SimpleSwap

Fake Support: How Crypto Impersonation Scams Catch People Looking for Help

You post asking for help in a public Discord or Telegram – and within minutes, someone posing as support DMs you. That timing isn't luck. It's the attack.

The pattern

  1. 1

    You ask for help publicly

    A transaction is delayed, or a wallet looks wrong, and you post about it in a project's Telegram or Discord.

  2. 2

    A “support” account messages you

    Within minutes, a DM arrives – matching branding, a plausible username, a professional tone. The timing itself feels like proof.

  3. 3

    The request turns sensitive

    Troubleshooting questions escalate: a recovery phrase for “verification,” a cloned interface, or an urgent transfer to a “safe” wallet.

  4. 4

    Credentials or crypto move

    None of this needs a technical exploit. The attacker only needs you to believe you're speaking to support.

A fast reply is not proof of identity. Verify support through a channel you opened yourself.

1,400%+

YoY growth in impersonation scams in 2025 (Chainalysis)

$14B+

in on-chain inflows to crypto scams in 2025

4.5×

more stolen per operation when scammers use AI tooling

Fastest-growing isn't largest – investment scams and pig butchering still lead by volume, often run by the same organized networks behind pig butchering's forced-labor compounds.

Why it works

You already asked for help

You didn't contact the scammer, but you did signal you needed help – so a DM right after can feel like a response, not an approach.

You're mid-problem

A delayed transaction or a locked-looking wallet creates urgency, right when a quick fix feels most valuable and least worth questioning.

Speed is the scammer's tool

Automated monitoring and organized teams let them reach you fast. A quick response is not evidence the sender is legitimate.

A hardware wallet couldn't stop this one

On January 10, 2026, investigator ZachXBT reported a victim had lost more than $282 million in Bitcoin and Litecoin – one of the largest individual social-engineering losses on record. The attacker impersonated Trezor support and persuaded the victim to expose their wallet recovery phrase. The hardware wallet itself was never technically breached.

The device could protect the keys from remote extraction. It couldn't protect a recovery phrase its owner was persuaded to disclose.

The rules before trusting support

Treat DMs as unverified

Don't rely on a profile picture, username or how much they already know about your problem.

Open the channel yourself

Close the conversation and navigate independently to the official site or app – never a link they send.

Never share wallet credentials

No genuine support agent needs your recovery phrase or private key to investigate a transaction.

Verify payment requests

A fee alone doesn't prove a scam – the unsolicited DM asking for it does. Confirm through an official channel first.

How SimpleSwap support actually works

simpleswap.ioLive chat & contact formsupport@simpleswap.io

We never need your seed phrase or private key. For a delayed transaction, we may ask for your Exchange ID and, once sent, the TXID.

A fee alone doesn't prove a scam – some refunds involve one under our Terms. What matters is verifying the request yourself before paying, never through an unsolicited DM.

If you're contacted

  • Stop. End the conversation and don't follow any links they send.
  • Verify. Open simpleswap.io independently – never through a link in the message.
  • Report. Send official support your transaction details, so we can flag the pattern.

Want the full breakdown?

Read the full guide for the Coinbase and Chainalysis research in detail, the recovery-scam follow-up pattern, and the complete list of rules.

Key takeaways

  • A fast, convincing reply is not proof of identity – especially right after you post in public.
  • Real support answers where you asked; it doesn't DM you first.
  • No genuine support agent ever needs your recovery phrase or private key.
  • Verify support through a channel you opened yourself – never one they opened for you.

Fake Support FAQ

You can't, from the profile alone – matching branding and a plausible username don't verify anyone. Close the conversation and open the official site or app yourself instead of trusting how convincing the message looks.

Run the full 10-second check

No. A standard SimpleSwap exchange doesn't require those credentials, and no one investigating a transaction on your behalf needs them either.

Most support doesn't involve one, but our Terms do allow a real fee in some refund and fund-recovery situations – for example, covering a network fee on a token refund. The safe test isn't whether a fee exists; it's whether you verified the request yourself through simpleswap.io or support@simpleswap.io before paying anything.

Usually your Exchange ID, and once a deposit has been sent, the transaction ID (TXID) from a block explorer. Refund, compliance or deposit-ownership cases may need additional verification.

No service can fully be, since impersonation uses a brand's name without ever touching the platform itself. SimpleSwap never messages you first, never asks for your recovery phrase, and support@simpleswap.io, the contact form and live chat on simpleswap.io are our only official channels.