Crypto doesn’t just attract innovators—it attracts scammers. The good news: most scams rely on the same handful of tricks. If you learn to recognise those patterns and set up a few simple guardrails, you’ll avoid 95% of disasters.

This guide is plain-English and practical. You’ll get:

• A map of the most common scam types (and what they look like).
• Simple rules you can follow today to harden your wallets and habits.
• Copy-paste checklists, policies, and incident steps for individuals, teams, and businesses.

Digital One Agency designs and builds crypto systems with security by default—wallet architecture, approvals, allow-lists, pay/treasury policies, audited contracts, and global rails via Digital One Payments. If you want rails that resist scams and human error, we’ll engineer them end-to-end.

TL;DR — The 10 Rules That Block Most Scams

1. Never share your seed or recovery phrase with anyone, ever. No support agent needs it.
2. Don’t sign blind. Read what you’re approving; know the spender and the function.
3. Segregate wallets: “Spend” wallet for daily use; “Vault” (hardware) for savings; never connect your Vault to random sites.
4. Approve with limits (max needed, not unlimited). Revoke stale allowances monthly.
5. Claim airdrops with a fresh wallet, not your main holdings. If it requires your seed or a wallet import, it’s a scam.
6. Bookmark official sites. Never click claim/mint links from DMs, comments, or ads.
7. Use authenticator-app 2FA (not SMS). Add a SIM-swap/port-out PIN with your telco.
8. Extensions off, browser clean. Minimal add-ons; finance-only browser profile.
9. On-chain first sends small. Test with a tiny amount before size.
10. When in doubt, do nothing. Scams rely on urgency. Take five minutes and re-check.

The Scam Map: What They Look Like (And How They Work)

1) Phishing (email, DMs, sites, search ads)

The play: “Your account is at risk—verify now.” Link leads to a fake wallet/exchange page that steals credentials or tricks you into signing a malicious message.

What blocks it

• Ignore links from DMs/comments.
• Type URLs yourself or use bookmarks.
• Hardware wallet address verification before sending.
• Read signing prompts—if unreadable, don’t sign.

2) Approval drainers (“Sign this to continue”)

The play: Malicious site pops a wallet prompt asking you to grant spending of your tokens/NFTs. One click, and they can transfer assets later.

What blocks it

• Approve only what you need and to the contract you recognise.
• Use limited allowances; avoid “unlimited” by default.
• Revoke monthly (more below).
• Keep savings in a wallet that never approves unknown contracts.

3) Fake airdrops/mints

The play: You get a “you’re eligible” message or you see mystery tokens in your wallet. The claim site asks for suspicious approvals or your seed.

What blocks it

• Treat unsolicited airdrops as toxic.
• For legitimate claims, use a fresh wallet holding only gas.
• Never import seeds. Never pay to “unlock” an airdrop.
• Verify the official announcement from the project’s own channels (not a look-alike).

4) Rug pulls (liquidity disappears / admin yanks the code)

The play: Token launches, price runs, insiders or the owner drain liquidity or mint/sell into buyers. In NFTs, creators vanish after mint.

What blocks it

• Check for timelocks, renounced/controlled ownership with transparent policies, and sensible token allocations.
• Beware tiny float + huge FDV + near-term unlocks.
• Don’t chase “guaranteed APR” paid only in the same token.
• Size small; assume early-stage = experimental.

5) Fake support & remote-access scams

The play: Imposters message you first, offer help, then ask you to screen-share, install software, or reveal your seed.

What blocks it

• Support never asks for seeds or codes.
• No screen-sharing on finance devices.
• Close the chat; go to official support from the site you bookmarked.

6) SIM-swap & account takeovers

The play: Attacker ports your phone number; intercepts SMS codes to seize exchange/email accounts.

What blocks it

• Use authenticator-app 2FA only.
• Add a port-out PIN with your telco.
• Remove phone numbers from exchange security where possible.

7) Address poisoning & QR tricks

The play: Scammer sends dust or creates look-alike addresses so you copy the wrong one; malicious QR encodes a different address.

What blocks it

• Address book/allow-list your recipients.
• Verify the destination on your hardware wallet screen before approving.
• Don’t copy addresses from your transaction history; always from your own allow-list.

8) Ice-phishing (changing your approvals)

The play: You sign a legit-looking transaction that updates a trusted contract’s spender to the attacker.

What blocks it

• Read the spender in the prompt; if it’s not the protocol you expect, cancel.
• Use wallets that highlight approval changes clearly.
• Regularly revoke and re-approve when needed.

9) Fake apps & extensions

The play: Clone wallets/exchanges in app stores or browser extension libraries.

What blocks it

• Install from official links only; verify publisher.
• Keep extensions minimal; finance-only browser profile.
• Update from inside the app, not from pop-ups.

10) Romance, P2P escrow, and OTC scams

The play: Long “relationship” or private seller lures you off-platform to send funds first.

What blocks it

• No off-platform deals.
• Use reputable escrow with on-platform dispute resolution.
• For businesses, vendor changes require call-back verification to a known number.

Set-Up: A Safe Default That’s Easy To Live With

Wallet architecture (individuals & pros)

• Vault wallet (hardware): long-term holdings; never connect to random dApps; outgoing only to your own Spend wallet or a known exchange address.
• Spend wallet (hot or L2): daily use; small balances only; ready to rotate.
• Fresh Claim wallet: used for mints/airdrops; keep just enough gas.

Keys and approvals

• Hardware wallet for savings; two seed backups stored separately (consider metal).
• Address allow-lists in exchanges and in your policy engine.
• Per-tx/daily limits where supported.
• Monthly revoke routine: clear stale allowances (tokens & NFTs).

Browser & device hygiene

• Finance-only browser profile; bookmarks to official sites.
• Minimal extensions; auto-update enabled.
• No finance on shared or unmanaged devices.

2FA & accounts

• Authenticator-app 2FA everywhere (email, exchange, password manager).
• Telco port-out PIN; remove SMS-only factors.
• Unique strong passwords; password manager required.

Transaction Hygiene (Before You Click “Approve”)

1. Who is the spender? Must be the protocol’s contract—not a random address.
2. What is the function? approve(spender, amount) = fine if spender is correct and amount is limited. Avoid “unlimited” by default.
3. What asset? Check symbol/contract (avoid look-alikes).
4. Why now? Real apps work without pressure timers and scare banners.
5. Test small. Prove the flow with a tiny amount first.

If any of those are unclear, cancel.

Airdrops & Mints: Safe Claims Checklist

• Verify the official announcement and URL.
• Use a fresh wallet with only gas; move claimed assets later.
• No seed imports, no secret phrases, no remote desktop—ever.
• If the claim wants approvals for unrelated tokens/NFTs, walk away.
• Watch for signature requests that grant spending (not needed to “check eligibility”).

NFTs: Extra Gotchas

• Operator approvals (e.g., “allow marketplace to manage all your NFTs”)—keep these narrow, remove after use.
• Listing cancellations: use the marketplace’s official tool; don’t click “cancel” links in random DMs.
• Prefer platforms that support partial approvals or item-level permissions.

Business & Team Playbook (Treasury, Not Trading)

Policy (one page)

• Allowed assets, chains, venues.
• Maker/checker roles (initiator/approver/auditor).
• Per-tx and daily limits; emergency halts.
• Vendor change controls: call-back to a known number, not to a new email.
• Stablecoin policy (issuers, caps, rotation if peg deviates).

Custody

• MPC/multi-sig for treasury; separate hot (ops) vs cold (treasury).
• Address allow-lists for payouts and counterparties.
• Dual on/off-ramps behind feature flags.

Monitoring & data

• Dashboards for balances, approvals, bridge health, peg checks, and fee markets.
• Daily reconciliation with on-chain references; exception queues for anomalies.

Training

• Quarterly tabletop exercises (SIM-swap, bridge delay, fake vendor).
• Phishing drills; clear escalation path.

Digital One Agency ships these as living systems—policy engines, approvals, dashboards, alerts, and reconciliations your finance team trusts.

The 20-Second Scam Sniff Test

• Promise of risk-free high yield?
• Urgency or countdown timer?
• Asked to move off-platform or use a new site/app you’ve never seen?
• Requests for seed, screen-share, remote software, or pre-funding fees?
• Signing prompt is unreadable or mentions a random spender?

If you tick even one, step back.

Monthly Security Routine (Copy-Paste)

• Revoke stale approvals (tokens, NFTs).
• Export exchange and wallet CSVs; file them.
• Review allow-lists and limits.
• Update firmware/wallet/app; check backups.
• Practise a tiny restore (test seed on an offline device).

Incident Response (If Something Goes Wrong)

1. Stop the bleeding: disconnect wallet site; switch devices; kill browser extensions.
2. Move what’s left to your Vault or a fresh wallet (hardware-verified addresses only).
3. Revoke approvals for compromised contracts.
4. Alert venues: open a ticket with exchanges/marketplaces; provide tx IDs.
5. Record everything: timestamps, addresses, tx hashes, screenshots.
6. Rotate credentials: email, exchange, password manager; revoke API keys.
7. Announce internally (and to customers if relevant) with clear next steps.
8. Post-mortem: what failed (people, process, tech), and which guardrail will prevent a repeat.

Red Flags (Quick Reference)

• Tiny float, huge FDV, unlocks soon (price risk + insider dump risk).
• “Audit coming soon.” Not good enough.
• Admin keys with god-mode (mint/burn/upgrade) held by one person.
• Bridged tokens pretending to be native everywhere.
• Unclear ownership or no timelocks on upgrades and treasury.

30-Day Hardening Plan

Week 1 — Foundations

• Hardware wallet set up; two seed backups stored separately.
• Authenticator-app 2FA everywhere; telco port-out PIN.
• Finance-only browser profile with bookmarks.

Week 2 — Architecture

• Split Vault/Spend/Claim wallets; move savings to Vault.
• Address allow-lists; per-tx/daily limits where supported.

Week 3 — Habits

• Enable monthly approval revokes; schedule CSV exports.
• Run a tiny test: bridge or claim with a fresh wallet.

Week 4 — Drill

• Tabletop: phishing attempt + wrong address + funding spike.
• Patch weak points; document the incident plan.

Outcome: scams become annoying background noise, not existential threats.

How Digital One Agency Keeps You (And Your Team) Safe

• Consulting & architecture: wallet segmentation, approvals, allow-lists, policy engines, and incident playbooks.
• Design & development: human-centred crypto UX—clear signing prompts, safe approvals, refunds and receipts that tie to your ledger.
• Smart contracts: audited, upgradeable contracts with timelocks and limited admin powers.
• Digital One Payments: dual on/off-ramps, automated routing, and reconciliation feeds. Blockchain and Systems development, platforms, trading systems, Tokenization and more.
• Training & monitoring: phishing drills, dashboards, alerts, and quarterly tabletop exercises.
• Family Office & HNW Setups: We setup secure systems, cold wallets, hot wallets and train you and you’re team on security and keeping your investments safe and away!

If you want crypto rails that are hard to misuse and resilient to scams, we’ll build them—properly.

👉 Book a meeting: https://digitaloneagency.com.au/book-a-meeting/
📞 Call us globally 24/7: +61 2 9057 9079
📧 Email: contact@digitaloneagency.com.au