How to Spot and Avoid Scams on Crypto Exchanges? (Common Red Flags)

Unverified Platform Credentials

1. The exchange lacks registration with recognized financial authorities such as the U.S. SEC, UK FCA, or Japan’s FSA.

2. No physical headquarters address is listed on the official website or the address cannot be verified via third-party business registries.
3. Domain registration details show recent creation, often less than six months old, and use privacy protection services to hide ownership.
4. Regulatory disclaimers are vague—phrases like “operates globally” or “compliant where applicable” replace specific jurisdictional licenses.
5. User reviews on independent forums mention repeated failures to produce proof of reserve audits or signed attestations from reputable accounting firms.

Suspicious Withdrawal Behavior

1. Withdrawal requests trigger arbitrary delays exceeding 72 hours without transparent status updates.

2. Minimum withdrawal thresholds suddenly increase without prior announcement or justification.
3. Users report receiving error messages like “KYC pending” despite having submitted verified documents multiple times.
4. Wallet addresses provided for deposits change without notice or fail checksum validation when pasted into blockchain explorers.
5. Internal transfers between user accounts show inconsistent timestamps or mismatched hash records in transaction logs.

Aggressive Marketing Tactics

1. Prominent banners promise guaranteed returns—“12% APY on stablecoins”, “risk-free staking”, or “doubling your BTC in 30 days”.

2. Affiliate programs reward users for recruiting others with escalating commission tiers, mimicking pyramid structures.
3. Social media accounts post daily screenshots of large, unverifiable payouts using blurred wallet IDs and non-standard time stamps.
4. Influencers promote the platform without disclosing paid partnerships, often using identical scripted language across multiple channels.
5. Pop-up notifications on the exchange site urge immediate action: “Limited slots left! Deposit before midnight to lock rate!”

Technical Infrastructure Flaws

1. SSL certificate errors persist during login or fund transfer steps, with browsers flagging mixed-content warnings.

2. API documentation contains outdated endpoints or references deprecated protocols like HTTP instead of HTTPS.
3. Two-factor authentication supports only SMS-based codes, with no option for authenticator apps or hardware keys.
4. Order book depth shows abnormal clustering—large bid/ask walls at round numbers with zero real-time trade execution behind them.
5. Mobile app versions on Google Play or Apple App Store lack digital signature verification and show mismatched developer names versus the website’s copyright notice.

Customer Support Evasion Patterns

1. Live chat connects only to automated bots that cycle through generic responses unrelated to the query.

2. Email support replies arrive from free domains like @gmail.com or @yahoo.com instead of corporate email addresses.
3. Ticket response times exceed five business days, and follow-ups receive templated acknowledgments without resolution paths.
4. Support agents refuse to escalate issues involving frozen assets or missing transactions, citing “system maintenance” indefinitely.
5. Phone numbers listed on contact pages route to voicemail-only lines with no callback option or published operating hours.

Frequently Asked Questions

Q: Can I trust an exchange just because it has a high trading volume?A: No. Volume can be inflated through wash trading—repeatedly buying and selling the same asset between controlled accounts. Cross-check volume rankings against independent analytics platforms like CoinGecko’s Trust Score or CryptoRank’s liquidity heatmaps.

Q: Is it safe if an exchange offers insurance for user funds?A: Not necessarily. Many platforms advertise “up to $X million insured” without naming the insurer or specifying coverage exclusions. Verify whether the policy covers hot wallet breaches, smart contract exploits, or only custodial negligence—and confirm its validity through the insurer’s public registry.

Q: What does it mean if an exchange uses a multisig wallet for withdrawals?A: Multisig is a security feature—but only if key holders are publicly identified, geographically distributed, and subject to independent oversight. Anonymous signers or single-entity control over all required signatures render multisig meaningless.

Q: Why do some exchanges require KYC but still allow anonymous deposits?A: This inconsistency suggests weak compliance enforcement. Legitimate platforms enforce KYC before enabling any deposit method—including P2P or crypto transfers. Allowing unrestricted inbound transactions while gating withdrawals violates FATF Recommendation 16 and signals regulatory arbitrage.