Security: Scams, Phishing and Rug Pulls

What you will learn

• The most common crypto scam patterns
• Why "guaranteed returns" are a red flag
• How to check providers and protect accounts
• What to do if you have been targeted

Explanation

Because crypto payments cannot be reversed, scammers like them. Learn the main patterns:

• Phishing: fake emails, text messages or websites that copy a real provider to steal logins or seed phrases. Fake ads in search engines are common.
• Fake support: after you post a question online, "support agents" contact you privately. Real support does not message you first and never asks for your seed phrase or remote access to your computer.
• "Guaranteed returns" and investment platforms: websites or "coaches" show growing balances, often after a contact on social media or a dating app. Withdrawals then need "taxes" or "fees" first. The money is already gone.
• Giveaway scams: "Send 1 BTC, get 2 back", often with fake celebrity videos.
• Rug pulls: the creators of a new token collect investors' money and then withdraw liquidity or sell their large holdings, leaving the token almost worthless.
• Address swapping: malware changes a copied address, or attackers send tiny amounts from look-alike addresses so you copy the wrong one from your history.

Protection habits:

• Type the provider's web address yourself or use a saved bookmark; do not click links in messages.
• Use a unique, long password and two-factor authentication (2FA) with an authenticator app or security key rather than SMS.
• Check the full receiving address on the device screen before sending. Send a small test amount first.
• Check MiCA authorisation in the ESMA register. BaFin publishes warnings about unauthorised firms.
• Take time. Pressure ("only today", "your account will be closed") is a scam tool.

If you are targeted: stop paying, do not pay "recovery services" (often a second scam), save all evidence, contact your provider and report to the police.

Worked example

Hypothetical example: testing a "guaranteed 2% per day" offer with arithmetic.

Assumptions: you invest €1,000; the promised return of 2% per day is added every day for 365 days.

1. Growth factor per day: 1.02.
2. Growth factor per year: 1.02^365 ≈ 1,377.
3. Promised value after one year: €1,000 × 1,377 ≈ €1,377,000.

No legitimate investment can promise to turn €1,000 into over €1.3 million in a year, and real investments cannot guarantee any return. The calculation shows that the offer is impossible. Typical end of such schemes: the balance shown on screen is fake, and withdrawal is blocked.

Common mistake

Practice activity

Read the following message and list every warning sign: "Hello from Support! Your wallet shows unusual activity. To avoid permanent closure within 2 hours, verify your 24-word recovery phrase at our secure portal. As a thank you, you will receive a bonus of 5% guaranteed."

Limitations: real scams change constantly; new forms may not match these patterns.

Key takeaways

• Crypto payments cannot be reversed, which makes scams attractive.
• Guaranteed returns, urgency and requests for seed phrases are red flags.
• Use bookmarks, strong 2FA, address checks and test transactions.
• Never pay to unlock a withdrawal or to recover stolen funds.

Next step

In the next lesson, you will get a general orientation on how crypto gains are taxed in Germany.