How to Identify a Fake Crypto Exchange

Key Takeaways

1. The clearest sign of a fake exchange is being asked to pay money to get your own money out. Real platforms deduct network and trading fees from your balance. They do not collect "unlock fees", "profit taxes" or "credit score deposits" before a withdrawal.
2. Verification starts with a regulator register, not with a website. A licence number that appears on a public government register is checkable in about two minutes. Everything on the platform's own website, including certificates and audit badges, can be copied or invented.
3. A convincing interface proves nothing. Fraudulent platforms are built to display fake balances and fake profits, and some have reached the official Apple and Google app stores. Judge the platform on its legal identity, its domain, and its withdrawal behaviour.

What counts as a fake crypto exchange

The phrase covers three different problems, and the risks are not the same.

Type 1: The invented platform. No real market exists behind it. Deposits go straight to the operator's wallet, and the balance you see is a number in a database. These platforms are typically introduced through a dating app or a messaging group.

Type 2: The clone or phishing site. A copy of a genuine exchange on a lookalike domain or inside a lookalike app, built to capture your login details, two-factor codes or wallet recovery phrase. The UK Financial Conduct Authority calls these "clone firms" and warns that they often reuse real company details so the information looks genuine.

Type 3: The real but unauthorised platform. The business exists and the trades may be real, but it operates without the registration its jurisdiction requires. Your funds are not necessarily stolen, but you usually have no ombudsman and limited legal recourse if the company fails.

Why this is worth ten minutes of your time

In its 2025 annual report, the FBI Internet Crime Complaint Center recorded 181,565 cryptocurrency-related complaints with reported losses above 11.3 billion US dollars, roughly 7.2 billion of it from crypto investment fraud. The average reported crypto loss was about 62,600 US dollars.

The infrastructure behind this is industrial. Under Operation Level Up, US authorities reported seizing 503 web domains built to look like legitimate crypto investment platforms. Seizure notices show the naming pattern: domains such as OKEX-NFT.net and NFT-UNI.com borrowed recognisable brand words to look credible.

Step 1: Check the regulator register before anything else

Every serious financial regulator publishes a searchable list of the firms it authorises. Search the platform's legal entity name, not its brand name, because large exchanges often register under a different company name and a brand search can return nothing even for a legitimate firm.

Two cautions. A register entry is a minimum bar, not an endorsement: UK crypto registration covers anti-money-laundering controls and says nothing about the firm's finances. And the FCA notes that a firm missing from its Warning List may still be unauthorised, because scam operators change names faster than lists can be updated.

Step 2: Verify the exact address and the exact app

Attackers do not need to beat your judgement if they can beat your eyes.

• Typosquatting registers near-misses of a real domain. Automated tools can generate over 2,000 plausible variants of one exchange domain using letter swaps, insertions and hyphens.
• Homoglyph attacks use characters from other scripts that render identically to Latin letters. Netcraft documented roughly 600 domains using one such character, most of them aimed at crypto users. This is why "the address looked right" is not evidence.
• Paid search results are a common entry point, with sponsored links impersonating well-known crypto brands ranking above genuine results.
• App stores are not a guarantee. Researchers have repeatedly found fraudulent crypto trading and wallet apps inside the official Apple App Store and Google Play. In one documented case the fake app allowed small withdrawals first to build trust, then locked the account and demanded a 20 percent fee.

Three habits fix most of this. Reach exchanges through your own saved bookmark rather than a link sent to you. Check the domain's registration age at the ICANN lookup tool, since a platform claiming a decade of history on a three-month-old domain is misrepresenting itself. Match the app publisher name to the company name on the official site.

Step 3: Watch what happens at withdrawal

This is the single most reliable test, and it is where fake platforms reveal themselves.

The CFTC states the rule plainly: never send more money to withdraw what is already yours, and US brokers do not collect or withhold taxes from trading accounts. Once a pay-to-withdraw demand appears, further payments will not recover the balance.

Step 4: Consider how you found the platform

Fake exchanges rarely arrive through search. They arrive through a person. Regulators describe the same pattern repeatedly: contact begins on social media, a dating app or a messaging group, trust builds over weeks, and the platform is introduced by someone presented as an insider or a relative in finance. Group chats then show fabricated payout screenshots to make the returns look normal.

Treat any exchange recommended by an online acquaintance as unverified until it passes Steps 1 and 2. The same applies when the pitch includes an AI trading bot, since the CFTC has warned that algorithms cannot deliver guaranteed or risk-free returns.

Step 5: Read the transparency claims critically

Many exchanges publish proof of reserves, usually a Merkle tree snapshot that lets you confirm your balance was included in an audited total. It is useful and limited:

• It shows assets and often says nothing about liabilities, so a platform can hold large reserves and still be insolvent.
• It is a snapshot, accurate on the audit date and possibly meaningless weeks later.
• In April 2026, on-chain researchers reported that Polish exchange Zondacrypto's Bitcoin hot wallet balance had fallen from 55.7 BTC to 0.086 BTC while the platform continued to present itself as solvent.

Check identity claims too. Run a reverse image search on leadership photos, since stolen and stock images are common, and look for a registered company number and address. Poor grammar across an otherwise polished site is another documented red flag.

The ten-minute pre-deposit checklist

1. Find the legal entity name and search the relevant regulator register.
2. Search the same name on the FCA Warning List and any local warning list.
3. Compare the domain character by character against your saved bookmark.
4. Check the domain registration date at the ICANN lookup service.
5. Confirm the mobile app publisher matches the company name.
6. Read the published withdrawal fee schedule before depositing.
7. Deposit a small amount, then withdraw a small amount, and then withdraw a larger amount.
8. Check whether proof of reserves exists, who audited it, and when.
9. Search the platform name together with the words scam, withdrawal and complaint.
10. Ask whether the introduction came from a stranger online, and weight your answer accordingly.

If you have already deposited

Stop sending money immediately, including any requested fee or tax. Save screenshots of the platform, the chat history, the wallet addresses and the transaction IDs, because investigators need those details. Report to your national authority, such as IC3 in the United States or Action Fraud in the United Kingdom, and tell your bank if fiat left through it.

Then guard against the second wave. The FBI recorded more than 10,500 recovery scam complaints in 2025 with roughly 1.4 billion US dollars in losses, including fraudsters posing as law firms, officials and even IC3 staff. No legitimate recovery service asks for an upfront payment in cryptocurrency.

FAQ

Can a fake exchange really pass an app store review? Yes. Researchers at Sophos and Group-IB have documented fraudulent trading apps published on both the Apple App Store and Google Play. Because these apps are pushed to small numbers of targeted victims, they attract few fraud reports and can avoid removal for a time.

Is a licensed exchange guaranteed to be safe? No. Licensing means the firm has met a defined standard for areas such as anti-money-laundering controls, capital and reporting. It does not remove market risk, custody risk or the possibility of business failure, and in most places crypto holdings are not covered by deposit compensation schemes.

The platform let me withdraw once, so is it legitimate? Not necessarily. Allowing an early small withdrawal is a documented technique for building confidence before larger deposits. Judge the platform by whether a large withdrawal completes without a new fee appearing.

Why does the register show nothing when I search the exchange brand? Exchanges often operate through a differently named legal entity. Look for the company name in the site footer, terms of service or legal notices, and search that. If no legal entity is named anywhere, treat that as a warning sign in itself.

Does proof of reserves mean my funds are safe? It means the exchange demonstrated that certain assets existed at one moment. It does not confirm liabilities, ongoing solvency, or that withdrawals will process under stress. Use it as one input, not as a verdict.

Related terms

• Clone firm: A fake business that copies the name, registration details or website of an authorised firm to appear legitimate.
• Pig butchering: A long-form investment scam where trust is built over weeks or months before the victim is directed to a fraudulent trading platform.
• Advance fee fraud: Any scheme requiring an upfront payment to release funds or profits that do not exist.
• Proof of reserves: A cryptographic attestation, usually built on a Merkle tree, showing that a custodian held specific assets at a specific time.
• Typosquatting: Registering misspelled or visually similar domain names to intercept users heading to a legitimate site.

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• FBI press release, Cryptocurrency and AI Scams Bilk Americans of Billions: https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
• CFTC and SEC Investor Alert, Fraudulent Digital Asset and Crypto Trading Websites: https://www.cftc.gov/LearnAndProtect/AdvisoriesAndArticles/watch_out_for_digital_fraud.html
• CFTC Customer Advisory on artificial intelligence scams: https://www.cftc.gov/PressRoom/PressReleases/8854-24
• FCA Warning List of unauthorised firms: https://www.fca.org.uk/consumers/warning-list-unauthorised-firms
• ESMA statement on the end of transitional periods under MiCA: https://www.esma.europa.eu/sites/default/files/2026-04/ESMA75-113276571-1679_Statement_on_the_end_of_transitional_periods_under_MiCA.pdf
• US Department of Justice, Scam Center Strike Force domain seizure: https://www.justice.gov/usao-dc/pr/scam-center-strike-force-announces-seizure-fake-cryptocurrency-investment-domain-used
• US Secret Service and DOJ, seizure of domains used in cryptocurrency investment fraud: https://www.justice.gov/usao-ndny/pr/secret-service-seizes-another-web-domain-used-furtherance-cryptocurrency-pig
• Chainalysis, US crackdown on Southeast Asian crypto scam centers: https://www.chainalysis.com/blog/asian-scam-centers-crypto-fraud-april-2026/
• Sophos, Fraudulent CryptoRom trading apps in Apple and Google app stores: https://www.sophos.com/en-us/blog/fraudulent-cryptorom-trading-apps-sneak-into-apple-and-google-app-stores
• Netcraft, lookalike domain research: https://www.netcraft.com/blog/down-the-hiragana-hole-uncovering-a-new-wave-of-lookalike-domains
• FinanceFeeds, proof of reserves and the Zondacrypto case: https://financefeeds.com/proof-of-reserves-crypto-exchanges/

Further reading

1. FCA: How to check a firm or individual is authorised. A short walkthrough of the Firm Checker and Financial Services Register, useful for anyone verifying a UK-facing platform. https://www.fca.org.uk/consumers/how-check-firm-individual-authorised
2. CFTC Learn and Protect customer advisories. A library of plain-language advisories on fee scams, romance-led investment fraud and unregistered brokers. https://www.cftc.gov/LearnAndProtect
3. ESMA: Markets in Crypto-Assets Regulation hub. Official material on MiCA authorisation and the register of authorised crypto-asset service providers in the EU. https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica

Disclaimer: This article is educational and is not financial, legal or investment advice. Regulatory rules and register locations change, so verify details with the relevant authority before acting.