Fake Crypto Support Scams: Why Real Help Never DMs First

Post "my swap is stuck" in a big crypto Telegram group or under a wallet's X post, and watch what happens. Helpful accounts show up fast, usually in your DMs, usually with a support badge in the profile picture and a link to "verify your wallet." That's not help. That's the opening move of one of the oldest plays in the trenches.

Fake crypto support scams don't need a clever exploit. They need you stressed, a believable logo and a link. This is how the script usually runs, what real support actually does (and never does), and the second wave that targets people who already lost money. Everything here comes from Phantom's own help center, the FTC and the FBI, so you can check me.

Why does "support" find you so fast?

Because you told the whole room you have a problem. Phantom's help article "Phantom will never DM, email, or ask you to send funds" describes the pattern plainly: scammers create accounts impersonating Phantom Support staff and send direct messages asking you to verify your wallet through a link, and those links lead to phishing sites built to steal your recovery phrase.

Phantom's guide to common crypto scams adds that the impersonation isn't limited to companies. Scammers pose as members of a community, a crypto company, or even your friend group, and offer help in exchange for money or sensitive information. A public complaint is a flare: stressed person, wants a quick fix, probably has funds. Victims announce themselves.

What the fake support script looks like

The wording changes, but the asks come from a short list. Phantom's help center documents each of these:

• "Verify your wallet." A link to a site that wants you to connect your wallet or type your recovery phrase. Phantom lists lookalike domains such as "phantom-support.io" and "phantom-wallet.com" as examples of the kind of URL to expect.
• "Your wallet was flagged." An alarming message, sometimes an email with a subject like "Phantom Wallet Alert—Action Required," claiming your wallet is at risk and asking you to move assets to a "verified address" for safekeeping. The verified address is theirs.
• "Import this phrase." Someone hands you a recovery phrase, maybe for a "fixed" wallet. Phantom's security tips are blunt: a wallet set up this way is controlled by the person who gave you the phrase. Anything you send there, they can take.
• "Claim your bonus." A reward, airdrop or refund that needs a small payment upfront to "verify eligibility" or "cover fees." You pay, and nothing comes back.

Every option ends with you handing over your recovery phrase, a signature or the funds themselves. In a self-custody wallet, that's all anyone could want from you, which is exactly why real support never asks.

What real support actually does

Know how the real thing works and the fake one stands out. Phantom's rules are about as clear as they get:

• They don't contact you first. Phantom's security tips say it will never contact you first, and its support will never message you on Discord, X, Telegram or other chat apps.
• They don't run a Discord. Phantom says it doesn't have a Discord server, and any Discord claiming to be official Phantom Support is a scam.
• Email only follows a ticket. Phantom only emails users who submitted a support ticket, and marketing comes from verified domains it names.
• You go to them. Phantom's scam guide points you to Settings > Help & Support inside the wallet to start a chat.

The FTC's rule works outside crypto too. In its 2022 crypto scam data spotlight, it puts it this way: nobody legit will require you to buy cryptocurrency, not to sort out a problem and not to protect your money. If a "support agent" wants crypto to fix your crypto, you've already got your answer.

The second wave: recovery scams

This is the part that makes me angriest, because it targets people who are already hurt. After a loss, a new kind of "help" shows up: a firm, a lawyer or a "blockchain investigator" promising to get your funds back.

The FBI has warned about this twice. Its June 2024 public service announcement describes fraudsters posing as lawyers from fictitious law firms who contact scam victims over social media or messaging apps, claim to be working with the FBI or another agency, and then ask for identity or banking details, upfront fees, or payments for "back taxes." According to the FBI's Internet Crime Complaint Center, victims further exploited this way reported over $9.9 million in losses between February 2023 and February 2024. The FBI also notes that law enforcement doesn't charge victims a fee to investigate crimes.

The August 2025 update adds red flags worth knowing: references to made-up regulators like the "International Financial Trading Commission," claims that you're on a government list of scam victims, being pulled into a WhatsApp group chat with supposed bank processors, payment requests in crypto or gift cards, and scammers who know the exact amounts and dates of your earlier transfers.

That last one hits different on Solana. Your transactions are public. Anyone who reads an explorer can quote your losses back to you, so knowing the details proves nothing about who they are. Phantom's drained-wallet article is also clear that the wallet itself cannot reverse transactions, freeze assets or recover stolen funds. When someone promises they can, treat it as a second scam until it's proven otherwise.

How to handle a support DM in the trenches

• Close the door first. Phantom recommends disabling direct messages from strangers on Discord and similar platforms.
• You go to support, support never comes to you. Type the official site yourself or use the help option inside the app. Never use a link from a DM, reply or ad, however official the profile looks.
• The phrase is never the fix. No real fix requires your recovery phrase, ever. If a "fix" needs it, the person asking is the problem.
• "Move it somewhere safe" means "send it to me." Only move funds to a wallet you created yourself, from a phrase you generated yourself.
• Upfront fees for recovery are a red flag. Report losses to the FBI's IC3 if you're in the US, and treat anyone who reaches out first with a recovery offer as a suspect, not a savior.

The same rule applies around here. If an account claiming to be DarkGeneral DMs you about a TradeVault or Wallet Forensics license, don't work it out in the DM. Go to the DarkGeneral contact page yourself, typed into your browser.

What this doesn't cover

I'm leaning on Phantom's published rules because they're specific and current, but every wallet and exchange has its own official channels, and you should check that platform's own help center for its list. I haven't tested any support desk or recovery service, and I'm not rating one platform against another. Fake sites are their own case file, covered in my guide on how to check if a crypto website is a scam, and the signature traps those sites use are in Solana wallet drainers and what simulation warnings miss.

The takeaway

Real support doesn't find you. You find it, through the official app or a site you typed yourself, and it never needs your recovery phrase, a signature or a "verification" payment. Fake crypto support scams only work in the gap between your problem and your patience, so slow down right when you feel the most pressure. If you got hit once, be twice as careful with anyone offering to get it back. Has a "support" account ever slid into your DMs within minutes of you posting a problem?

More case files: how Solana address poisoning works, crypto tools that promise too much, and the live crypto news page for fresh scam warnings.

Still building. Still here. 🫡