Fake support and cloned accounts
A logo you trust. A handle that is one character off. A DM that starts with “We noticed unusual activity.”
Scammers clone Coinbase, Ripple, D’CENT, Ledger, Uphold, and even James Rule. They DM first, post “giveaway” replies under real videos, and run lookalike sites that ask you to “sync” a wallet.
Tells
- They contacted you first — James, Ripple, and exchanges do not cold-DM holders.
- The handle is almost right: extra letters, swapped vowels, a lookalike Unicode character.
- They want you to move coins, connect a wallet, or “verify” on a site they sent.
- Urgency: “Your account will be frozen in 30 minutes.”
Do this instead
Close the DM. Open the official app or site yourself by typing the address. Never use a link from a message. Report the clone.
Seed-phrase harvest
“Enter your 12 or 24 words to restore / sync / claim / unlock.” That sentence is the whole scam.
Phishing pages, fake wallet apps, “support agents” on Telegram, and QR codes at events all hunt the same thing: the recovery phrase that is the wallet. Once they have it, they drain it — often after waiting so you do not connect the leak to the paste.
Tells
- Any person, site, or pop-up asking for your recovery phrase.
- A wallet “update” that wants the phrase instead of an app-store update.
- A live chat that asks you to “confirm ownership” with the words.
- Airdrop or staking sites with a seed-entry field.
Do this instead
Nobody legitimate needs your seed phrase. Not James Rule. Not Ripple. Not Coinbase. Not a hardware-wallet maker. If you typed it anywhere online, move funds to a brand-new wallet immediately.
Giveaway and “send 1, get 10”
Elon, Ripple, or James is doubling XRP today. You just have to send first.
Pinned comments, hijacked livestreams, and paid ads promise a 2x–10x return if you send coins to a “verification wallet.” The math only works one way: they keep what you send.
Tells
- You must send crypto to receive crypto.
- A celebrity or host is “personally” running a giveaway in the comments.
- A countdown clock and a QR code.
- The same pitch copied under hundreds of posts.
Do this instead
Real giveaways never require an inbound transfer. If you already sent funds, they are gone. Do not send more to “unlock” them — that is the second bite.
Pig butchering and romance
A stranger warms you up for weeks, then walks you into a fake investment platform that shows fake profits.
They meet you on a dating app, WhatsApp, or Instagram. They talk for a long time. Then they “share” a trading site where your balance only goes up — until you try to withdraw and the taxes, fees, and “unlock” payments start.
Tells
- A new relationship that steers into investing fast.
- A platform you cannot find in a real app store or that only works through their link.
- Profits on screen, withdrawals blocked in real life.
- They coach you to keep it secret from family.
Do this instead
Stop wiring. Do not pay a “release fee.” Talk to a real person offline. Report it. Recovery DMs that appear the next day are a second scam.
Recovery and “we can get it back”
You just got drained. A helpful stranger slides in: for a fee, or a small send, they can reverse it.
Once you are marked as a victim — because you posted about it, or because the first scammer sold your number — recovery rooms, “on-chain police,” and fake lawyers pile on. They cannot reverse a completed crypto transfer. They will take the rest.
Tells
- Unsolicited help after a loss.
- They want a retainer in crypto.
- They claim a special relationship with exchanges or the IRS.
- Guaranteed recovery.
Do this instead
File reports with the FTC, FBI IC3, and your exchange if an account was involved. Use a lawyer you found, not one that found you. Ignore DMs.
Rug pulls and fake tokens
A new “XRP 2.0,” a celebrity coin, or an XRPL meme with a locked liquidity story that is not locked.
Anyone can issue a token. Charts can be painted. Liquidity can be pulled. Telegram admins can vanish. The screenshot of a “certik audit” can be stolen. Airdropped junk tokens are often bait to visit a draining site.
Tells
- Anonymous team, rented influencers, guaranteed returns.
- You are asked to buy on a site, not a major venue, with a token contract they pasted.
- Huge buy/sell tax, mint authority still open, liquidity not locked.
- An airdrop of a token you did not ask for.
Do this instead
If you do not understand the contract, you are the exit liquidity. Ignore mystery airdrops. Never connect a wallet to claim them.
