Your slice of crypto.

Avoiding Crypto Scams and Staying Safe

Owen Calder
Published

Updated

Illustration: a perfect-looking slice of pie dangling from a fishing line and hook, with a magnifying glass showing the hook up close.

Last checked: 10 October 2026

About this guide

This is general information about crypto scams in Australia. It isn’t financial, legal or personal advice. Official steps and contact details change, so follow the linked official pages for the latest version.

If this is happening now

  • Stop sending money or crypto. Scammers keep asking for more until you stop.
  • Stop replying, clicking links or approving anything in your wallet.
  • Contact your bank, and the genuine crypto platform you used, with contact details you’ve found yourself.
  • Be wary of anyone who offers to get your money back.

Then work through If it has already happened.

Many crypto scams follow familiar patterns. This guide covers how the common ones work, what to check before you send anything, and what to do if it has already happened.

Why scammers ask for crypto

Scamwatch says scammers use crypto investments because they’re hard to track, and that money lost to a crypto scam is unlikely ever to come back.

In 2025, the payment category with the highest losses in reports to Scamwatch was “cryptocurrency and digital currency exchange”: $121.3 million, or 36.2% of all losses reported to Scamwatch that year. The category covers crypto payments and bank transfers to digital currency exchanges (crypto platforms). Scamwatch is one of several places scams are reported, so this isn’t a national total.

Scams you’re most likely to meet

Fake trading platforms and apps

A website or app shows your investment growing, but the numbers are made up. Some let you make small withdrawals early to win your trust. Then you’re locked out, and the site disappears with your money. Scammers build fake trading apps that work the same way.

Celebrity “endorsements” and deepfakes

Ads and fake news stories use well-known people’s names and faces without permission, sometimes in convincing AI-generated “deepfake” videos. They usually link to scam investment or trading websites, often involving crypto.

Romance baiting

Someone you’ve met online moves the conversation to a more private app, such as WhatsApp, LINE or WeChat. They encourage you to invest a small amount, which may show a quick return, and then push you to invest larger amounts.

Being told to pay in crypto

An online partner, job recruiter or business asks to be paid in crypto only, sometimes by buying it at a crypto ATM. Other versions include “giveaways” that promise to multiply any crypto you send, blackmail threats, and callers claiming to be government or police officials who say your crypto has been frozen.

Copies of real crypto platforms, and fake support

Scammers copy genuine crypto platforms (often called exchanges) to collect your login and personal details. Others pose as support staff. Genuine support staff won’t ask for your seed phrase.

Recovery scams

After a scam, people may contact you offering to get your money back. This is often a second scam. The warning signs are below.

Scams that target your wallet

If you keep crypto in a wallet you control yourself (self-custody), some scams go after the wallet directly. What Is a Crypto Wallet? explains how that differs from leaving crypto with a platform.

Your seed phrase. A seed phrase (also called a recovery phrase) can recreate the keys for the accounts created from it, so anyone who has it can take what those accounts hold. Never share it with anyone, including someone who says they’re from support, and never type it into a website or form someone has sent you. The only time to enter it is when you’re restoring your own wallet yourself, using that wallet’s official app or device. Keys can be exposed in other ways too, such as a photo of a seed phrase that syncs to cloud storage. Understanding Private Keys & Seed Phrases explains how they work.

Tokens you didn’t ask for. A token can turn up in your wallet that appears to be worth a lot. Its arrival doesn’t give anyone your keys. The risk starts when you try to sell or “claim” it: the website you’re sent to may ask you to approve a request, send crypto or enter your seed phrase. Moneysmart’s advice is to be careful before interacting with any token you didn’t trade.

Spending permissions (Ethereum tokens). Some wallet requests don’t send anything at the time. Instead, they give an app or address permission to spend one of your tokens later, sometimes with no limit on the amount. Some are only a signature, which someone can then use to give themselves that permission. For standard Ethereum tokens (known as ERC-20 tokens), a spending permission doesn’t expire on its own.

Moneysmart says not to sign a request you can’t read. Being able to read one doesn’t make it safe, though. Check who is getting permission and what it lets them do. If you’re unsure, don’t sign.

This describes standard ERC-20 token permissions on Ethereum. Other kinds of request, and other networks, work differently.

What a hardware wallet does

It keeps your private keys on a separate device that isn’t connected to the internet, which makes them harder for hackers to reach, even if your computer is compromised.

What it doesn’t protect you from

Anyone who gets your seed phrase can reach the accounts it controls without the device. And it can’t stop a loss from a harmful payment or permission that you approve on it.

Warning signs

  • Contact you didn’t ask for about an investment.
  • Pressure to act quickly.
  • Promises of guaranteed returns.
  • A request to pay only in crypto, or to buy crypto at a crypto ATM and send it on.
  • An investment tip from a social media ad, a celebrity, an influencer, an online romantic partner, or a friend who may have been scammed themselves.
  • An “adviser” who says they don’t need an Australian financial services (AFS) licence.
  • Anyone asking for your seed phrase, or for remote access to your computer or phone.

Checks before you send anything

Scamwatch’s three steps are a good habit. Stop: take a moment before giving anyone money or personal information. Check: make sure the person or organisation is real. Protect: act quickly if something feels wrong.

1. Is it really the business it claims to be? Find the website or app yourself rather than using a link you were sent, and check the web address carefully. Contact the business using phone numbers or email addresses from its official website or app. A new website for a business that has been around for years is a warning sign.

2. Is the crypto platform registered with AUSTRAC? AUSTRAC says it’s illegal to provide virtual asset services in Australia without being registered with it. Search AUSTRAC’s register of virtual asset service providers. Registrations can be suspended, cancelled or not renewed, so check the current status.

3. If someone says they’re licensed, check the licence. If a person or business offering investment advice or products says it holds an AFS licence, look up the licence holder’s name and number on ASIC’s professional registers. Make sure they match the business you’re dealing with: a licence number on its own doesn’t prove you’re dealing with the licensee. Many crypto platforms aren’t licensed by ASIC at present, so this check is for when a licence is claimed.

4. Check the warning lists. Search Moneysmart’s investor alert list and the IOSCO investor alerts portal. Moneysmart is clear that a name missing from its list doesn’t mean you can trust it.

These don’t prove a business is genuine

  • A polished website, familiar branding or convincing testimonials.
  • Finding it in a quick online search.
  • A wallet request you can read. It can still hand over permission to spend your tokens.
  • Being able to make a small withdrawal. Scammers allow small withdrawals to build trust.

What these checks do

They tell you whether a business is registered with AUSTRAC, whether a licence someone claims is on ASIC’s register, and whether ASIC has flagged a name.

What they don’t protect you from

A fake website, app or caller using a real business’s name; scams that aren’t on any list yet; or losses if a platform fails or is hacked. Moneysmart notes that many crypto providers aren’t licensed, so you may not be protected if that happens.

If it has already happened

Start with the first step, then follow whichever situations apply to you.

First: stop further losses

  • Don’t send any more money or crypto.
  • Stop replying, and don’t click, approve or sign anything else from the scammer. Save the messages (see Keep a record), then block them.
  • When you contact your bank, crypto platform or anyone else, use contact details you’ve found yourself. For your bank, use the number in your banking app or on your card.

If you sent money or crypto

  • Contact your bank or card provider straight away and ask them to stop the transactions.
  • If crypto was involved, contact the genuine crypto platform you used to buy or send it, not the website or app you were investing through. Moneysmart says the platform may be able to help stop transactions.
  • If you’re unhappy with your bank’s response, complain to the bank first, then to the Australian Financial Complaints Authority (AFCA).

If a device may be compromised

This applies if you gave someone remote access to your computer or phone, or installed something they sent.

  • Disconnect the device from the internet.
  • Delete any remote access software and scan for malware. Scammers sometimes leave a “back door” so they can get in again.
  • Change your passwords from a separate device you trust, not the one that may be compromised.
  • If you’re not sure the device is clean, have an IT professional check it.
  • For expert advice, call the Australian Cyber Security Hotline on 1300 292 371, 24/7, or see the Australian Cyber Security Centre’s hacking guide.

If an account may be compromised

This applies if you gave someone a password or login code, or a service warns you about a login you didn’t make.

  • Contact the service, such as your bank or crypto platform, using contact details you found yourself.
  • On a device you trust, sign out of all devices and set a new password you haven’t used before. If you used the old password anywhere else, change it there too.
  • Turn on multi-factor authentication.

If you gave identity information

This applies to ID documents and personal or account details.

  • Tell your bank, super fund and other financial services.
  • Contact IDCARE on 1800 595 160. It’s Australia’s national identity and cyber support service, and can help you make a free plan to limit the damage.
  • Ask for a ban on your credit report. During a ban, credit reporting bodies generally can’t use or disclose your report; the exceptions include when you’ve given written consent or the law requires it. A ban is free, lasts 21 days and can be extended. The OAIC recommends asking all three credit reporting bodies (Equifax, Experian and Illion). You can also ask one of them to pass your request on to the other two. The OAIC explains how.
  • Get a free copy of your credit report and check for loans or credit applications you don’t recognise.

If your own wallet may be compromised

This applies if you revealed your seed phrase or a private key, or approved or signed something from a scam site.

  • Stop using the website, token or contact involved.
  • If you revealed your seed phrase, assume every account created from it is exposed. If you revealed a private key, assume the account it controls is exposed.
  • For standard Ethereum tokens, a spending permission you approved stays in place until it’s used up, changed or removed. Removing it stops future use, but it doesn’t bring back anything already taken. A transfer that has already gone through can’t be reversed.
  • Get help from IDCARE before acting on instructions from anyone who contacts you, and report what happened.

Keep a record

Save screenshots, emails and chat logs before they’re removed, and store them somewhere secure. Note the dates, amounts and bank transaction details. For crypto, also note the transaction IDs, wallet addresses and website addresses involved. Include as much detail as you can when you report.

Report it

  • Scamwatch: report every scam. The National Anti-Scam Centre uses reports to monitor trends and warn people about new scams. With your consent, it can also work with organisations to remove scam websites, ads and contact details.
  • ReportCyber: make a police report here if someone stole your money or personal information, tried to extort you, or it was a crypto scam. ReportCyber is the Australian Government’s cybercrime reporting tool, and relevant reports are assigned to police and other law enforcement agencies for investigation. It can’t recover lost money.
  • IDCARE: not a reporting service. It gives free support and a plan for your situation.

Watch for recovery scams

Scammers often go after people who have already been scammed. Be wary if someone:

  • contacts you, or advertises, offering to get your money back;
  • asks for a fee upfront (sometimes called a “tax”, “deposit” or “retainer”), a percentage of what they recover, or travel costs to “find the scammer”;
  • promises they can recover your losses or track down your crypto;
  • says they’re from the police, a government agency, a law firm or a fund recovery service;
  • asks for ID documents, remote access to your device, or for you to set up a crypto wallet.

The National Anti-Scam Centre says that even when investigators can trace stolen funds, the money is almost never returned to the victim.

Get support

If the scam has left you in debt, a free and confidential financial counsellor can help. For emotional support, Lifeline (13 11 14) and Beyond Blue (1300 22 4636) are available 24/7.

Related reading

Sources

Checked 10 October 2026.

Previous article:
Next article: