserted to exist, and none should be read as evidence about any real exchange.
| Hypothetical domain | What to notice |
|---|---|
| exchange-login.example | An added word plus a hyphen; the real brand may use neither. |
| exchage.example | A dropped letter in the middle of the name. |
| exchnage.example | Two letters switched in order. |
| exchange.example.co | A different final ending after the brand's usual ending. |
Calculation: in the table above, three of the four rows show a change to the name itself, and one shows a change to the ending. That split is a simple count of the Hypothetical rows, not a statistic about real scam prevalence. The point is that lookalikes are not only about misspelled brand names; they also move the ending.
If a QR code preview shows a domain like any of these, the safe action is to stop rather than to click. The source guidance says that if you scan that scammy QR code, it could take you to a fake site designed to steal your money, your personal information, or both.
If you already typed credentials into a lookalike
The source guidance gives three practical steps after contact with a suspected fake site. First, do not interact with the scammer: if you reach out to someone through the website you think is fake, they may try to get money or sensitive information out of you. Second, change your password immediately wherever you used the same password for other accounts. Third, review your transactions by checking your credit card and bank statements to spot transactions you didn't make.
None of this is a recovery guarantee. The guidance is about limiting further exposure and spotting unauthorized activity, not about getting funds back.
Where an exchange brand check stops
A domain mismatch is a reason to pause and verify through a route you choose yourself. It is not, by itself, proof that a named business is a scam, and a matching-looking name should not be treated as proof of legitimacy either. The source material is about QR-code payment scams and general account hygiene, not about any specific crypto exchange.
What the source does not say
- It does not name any crypto exchange, identify a specific fake exchange site, or state that a particular domain is fraudulent.
- It does not give a list of official exchange domains or a method for confirming brand ownership beyond checking the link preview.
- It does not state how often lookalike domains appear, how quickly they are taken down, or whether reporting one leads to any result.
- It does not address crypto withdrawals, wallet approvals, seed phrases, or fund recovery.
- It does not confirm that any preview shown by a QR reader is complete or trustworthy, so the preview should be treated as a first check, not a final one.
Bottom line
Check the domain before the design. Read the registrable domain slowly, look for switched or doubled letters and added words, and prefer getting to an exchange the way you normally do. If you land somewhere suspicious, do not engage, change any reused password, and review your statements for transactions you did not make.