The safest first move when an unexpected message claims to be from a platform, support desk, or project you use is to treat it as unverified and check the claim through a route you choose yourself. The message may look like it comes from a company you know or trust — a bank, a payment app, or, in the crypto context, an exchange or wallet support channel — but according to the Federal Trade Commission (FTC), scammers use email or text messages to try to steal your passwords, account numbers, or Social Security numbers (c01). If they get that information, they could get access to your email, bank, or other accounts, or sell your information to other scammers (c02, c03).
This guide is about identity verification, not about deciding that any particular named brand is fraudulent. A similar-sounding name, a matching logo, or a polished tone is not proof of fraud on its own, and neither is it proof of legitimacy. The point is to separate what a message claims from what you can independently confirm.
Why impersonation is the core risk
The FTC states that scammers launch thousands of phishing attacks like these every day — and they are often successful (c04). Scammers often update their tactics to keep up with the latest news or trends (c05). That matters for crypto users because fast-moving news and new product names give impersonators fresh material to borrow, which makes a message feel timely even when it is fabricated.
Phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment (c06). You might get an unexpected email or text message that looks like it is from a company you know or trust, like a bank or a credit card or utility company, or from an online payment website or app (c07, c08).
The common storylines to recognize
The FTC lists several recurring tactics a scammer might use. Recognizing the storyline is the first filter, because each one is designed to create urgency or authority before you have time to verify (c09).
- They say they have noticed some suspicious activity or log-in attempts — they have not (c10).
- They claim there is a problem with your account or your payment information — there is not (c11).
- They say you need to confirm some personal or financial information — you do not (c12).
- They include an invoice you do not recognize — it is fake (c13).
- They want you to click on a link to make a payment — but the link has malware (c14).
- They say you are eligible to register for a government refund — it is a scam (c15).
In the crypto setting, the "suspicious log-in" and "problem with your account" scripts are especially common pretexts for asking for a seed phrase, a one-time code, or a wallet connection. The evidence-supported rule is narrow: a message that asks you to confirm personal or financial information is asking you to do something you do not need to do (c12).
Verification steps that do not depend on the message
The following steps are a way to organize verification using only the channels you already trust. They are not a guarantee against every attack, and they do not establish that any specific sender is a scammer.
1. Do not use the contact details in the message. Since the premise of phishing is a story that tricks you into clicking a link or opening an attachment (c06), replying, calling a number from the message, or opening the attachment keeps you inside the sender's frame. Go to the platform's own app or a destination you typed or bookmarked yourself.
2. Separate story from account state. A claim of suspicious activity (c10) or an account problem (c11) is a statement about your account. You can check your account state directly through a channel you control instead of trusting the assertion. If nothing in your own account view matches the claim, the message has failed its own test.
3. Treat logo and header as decoration, not evidence. The FTC notes that an email can look real, use a company's logo in the header, and still be a scam (c16, c17, c18). Visual fidelity tells you the sender copied a design; it does not tell you who is behind it.
4. Inspect the request type before the request content. Credentials, account numbers, and identity data are the assets at stake (c01). A legitimate support interaction is not made safer by a friendly tone, and the cost of sharing the wrong item is account access or resale of your data (c02, c03).
5. Keep the claim labeled as unverified until a second, independent channel confirms it. "Project X support messaged me" and "Project X support is messaging me and I confirmed it through the channel I already use" are different statements. Only the second one is a verification result.
What the source does not say
The source used here does not establish that any named platform, exchange, project, or individual is a scammer, and it does not provide a test for judging a brand by its name. It does not describe crypto wallets, seed phrases, token prices, or blockchain transactions specifically. It does not state how often any particular tactic succeeds, how to recover funds, or what to do after credentials are lost. It also does not describe how to authenticate a sender's technical origin, such as by examining email headers, and it offers no list of verified company contact channels.
Because of those gaps, this guide cannot tell you that a specific message you received is fraudulent. What it can do is help you keep the decision inside evidence you gathered yourself, rather than inside a story someone else wrote.
How to read a suspicious message, step by step
Sort what you have into two columns. In the first column, put what the message claims: it is from a trusted company (c07), there is suspicious activity (c10), there is an account or payment problem (c11), or you must confirm information (c12). In the second column, put what you can observe without using the message: your own account view, your own login history, your own records. If the second column is empty, the message is unverified regardless of how convincing it looks.
The FTC's framing is useful here: these messages often tell a story (c06), and the sender is hoping you will not notice it is a fake (c17). Verification is the act of refusing to accept the story as a substitute for your own observation. That standard applies equally to a bank alert, a payment app notice, and a message that claims to be project support.