Phishing emails are the most common way crypto is stolen. They look legitimate, create urgency, and trick you into revealing your credentials.
Anatomy of a Phishing Email
| Element | Legitimate Email | Phishing Email |
|---|---|---|
| Sender address | official@exchange.com | officiaI@exchange.com (spoofed) |
| Greeting | Dear [Your Name] | Dear Customer |
| Urgency | None | ”Action required within 24 hours” |
| Link | exchange.com/security | exchange-secure.com |
| Spelling | Professional | Minor errors or odd phrasing |
Common Crypto Phishing Themes
| Theme | Example |
|---|---|
| Account suspension | ”Your account will be suspended. Verify now.” |
| Unauthorised login | ”New login detected from Russia. Click to secure.” |
| Withdrawal pending | ”Your withdrawal is pending. Confirm to process.” |
| Wallet update | ”Update your wallet to continue using our service.” |
| Token airdrop | ”Claim your free tokens. Limited time.” |
| Security upgrade | ”We’ve upgraded our security. Re-verify your account.” |
How to Check a Link
Before clicking, hover over the link.
| Displayed Text | Actual Link | Verdict |
|---|---|---|
| binance.com/security | binance.com/security | Safe |
| binance.com/security | binance-secure.com | Phishing |
| Sign in to your account | http://192.168.1.1/login | Phishing |
| Claim airdrop | http://claim-uni.io | Phishing |
| metamask.io/unlock | metamask.io/unlock | Safe |
| metamask.io/unlock | metamask-extension.com | Phishing |
Red Flags
| Red Flag | Why It’s Suspicious |
|---|---|
| Generic greeting (“Dear customer”) | Real services use your name |
| Threats or urgency | Designed to bypass your judgement |
| Unexpected attachment | Never open attachments from crypto services |
| Requests for password | No legitimate service asks for your password |
| Requests for seed phrase | NEVER share your seed phrase |
| Mismatched sender name | ”Coinbase” from “support@gmail.com” |
| Grammar errors | Professional companies proofread their emails |
The “From” Address Trick
Scammers spoof the “From” address to look legitimate.
| Looks Like | Is Actually |
|---|---|
| support@coinbase.com (in display) | support@coinbase-secure.com (in header) |
| no-reply@binance.com | no-reply@binance-support.info |
| help@metamask.io | help@metamask-wallet.com |
Check the full email header if you’re suspicious.
What Legitimate Companies Will Never Do
| Legitimate companies will NEVER |
|---|
| Ask for your password in an email |
| Ask for your seed phrase or private key |
| Ask you to “verify” by sending crypto |
| Send you a link to download their app |
| Ask you to connect your wallet to a website they link |
What to Do If You Receive a Phishing Email
| Step | Action |
|---|---|
| 1 | Don’t click any links |
| 2 | Don’t open attachments |
| 3 | Mark as spam/phishing in your email client |
| 4 | Forward to the company’s security team (report@company.com) |
| 5 | Delete the email |
What to Do If You Clicked
| Step | Action |
|---|---|
| 1 | Don’t enter any credentials |
| 2 | Close the page immediately |
| 3 | Change passwords on the real website (not from the link) |
| 4 | Enable or check 2FA |
| 5 | Check for unauthorised access |
| 6 | Monitor your accounts for suspicious activity |
Bottom Line
Phishing emails work by looking real and creating urgency. Always check the sender address, hover before clicking links, and remember: no legitimate service will ever ask for your password or seed phrase via email. When in doubt, type the website URL yourself instead of clicking the link.
The reasons these emails keep working
Phishing succeeds because it preys on the habits that make legitimate crypto use fast and convenient. You are juggling multiple tabs, an exchange notification lands in your inbox, and the urgency it manufactures — “action required within 24 hours” — is designed to bypass your judgement rather than pass it. The impersonation is the second half: by cloning a real template and mirroring the exact colours, wording, and logo of a service you trust, the attacker removes the visual cues that would otherwise raise suspicion.
The most damaging mistake victims make is to treat the email’s surface as proof. Almost everyone can learn to spot a badly-worded scam, so the modern version is written cleanly and reads exactly like a company’s genuine notice. That is why the checks in this article must become a fixed routine rather than a reaction to something looking off. Build the habit of hovering over every link before clicking, revealing the full sender header when anything feels unusual, and treating any request for a password, seed phrase, or private key as an automatic red flag regardless of how official the message looks.
There is also a quieter cost to falling for these emails that is easy to miss: even when you do not lose funds, a successful login on a cloned page gives the attacker your credentials and enough information to attempt a full account takeover. Treat the link check as non-negotiable. If you are ever unsure whether an email is real, do not use the link at all — open a fresh browser tab, type the exchange’s official address yourself, and sign in there. That single habit defeats the entire category of attack, because a cloned page has no value if you never reach it through the email.
Finally, remember that phishing is a numbers game. Attackers send thousands of near-identical messages and profit from the small fraction of recipients who click. Nothing about the message being addressed to you in particular means it is legitimate. Slowing down for the one minute it takes to verify the destination before acting is enough to make you an unprofitable target.