How to Spot a Fake Crypto Exchange: 12 Red Flags and Verification Checks

A fake crypto exchange does not need to look obviously fraudulent.

It can have:

• Real-time crypto prices
• Professional charts
• A working mobile app
• Customer support
• A copied licence number
• A dashboard showing profitable trades
• An early withdrawal that actually succeeds

None of those features proves that real trading, custody or regulated exchange activity is taking place.

Some fraudulent platforms are entirely fabricated. Others impersonate legitimate exchanges, regulated companies or real financial-services firms. They can copy a genuine company name, regulatory number, website design or certificate while directing users to a different domain and different deposit wallets.

The strongest verification therefore does not ask only:

Does this exchange look real?

It asks:

Can the domain, legal entity, regulatory record, app publisher, deposit route and withdrawal behavior all be independently connected to the same legitimate business?

If those pieces do not match, stop before sending funds or identity documents.

The short answer

A fake exchange becomes more likely when several of these signals appear together:

1. An unsolicited person introduces the platform.
2. The domain does not match the legitimate brand.
3. The app comes from an unusual download route.
4. The claimed licence cannot be matched to the exact legal entity.
5. Deposit instructions change or point to personal accounts.
6. Returns appear guaranteed or artificially smooth.
7. Small withdrawals work but larger withdrawals trigger new conditions.
8. The platform demands extra “tax,” “unlock” or “verification” payments.
9. Support exists only through private messaging.
10. Legal documents are missing, copied or internally inconsistent.
11. Trading activity cannot be independently verified.
12. The platform creates urgency or blocks independent verification.

One unusual feature is not always proof of fraud.

A cluster of identity, regulatory, payment and withdrawal inconsistencies is much more significant.

First distinguish the type of fake exchange

Not every fake crypto exchange follows the same model.

This distinction matters because a real regulatory record can still be used by a fake website.

A legitimate licence number is evidence about the licensed entity, not automatically evidence about the website displaying it.

The Cexvia verification model

Before relying on a crypto exchange, connect these six elements:

Domain
  ↓
Brand
  ↓
Legal entity
  ↓
Regulatory record
  ↓
Deposit / custody path
  ↓
Withdrawal / operational evidence

A convincing logo is not enough.

A regulatory registration is not enough.

Even a successful small withdrawal is not enough.

The evidence should describe the same operating business.

Cexvia applies the same principle when building exchange risk profiles: regulatory and operational evidence is mapped to the relevant venue and legal entity rather than inferred from a brand name alone.

1. The platform was introduced through an unsolicited relationship

A common crypto investment scam begins outside the exchange itself.

Initial contact can occur through:

• Dating apps
• Social media
• Investment groups
• Messaging apps
• Wrong-number texts
• Professional networking platforms
• Unsolicited investment communities

The relationship may develop for days or weeks before crypto is discussed.

The person can present themselves as:

• A successful trader
• An investor
• A mentor
• A romantic interest
• A business owner
• A member of an exclusive investment group

Eventually, they recommend a specific crypto website or app.

US regulators and law-enforcement agencies continue to warn about this pattern. The SEC describes relationship investment scams as schemes in which fraudsters build trust before steering victims toward investments. FBI guidance similarly describes scammers using social or romantic relationships and directing victims to specific cryptocurrency trading applications or investment accounts.

Verification rule

Do not evaluate the exchange through the person who introduced it.

Verify the platform independently using:

• The exchange's known official domain
• Regulator databases
• Corporate records
• Official app-store listings
• Independent public evidence

Do not use the introducer's referral link as the starting point for verification.

2. The domain does not match the legitimate exchange

Fake exchanges and clone sites frequently use domains that resemble legitimate brands.

Examples of suspicious patterns include:

brand-vip.com
brand-global.net
brand-exchange.xyz
brandsecure-login.com
brànd.com
brand-trade-pro.com

A clone can copy:

• Logo
• Colors
• Trading interface
• Legal text
• Customer-support design
• Licence number
• Real-time market prices

The copied interface does not create a legal connection to the real company.

Check the domain itself

Verify:

• Exact spelling
• Top-level domain
• Subdomain
• HTTPS certificate
• Historical use of the domain
• Whether the legal entity publicly associates itself with that domain

A newly registered domain does not automatically prove fraud.

But a platform claiming a long operating history through a domain that appeared very recently creates an evidence conflict that should be explained before funds are sent.

Do not trust search ads as verification

A paid search result or sponsored link is not evidence that the site belongs to the real exchange.

Navigate from a previously verified source or manually type the known domain.

3. The app came from an unusual download route

A fake exchange can be delivered as:

• Android APK
• Enterprise mobile profile
• Test build
• Configuration profile
• Direct download file
• Link sent through private messaging

The app may look nearly identical to a real exchange.

It may also display real crypto market data while sending deposits to wallets controlled by the scam operator.

Verify the app separately

Check:

• Publisher or developer name
• App-store listing
• Linked official website
• Privacy policy
• Package identity where relevant
• Whether the official exchange website links to the same app

Even appearance in an app store is not absolute proof of legitimacy.

The important test is whether the publisher and domain match the operating company.

Never install remote-access or device-management software at the request of exchange “support.”

4. The licence belongs to another company or does not cover the website

This is one of the most important fake-exchange checks.

Fraudsters can copy a legitimate:

• FinCEN MSB number
• Company registration
• VASP registration
• Financial licence
• Certificate
• Regulator logo

The record itself may be genuine.

The connection to the website may be false.

A licence check must match more than the number

Verify:

FinCEN explicitly states that inclusion in its MSB registration database is not a recommendation, certification of legitimacy or government endorsement.

A website displaying a genuine FinCEN number therefore still needs to prove that it belongs to the registered business.

Watch for scope inflation

Examples:

Actual record:
FinCEN MSB registration

Website claim:
"US government licensed investment exchange"

or:

Actual record:
Company incorporation

Website claim:
"International financial licence"

The underlying record may be real while the marketing interpretation is false.

For more detail, see:

Registered, Licensed or Regulated? How to Verify a Crypto Exchange

5. Deposit instructions do not fit a normal exchange account

Deposit-address rotation can be normal.

Changing banking partners can also be legitimate.

The stronger warning is when deposit instructions are detached from the authenticated platform.

Examples include:

• A support agent sends a wallet address through chat
• A “mentor” provides the deposit address
• Payment goes to a personal bank account
• The beneficiary name has no obvious relation to the exchange
• Each payment is redirected to a new unrelated recipient
• The authenticated exchange account contains no record of the deposit instructions
• Users are told to misstate the purpose of a bank transfer

Safer verification

Generate payment details only through a verified exchange account.

Before sending, record:

• Asset
• Network
• Deposit address
• Memo or tag
• Bank beneficiary, if fiat
• Payment reference
• Account page showing the instruction

Do not replace those details with an address supplied through private messaging.

6. The returns look guaranteed, perfectly smooth or disconnected from markets

A fake platform can copy real market prices while inventing:

• Account balances
• Trading results
• Interest
• Mining rewards
• Arbitrage profits
• Strategy returns

This creates an important distinction:

Real market data does not prove real execution.

A website can display BTC and ETH prices from a public API while every number in the user's account is stored in an internal database controlled by the fraudster.

Warning signs include:

• Guaranteed daily returns
• No losing trades
• Fixed percentage growth
• “Risk-free” arbitrage
• Extraordinary returns with no verifiable execution
• Profits that continue while the actual market moves against the stated strategy

The FBI states that investment fraud commonly involves promises of low- or no-risk investments and nonexistent opportunities.

Verify execution, not screenshots

Ask whether activity can be connected to:

• Real withdrawals
• Public blockchain transactions
• Verifiable market execution
• Recognized counterparties
• Legitimate custody arrangements

A screenshot of a profitable position proves only that the interface can display that number.

7. A small withdrawal works before a much larger deposit

A successful first withdrawal can feel like strong evidence that a platform is legitimate.

It is not conclusive.

The FTC has documented crypto investment scam reports in which users were allowed to make a small test withdrawal, increasing confidence before they deposited substantially more.

The fraud appears later.

Common progression:

Small initial deposit
      ↓
Displayed profit
      ↓
Small withdrawal succeeds
      ↓
User increases deposit
      ↓
Displayed balance grows
      ↓
Large withdrawal requested
      ↓
New fee / tax / VIP requirement appears

The early withdrawal can be part of the fraud design.

Verification rule

Do not increase exposure solely because a test withdrawal succeeded.

Verify the legal business before the first significant deposit.

8. The platform demands another payment before withdrawal

This is one of the strongest scam indicators.

Typical labels include:

• Tax
• Withdrawal tax
• Unlock fee
• Security deposit
• Verification deposit
• Liquidity fee
• Risk reserve
• Credit-score payment
• Anti-money-laundering deposit
• VIP upgrade
• Margin replenishment
• Account activation
• Regulatory release fee

The SEC warns that fraudsters may show victims apparent profits and then demand additional fees, taxes or deposits before funds can supposedly be withdrawn.

The FTC describes fake crypto investment websites where users cannot withdraw or are told to pay large additional fees.

Distinguish normal fees from advance-fee fraud

A legitimate exchange may charge:

• Trading fees
• Withdrawal fees
• Network fees
• Published service charges

Those should normally be documented in the platform's fee structure or shown inside the authenticated transaction flow.

A demand to send additional crypto to a separate wallet to “release” an existing balance is materially different.

Do not pay simply because the dashboard shows a large amount waiting to be unlocked.

For withdrawal diagnosis, see:

Crypto Exchange Withdrawal Problems: How to Diagnose Delays, Holds and Missing Transfers

9. Customer support exists only through private messaging

Private messaging is not automatically fraudulent.

Many legitimate crypto companies maintain Telegram or other community channels.

The warning becomes stronger when private messaging is the only channel through which:

• Deposits are arranged
• Compliance documents are collected
• Withdrawal fees are demanded
• Account restrictions are explained
• Password or security actions are requested

Support should never require:

• Seed phrase
• Private key
• Wallet recovery phrase
• Authenticator secret
• One-time authentication code
• Remote desktop control
• Screen-control permissions

No legitimate exchange needs a self-custody wallet's private keys in order to investigate a transfer.

10. Legal documents are missing, copied or contradictory

Open the site's:

• Terms of service
• Privacy policy
• Fee schedule
• Risk disclosure
• Complaint procedure
• Legal or regulatory page

Look for:

• Full legal entity
• Registered address
• Governing law
• Contact information
• Regulator
• Licence or registration number
• Customer eligibility
• Restricted jurisdictions

Common clone-site problems include:

• Another company's name in the terms
• A different domain in the privacy policy
• Placeholder text
• Broken legal links
• Conflicting addresses
• Different regulators named on different pages
• No identifiable contracting entity

A polished legal page is not sufficient evidence by itself.

But internal contradictions are useful risk signals.

11. Trading and account activity cannot be independently verified

Fake exchange dashboards can display:

• Real price feeds
• Fake order books
• Fabricated trade fills
• Simulated account balances
• Internal “transaction IDs”
• Fake profit histories

Compare the displayed market with independent market data.

Large unexplained price differences, impossible arbitrage or guaranteed fills can indicate that the displayed market is not genuine.

Internal transaction ID versus blockchain transaction hash

These are not the same thing.

An internal platform ID proves only that the website generated an identifier.

A public blockchain transaction hash can be checked independently.

For crypto deposits and withdrawals, determine whether the claimed transaction exists on the appropriate blockchain when it should.

12. The platform creates urgency and discourages verification

Fraud works better when the victim does not independently investigate.

Pressure tactics include:

• Bonus expires today
• VIP allocation is almost full
• Mining slot expires
• Investment signal works for only a few hours
• Account will be frozen today
• Regulator will seize the balance
• Tax must be paid immediately
• Family or bank should not be told
• Bank transfer purpose must be disguised

A legitimate exchange should survive independent verification.

If the opportunity becomes unavailable merely because you spend time checking the company, regulator and domain, the urgency itself is relevant evidence.

Do not:

• Borrow money because of a countdown
• Sell assets to meet an “unlock” requirement
• Lie to a bank about the purpose of a transfer
• Ignore a bank fraud warning because a mentor tells you to

A 5-minute fake exchange verification workflow

Before depositing, run these checks in order.

Step 1 — Verify the domain

Compare the exact URL against reliable references.

Do not rely on logos or search advertisements.

Step 2 — Find the legal entity

Read the terms of service.

Record:

Legal entity:
Company number:
Registered address:
Governing law:

If no company is identifiable, stop.

Step 3 — Verify the regulatory claim

Use the regulator's official database.

Record:

Regulator:
Record type:
Reference number:
Status:
Permitted activity:
Jurisdiction:
Approved domain:

Do not rely on certificate screenshots.

Step 4 — Verify the app

Check that:

app publisher
=
official website
=
legal entity / group

An app sent directly through chat should receive additional scrutiny.

Step 5 — Verify the deposit path

Make sure payment instructions originate inside the authenticated platform.

Check the beneficiary or wallet address.

Step 6 — Check withdrawal evidence

Search for:

• Current withdrawal status
• Official service notices
• Verified incidents
• Regulatory warnings
• Evidence of withdrawal suspensions

Cexvia Risk Radar tracks validated events including withdrawal suspensions, hacks or asset loss, licence suspensions or revocations, regulatory actions and service outages.

Check Cexvia Risk Radar

Step 7 — Check the exchange profile

If Cexvia covers the venue, review:

• Legal entity
• Regulatory standing
• Corporate transparency
• Asset and solvency transparency
• Security history
• Operations and user protection
• Evidence coverage

Browse Cexvia Exchange Risk Profiles

Step 8 — Run the safety checklist

Cexvia's 15-point exchange safety checklist includes checks for the official domain, contracting entity, licence scope, reserves, incidents, withdrawal status and exit route.

Run the Cexvia Exchange Safety Checklist

How to read combinations of red flags

The evidence becomes stronger when signals occur across different categories.

Lower-information warning

New domain only

A new domain can have legitimate explanations.

It requires investigation, not an automatic fraud conclusion.

Stronger warning

New domain
+
no identifiable legal entity
+
copied licence number

Now identity and regulatory evidence conflict.

High-risk pattern

Unsolicited relationship
+
unknown platform
+
fake / mismatched licence
+
large displayed profits
+
withdrawal blocked
+
additional tax demanded

This closely matches patterns described in US investor-protection and law-enforcement warnings.

The strength comes from the combination, not one isolated sign.

Fake exchange versus risky real exchange

This distinction is important.

A real exchange can still have:

• Poor customer service
• Withdrawal delays
• Regulatory problems
• Security incidents
• Weak transparency
• High fees
• Limited licences

Those issues do not automatically mean the exchange itself is fabricated.

Cexvia separates:

Identity / legitimacy problem

Questions include:

• Is the website genuine?
• Does the company exist?
• Does the domain belong to that company?
• Are regulatory records being impersonated?
• Is the user interacting with the real service?

Exchange-risk problem

Questions include:

• What is the regulatory standing?
• How transparent is the company?
• What reserve or custody evidence exists?
• Has the platform suffered security incidents?
• Are withdrawals operating normally?
• What user-protection controls exist?

A platform should first pass the identity test.

Only then does a conventional exchange-risk assessment become meaningful.

What to do if you already sent money

If there are signs that the platform may be fraudulent, prioritize evidence preservation.

Save:

• Domain
• Website screenshots
• App information
• Wallet addresses
• Bank beneficiaries
• Transaction hashes
• Emails
• Phone numbers
• Usernames
• Chat history
• Account balance pages
• Deposit instructions
• Withdrawal demands
• Claimed licences
• Company names
• Support identities

Do not delete messages even if they are embarrassing or emotionally difficult.

They may establish how the fraud developed.

Stop sending additional funds

Do not send more money merely because the platform claims that:

• A final payment will unlock everything
• Tax must be paid first
• Your credit score must be restored
• A regulator has frozen the funds
• A recovery specialist needs an upfront fee

The apparent balance on the dashboard may not represent recoverable assets.

Contact the funding institution

If funds were sent through:

• Bank transfer
• Card
• Legitimate crypto exchange
• Payment service

contact that institution promptly and explain that the transfer may be related to fraud.

Ask what fraud, recall, account-security or tracing options are available.

Report the wallet and transaction details

For US victims, the FBI's Internet Crime Complaint Center requests detailed cryptocurrency transaction information when reporting fraud.

Relevant information can include:

• Wallet addresses
• Transaction hashes
• Amounts
• Dates
• Domains
• Contact details
• Communication platforms

Official resource:

FBI IC3 — Cryptocurrency

Fraud can also be reported to:

FTC — ReportFraud

Beware of recovery scams after the original scam

Losing funds can create a second vulnerability.

Scammers may contact victims claiming to be:

• Law firms
• Blockchain investigators
• Government agents
• Asset recovery companies
• Ethical hackers
• Exchange investigators

They may already know:

• The victim's name
• Amount lost
• Platform used
• Wallet address

That knowledge does not prove they have recovered anything.

The FBI specifically warns about cryptocurrency recovery services, especially those charging upfront fees. It has also published warnings about fictitious law firms targeting crypto scam victims.

The SEC describes recovery or “reload” scams as advance-fee fraud in which prior victims are asked to pay additional money to recover earlier losses.

Recovery rule

Do not pay an unsolicited recovery provider in advance simply because they claim to have traced the funds.

Verify any law firm, regulator or authority independently using contact details obtained from an official source.

Common fake exchange claims and what they really prove

Frequently asked questions

How can I tell if a crypto exchange is fake?

Start by matching the exact domain, legal entity, regulatory record and app publisher.

Then inspect where deposits are sent and whether withdrawals settle through verifiable channels.

Several mismatches together are a stronger warning than one isolated issue.

Can a fake crypto exchange show real prices?

Yes.

A fake website can pull live market prices from public data sources while fabricating the user's trades, profits and account balance.

Real-looking charts do not prove real custody or execution.

Can a fake exchange have a real licence number?

It can display a real number.

The number may belong to an unrelated legitimate business.

Always verify the legal entity, status, activity and domain through the regulator's own record.

Is FinCEN MSB registration proof that an exchange is legitimate?

No.

FinCEN explicitly states that inclusion in the MSB registration database is not a recommendation, certification of legitimacy or government endorsement.

Does a successful crypto withdrawal prove the exchange is real?

No.

The FTC has documented reports in which crypto investment scams allowed small test withdrawals before victims deposited much larger amounts.

Why is the exchange asking me to pay tax before withdrawing?

Additional tax, fee or deposit demands before releasing apparent investment profits are a known advance-fee fraud pattern.

Do not pay a separate wallet or unofficial contact without independently verifying the platform and the legal obligation.

Can I recover crypto sent to a fake exchange?

Confirmed blockchain transactions are generally irreversible at the protocol level.

Law enforcement, a centralized service controlling the destination or another relevant intermediary may sometimes assist, but recovery is not guaranteed.

Be cautious of anyone promising guaranteed recovery.

Is every exchange with withdrawal complaints fake?

No.

Real exchanges can experience wallet maintenance, compliance reviews, security holds and service outages.

A withdrawal problem should be investigated separately from whether the platform's identity itself is genuine.

Conclusion

The most convincing fake crypto exchanges succeed because they reproduce the surface features users expect from real trading platforms.

They can show:

• Live crypto prices
• Profitable trades
• Regulatory logos
• Customer support
• Mobile apps
• Successful early withdrawals

The verification must therefore go deeper than appearance.

Use this chain:

domain → legal entity → regulatory record → app publisher → deposit path → withdrawal evidence

Then ask whether every link describes the same operating business.

If the company cannot be identified, the regulatory record belongs to another entity, deposits are directed through unofficial channels, or withdrawals require repeated extra payments, do not treat a dashboard balance as proof that assets exist.

For Cexvia, fake-exchange detection and exchange-risk scoring are related but distinct tasks: identity must be verified first; only then should regulatory, solvency, security and operational risk be assessed.

Primary sources and Cexvia resources

• SEC Investor.gov — 5 Ways Fraudsters May Lure Victims Into Scams Involving Crypto Asset Securities
• SEC Investor.gov — Relationship Investment Scams
• SEC Investor.gov — Advance Fee Fraud
• FTC — What To Know About Cryptocurrency and Scams
• FBI IC3 — Cryptocurrency
• FBI IC3 — FBI Guidance for Cryptocurrency Scam Victims
• FBI IC3 — Fictitious Law Firms Targeting Cryptocurrency Scam Victims
• FinCEN — MSB Registration Website
• Cexvia Exchange Risk Profiles
• Cexvia Risk Radar
• Cexvia Exchange Safety Checklist
• Cexvia Methodology

*Cexvia evaluates centralized exchanges using publicly verifiable evidence across regulatory standing, corporate transparency, asset and solvency transparency, security history, and operations and user protection. Identity verification and scam detection are separate from exchange risk scoring. Ratings are evidence-based assessments, not guarantees of safety or recommendations to deposit or trade.*