What Is a Fake Crypto Exchange Scam? How to Avoid It

A fake crypto exchange scam is when criminals build a website that closely mimics a real, well-known exchange's design, logo, and domain name, then trick users into creating accounts and depositing funds that the scammers simply keep. Unlike a hack of a real exchange, there is no legitimate platform behind the scam at all — deposits go straight into wallets the scammers control, and any "trading balance" shown on the fake site is just numbers on a page with no real assets backing them.

How clone exchange scams work

The typical pattern starts with a domain that looks almost identical to a real exchange — a swapped letter, an extra hyphen, or a different top-level domain (.io instead of .com, for example). Scammers copy the real site's HTML, CSS, and logos, sometimes near pixel-perfect, and distribute the link through:

• Paid search ads that outrank the real exchange for its own brand name.
• Phishing emails or texts claiming account issues, security alerts, or bonus offers.
• Fake social media accounts impersonating the exchange or its support team.
• Malicious browser extensions that redirect exchange URLs to a clone.

Once a victim "logs in" or "signs up," they're prompted to deposit crypto to start trading. The deposit address shown belongs to the scammer, not the real exchange. The fake site's dashboard then displays a fabricated balance, sometimes showing fake gains to encourage larger deposits, a pattern that overlaps with pig butchering-style investment fraud. When the victim tries to withdraw, the site invents a reason for delay — a "verification fee," a minimum withdrawal threshold, or a frozen account requiring a payment to unlock.

Why these scams are effective

Clone exchanges succeed because they exploit brand trust rather than technical vulnerabilities. A user who already trusts a real exchange's name is primed to trust anything that looks like it, especially under time pressure created by fake security alerts ("your account will be suspended in 24 hours"). The scam doesn't need to break any cryptography or smart contract — it just needs to look convincing enough for a few minutes.

Real exchange vs fake clone: key differences

Signal	Legitimate exchange	Fake clone
Domain	Matches the official, bookmarked URL exactly	Slightly altered spelling or TLD
SSL certificate details	Issued to the real company name	Often generic or mismatched
Withdrawal behavior	Processes normally, subject to standard limits	Invents fees or blocks to delay/deny withdrawal
Support contact	Verifiable official channels, no unsolicited DMs	Cold-contacts users, pushes urgency
Deposit address	Matches addresses shown in the real app/exchange history	Unverifiable, often reused across victims

How to avoid fake exchange scams

• Always navigate by bookmark or typed URL, never by clicking links in emails, texts, or social media ads, even ones that appear in search results above the real listing.
• Check the domain character by character before entering credentials or depositing funds — look for homoglyphs, extra characters, or unfamiliar extensions.
• Verify through official channels if you receive an unexpected message about your account; go to the exchange's known app or website directly rather than clicking through.
• Enable and check for anti-phishing codes, a feature many real exchanges offer that stamps a custom code into all genuine emails — see our guide on what an anti-phishing code is for setup details.
• Be suspicious of any offer requiring an upfront payment to "unlock" a withdrawal or balance; legitimate exchanges never charge a fee to release your own funds.
• Use a password manager, which will simply fail to autofill credentials on a clone domain that doesn't match the saved legitimate URL, acting as an automatic tripwire.

What to do if you've already deposited into a fake exchange

Act immediately: stop all further deposits, do not pay any requested "unlock fee" (this never results in fund release and only feeds the scam further), and document everything — the domain, wallet addresses, transaction hashes, and any communications. Report the domain to the real exchange being impersonated (most have dedicated abuse-report channels) and to relevant cybercrime authorities. Recovering funds sent to a scammer's wallet is rare once transferred, since blockchain transactions are irreversible, which is exactly why prevention matters far more than after-the-fact response here.

Bottom line

Fake exchange scams rely entirely on convincing you a cloned website is the real thing, then keeping whatever you deposit. Protect yourself by only accessing exchanges through bookmarked or manually typed URLs, checking domains carefully, using anti-phishing codes where offered, and treating any request for an upfront fee to unlock a withdrawal as an instant red flag. For broader protection against related fraud patterns, see our guides on how to verify a crypto exchange is legitimate and common DeFi scams.