Use this checklist to evaluate any crypto opportunity, message, or platform. If you check “yes” for any red flag, stop and walk away.
The Golden Rules
- If someone contacts you first about crypto, it’s a scam — 99% of the time
- If it sounds too good to be true, it is — Guaranteed returns don’t exist
- There are no free airdrops that need your wallet connection — Never “verify” by signing
- No legitimate support agent asks for your password, 2FA, or seed phrase
- If you’re being pressured to act fast, it’s a scam — Scammers create urgency
Platform Red Flags
| Check | Red Flag |
|---|---|
| URL | Domain slightly misspelled (co1nbase.com) or registered last week |
| Team | Anonymous, stock photos, or no verifiable history |
| Audit | No audit or audit by unknown firm |
| Whitepaper | Buzzwords, no substance, or copied from other projects |
| Social media | New account, bots, or disabled comments |
| Company registration | Can’t find on business registry |
Investment Red Flags
| Check | Red Flag |
|---|---|
| Returns | ”Guaranteed” profits, daily returns %, 100x promises |
| Lockup | Can’t withdraw for months without massive penalty |
| Referrals | Paid for recruiting others (pyramid structure) |
| Sales tactics | Countdown timers, “limited slots,” pressure to deposit more |
| Platform | Not on CoinMarketCap’s top 100 exchanges |
Communication Red Flags
| Check | Red Flag |
|---|---|
| Channel | DM on Telegram, WhatsApp, Instagram, or Twitter |
| Identity | Won’t do video call, uses stolen photos |
| Speed | Wants to move fast, too busy for verification |
| Requests | Asks for crypto, wallet connection, or personal info |
| Verification | Wants you to “verify” by sending crypto or signing |
Personal Security Checklist
- Hardware wallet for >$1,000 holdings
- 2FA with authenticator app (not SMS)
- Unique passwords for every account (use a password manager)
- Seed phrase stored offline (paper, fireproof safe)
- Email account secured with its own 2FA
- Wallet address book with whitelisted addresses only
- Burner wallet for DeFi and NFT interactions
- Wallet approval checker (Revoke.cash) checked monthly
- Crypto-specific email not used for social media
- Test transactions with $1 before large amounts
Transaction Safety Checklist
Before every transaction:
- Is the receiving address exactly right? (check first 4 and last 4 characters)
- Is the network correct? (Ethereum, Solana, Polygon — match the receiver)
- Is the amount correct? (double-check decimals)
- Did I send a test transaction first?
- Do I understand what I’m signing? (MetaMask warnings in RED)
What to Do If You’re Scammed
- Stop communication — Don’t pay more fees, don’t engage
- Move remaining funds to a new wallet
- Report the scam — Exchange, blockchain explorer, local police, IC3
- Revoke all approvals — Revoke.cash
- Warn others — Post on BitcoinTalk, Reddit, Twitter
- Accept the loss — Recovery is rare; focus on prevention next time
The 24-Hour Rule
Before any crypto decision, wait 24 hours. Sleep on it. Talk to someone about it. If it’s still a good idea tomorrow, proceed. Scammers rely on urgency and FOMO. The 24-hour rule kills both.
Verdict
Print this checklist. Share it with every friend new to crypto. The most expensive crypto lesson is learned after losing money. The cheapest is learned by reading this list.
Related: How to Spot a Crypto Scam Complete Guide | How to Create a Strong Security Plan | Common Phishing Attacks
What matters most
Most crypto scams share a handful of ingredients, and once you can name them you can reject nearly every scheme you meet. Unsolicited contact is the first tell: nobody who genuinely holds value contacts strangers out of nowhere to offer them returns. Guarantees and urgency are the second — real markets never guarantee profits, and scammers manufacture deadlines precisely so you do not think. And requests for your private information — a password, a 2FA code, a seed phrase, a wallet connection to “verify” an airdrop — are the third, because no legitimate service ever needs any of those from you. A checklist is really a way of making these instincts routine: when anything conflicts with them, you stop, wait, and verify on your own terms instead of theirs.
What to avoid
The habits that undo people most often are small and silent. Do not reuse passwords across accounts — a single credential leak then hands attackers your exchange, email, and wallet together, so use a password manager and unique passwords everywhere. Do not rely on SMS two-factor authentication if you can help it, because SIM swapping makes it weak, and secure your crypto-specific email with its own 2FA since it is the reset key to everything else. Do not approve wallet transactions you do not fully understand — a “free” signature can grant an attacker the right to drain your assets, and MetaMask’s red warnings are there for a reason. And when handling DeFi or NFTs, do not risk your main holdings: use a burner wallet and check approvals monthly with a tool like Revoke.cash so old, lingering permissions cannot be abused later.
Common questions
Q: Do I really need a hardware wallet for small amounts? A: Not necessarily. Many beginners keep modest amounts on a reputable exchange with strong security, including an authenticator app. As a guideline, move holdings above roughly $1,000 to a hardware wallet that holds your keys offline. The threshold is yours to choose, but the principle is clear: the more you hold, the more the offline protection matters.
Q: Why is there such a focus on test transactions and address checks? A: Because a single wrong address, wrong network, or wrong amount on a blockchain is permanent and unrecoverable. Sending a small test transaction first, verifying the receiving address by its first and last four characters, and confirming the network matches (Ethereum, Solana, Polygon, and so on) prevent the most common and most irreversible self-inflicted losses.
Q: What is the 24-hour rule and why does it work? A: Wait a full day before acting on any crypto decision, sleep on it, and talk it through with someone you trust. Scams depend on urgency and FOMO — the countdown timers, the limited slots, the pressure to deposit more. Giving yourself 24 hours removes that manufactured pressure, and a genuinely good opportunity will still be there tomorrow, while a scam will not survive the delay.
Q: Should I post about being scammed publicly? A: It can help other people avoid the same trap, and many victims find warning the community on BitcoinTalk, Reddit, or Twitter to be a useful step. Just do it after you have secured your accounts and reported to the authorities, and never engage with the ‘recovery agents’ who invariably contact scam victims afterwards promising to get money back for a fee — those are a second scam.
Making the checklist a habit
A one-page checklist is only valuable if you actually run it before decisions, so build it into your routine rather than reaching for it after something goes wrong. Keep it saved or printed where you do your research, and run through the platform, investment, and communication red-flag lists before you register anywhere, deposit anything, or reply to anyone. Pair that with your personal security habits — hardware wallet for large sums, authenticator-app 2FA, unique passwords, offline seed phrase, and a burner wallet for risky interactions. The most expensive lesson in crypto is the one learned by losing money; the cheapest is the one learned by reading and following a list like this before you ever send a coin. Print it, share it with every friend new to crypto, and let the 24-hour rule do its work.