Fake crypto exchange apps: how to check an app before you deposit

A fake crypto exchange is a trading app or website that shows you a balance and “profits” while your deposits go straight to wallets the scammers control. Before you deposit, check whether the platform is registered with FinCEN and licensed in your state, look it up on regulator warning lists, compare the app’s developer with the real company, check the domain’s age, and ask who sent you there; if anyone tells you to pay a “tax” or “fee” before you can withdraw, stop paying.

Regulators describe the same pattern again and again. The FBI’s 2025 IC3 Annual Report says cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025, with $7.2 billion reported lost across 61,559 complaints. In the same report, the IC3 says victims “are enticed to send cryptocurrency to fake investment scam platforms or apps and are shown fake profits,” and that when they try to withdraw, “they will be charged taxes and fees as a final attempt to exploit money from the victims before the scammers disappear with all the victim funds.”

How a fake crypto exchange usually works

The app is rarely where the scam starts. It starts with a person.

A September 2024 investor alert issued jointly by the SEC’s investor education office, the CFTC, FINRA and NASAA says fraudsters “might run advertisements or add targets to a group chat that the target didn’t seek to join,” or text “pretending to be an old friend or claiming to have contacted the target accidentally.”

After trust is built, the contact brings up crypto trading. FinCEN’s pig butchering alert (FIN-2023-Alert005) says the scammer will “direct them to use virtual currency investment websites or applications designed to appear legitimate, but which are fraudulent and ultimately controlled or manipulated by the scammer.” Your “deposits” go to addresses the scammers control. Then:

1. The balance grows. The FBI’s October 2022 public service announcement says the fake websites and apps “allow the victims to track their investments and give the impression they are growing exponentially.”
2. A small withdrawal works. FinCEN says the scammer “may even allow the victim to withdraw a small amount of that investment to further build the victim’s confidence before urging the victim to invest more.”
3. Pressure to deposit more. The SEC alert says fraudsters “might pretend to loan their targets funds for trading but require these ‘loans’ to be repaid before any purported profits or principal can be withdrawn.”
4. The withdrawal wall. When you try to take out a large amount, FinCEN says “the scammer may demand that the victim pay purported taxes or early withdrawal fees.” Once you can’t or won’t pay more, the contact disappears.

A recent example from the Washington State Investment Scam Tracker shows the arithmetic. In a February 6, 2026 entry, Washington’s Department of Financial Institutions (DFI) describes a senior investor who met someone online, moved to WhatsApp, wired $10,000 and invested on a website impersonating a real trading platform. The account “grew” to $35,000, and the investor was told to pay $7,700 in fees to withdraw, even though the contact had said fees would come out of profits. When the investor pushed back, the website locked him out and the contact blocked him. DFI notes it has not verified the reported details.

Who sent you to the app? Start there

The most useful check needs no tools: how did you find this platform? If the answer is a person you met online, a stranger who texted the “wrong number,” a “mentor” in a group chat, or an ad that led to a private chat, treat the platform as suspect no matter how professional it looks. The SEC alert puts it plainly: “No matter how trustworthy someone might seem, don’t make investment decisions based on the advice of anyone who makes unsolicited contact with you online or through an app or text message.”

Washington DFI’s pig butchering page lists warning signs that cluster around the person, not the app:

• unsolicited contact through social media, dating apps or wrong-number texts
• a quick emotional or romantic connection
• excuses to avoid video calls or meeting in person
• pressure to keep the investment secret from friends and family
• pressure to lie to your bank about why you are moving money
• returns “sometimes measured in hours or days rather than months or years”

The CFTC’s romance fraud page adds one more: the contact tells you to send crypto “to a trading platform you’ve never heard of before.” If the platform came from someone like this, a clean result on the checks below does not cancel those warning signs, because scammers copy real companies’ names.

Check 1: Is it registered with FinCEN and licensed in your state?

The CFTC’s registration check page says “Digital currency spot market trading companies are considered money service businesses (MSB) by the U.S. Treasury and must be registered with Financial Crimes Enforcement Network (FinCEN).” Many states also require them to register as money transfer companies. Two lookups follow:

• FinCEN MSB Registrant Search at fincen.gov/msb-registrant-search. Search the exact company name. FinCEN’s alert lists “not registered with FinCEN as a money services business” as one more indicator that a supposedly legitimate business may be part of a pig butchering scam.
• NMLS Consumer Access at nmlsconsumeraccess.org. The CFTC page tells readers to “check the Nationwide Multistate Licensing System (NMLS) to see if the company is registered in your state (click search results for a detailed view).” The NMLS is operated by the Conference of State Bank Supervisors.

Two cautions. First, a registration only helps if it belongs to the company you are actually dealing with. Scam sites often borrow the name of a real, registered firm, so compare the website address and contact details in the registration with the app in front of you. Second, the CFTC page warns: “FinCEN does not approve or endorse any business that has registered as an MSB. Any such claim and similar claims are false and may be part of a scam.” If a platform’s homepage says it is “approved by FinCEN” or shows a FinCEN logo as a badge of trust, that is a reason to walk away.

Check 2: Search regulator warning lists and scam trackers

• CFTC RED List. The Registration Deficient List “contains names of foreign entities that appear to be acting in a capacity that requires registration with the CFTC, but they are NOT registered with the CFTC.” Being on it is not a legal finding of wrongdoing. Being absent proves nothing either: the CFTC says “Even if the entity you are considering is not on the RED List, always check to see if it is registered with the CFTC before opening an account or paying any money.”
• State scam trackers. Washington’s Investment Scam Tracker lets you search or browse investment scams reported to DFI, with categories for cryptocurrency, pig butchering, recovery and impersonation scams. Other states’ securities and financial regulators publish warnings too; NASAA’s directory, which Washington DFI points to, lists them. Search for the platform’s name and its web address.
• SEC and FINRA tools. The CFTC check page points to the SEC’s PAUSE list of unregistered entities that claim to be registered, and to FINRA BrokerCheck. If your “mentor” claims to be a licensed professional, test that claim there.

A miss on these lists is weak evidence; a hit is strong evidence.

Check 3: Who really published the app?

Being in Apple’s App Store or Google Play is not a background check. The SEC alert says “just because an app is available on a well-known app store doesn’t mean that the app itself, or the activities conducted within it, are legitimate.”

What to look at:

• How you installed it. FinCEN lists as a red flag that a customer “downloaded an application on their phone directly from a third-party website, rather than from a well-known third-party application store or an application store installed by the manufacturer of the device.” If your contact sent you a download link or a web page that “installs” the app, stop.
• The developer name on the listing. Look at who the store listing names as the developer and compare it with the company that runs the real exchange’s website, which you should reach by typing the address yourself. An app named after a well-known exchange but published by an unrelated developer is a warning sign.
• Whether the company exists. The FBI’s July 2022 Private Industry Notification on fake crypto investment apps tells investors to verify an app “by confirming the company offering the app actually exists, identifying whether the company or app has a website, and ensuring any financial disclosures or documents are tailored to the app’s purpose.” It also says to treat apps “with limited and/or broken functionality with skepticism.”

The same notice describes criminals who convinced at least 28 victims to download an app “that used the name and logo of an actual US financial institution.” When 13 of them tried to withdraw, they received an email saying they had to pay taxes first. After paying, they still could not withdraw. Across its cases, the FBI counted 244 victims and about $42.7 million in losses.

Check 4: Domain age, lookalike addresses and the website itself

The FBI’s October 2022 PSA warns readers to “be on the lookout for domain names that impersonate legitimate financial institutions, especially cryptocurrency exchanges,” and says “Misspelled URLs, often with a slight deviation from the actual financial institutions’ website, may be fake.” FinCEN’s technical red flags include “a web address or domain name that is misspelled in such a manner as to resemble that of another business, a recently registered web address or domain name, no physical street address, international contact information, or contact methods that include only chat or email.”

The CFTC’s romance fraud page suggests two simple checks: “Look up the site’s domain registration to see if its age matches its claims,” and, if the site lists a headquarters, “do a street-level online map search to see if it looks like a legitimate place of business.” A platform that claims years of history on a domain registered a few weeks ago has answered your question.

FinCEN cites a November 2022 case in which federal prosecutors in Virginia seized seven domains spoofing the Singapore International Monetary Exchange; five U.S. victims lost over $10 million through them.

Sloppy design is a red flag for FinCEN, but polished design proves nothing. The SEC alert notes that scammers use altered or AI-generated images and videos of “skyrocketing account balances” and paid testimonials, and that others in a group chat “who claim to have made huge profits might be in on the fraud.”

Quick checklist: run these before you deposit

Passing every row rules out common fakes; it does not make a platform safe or a good investment. For decisions about whether to invest at all, talk to a licensed financial professional you found yourself.

The “pay a tax or fee to withdraw” red flag

If a platform now says you must pay before you can withdraw, each regulator quoted here treats the upfront withdrawal payment as the end stage of the scam:

• FinCEN: the scammer “may demand that the victim pay purported taxes or early withdrawal fees.”
• The SEC alert: fraudsters “tell the target for the first time that they must pay more to cover fees or taxes,” and “paying additional funds only causes the target to lose more money.”
• An FBI and ABA Foundation infographic: “there’s no getting the money back, even if they pay the supposed fees or taxes.”

The demand can take other forms, such as a “loan” to repay first or a minimum balance you never agreed to. In one case in the FBI notice, criminals told a victim he was enrolled in a program requiring a minimum balance of $900,000 without his consent, then told him to deposit the funds or have all assets frozen.

FinCEN also tells banks to watch for customers who send money to crypto platforms and note that the payment is for “taxes,” “fees,” or “penalties.” Your bank may ask you about such a transfer. If it does, tell the truth. Washington DFI lists pressure to lie to your bank as a sign of a scam.

If you have a genuine question about taxes on crypto, ask a tax professional you choose yourself, not the platform or your contact.

What to do if you already deposited

1. Stop sending money. That includes fees, taxes, deposits to “unlock” the account, and loan repayments. The FBI infographic’s first step for victims is to stop sending money to the criminals.

2. Stop contact and keep the evidence. Washington DFI advises blocking the scammer everywhere, and saving “unedited screenshots of conversations, profile details, crypto wallet addresses, transaction hashes, and website URLs.”

3. Contact the exchange or bank you sent the money from. If you bought crypto at a known exchange and sent it to the fake platform, tell that exchange and your bank right away. Washington DFI says to notify your financial institutions “to secure your accounts, freeze transfers, and report fraudulent activity.” Use the app or website you already have, not contact details from the scammer; fake support lines are common, as our piece on Coinbase scam calls shows.

4. Report it.

• FBI IC3 at ic3.gov. The 2022 FBI PSA asks victims to include how the person first contacted them and how they identified themselves, plus transaction details such as dates, amounts, account numbers, crypto wallets, and the receiving addresses.
• FTC at ReportFraud.ftc.gov.
• CFTC at cftc.gov/complaint and the SEC at sec.gov/tcr, both named in regulator materials on these scams.
• Your state regulator. Washington residents can file with DFI; the agency points people in other states to NASAA’s directory of state securities regulators.

FinCEN’s alert also mentions the Justice Department’s National Elder Fraud Hotline at 833-FRAUD-11 (833-372-8311) for older victims.

Reports get used. The FBI’s Operation Level Up uses IC3 complaint data to find and warn crypto investment fraud victims. In 2025 it notified 3,780 victims, and 78% of them were unaware they were being scammed.

5. Consider professional help. If large sums are involved, a lawyer you find yourself can advise on your options. If you pulled money from a retirement account, the CFTC notes victims “may even owe a large tax bill to the IRS for prematurely removing funds from retirement accounts,” so a tax professional is worth a call.

Beware the second scam: fake recovery services

Victims of a fake crypto exchange are often targeted again by people offering to get the money back. The 2025 IC3 report counted 10,516 recovery scam complaints and $1.4 billion in losses, with more complaints reporting impersonation of government officials and recovery firms.

The CFTC’s article on relationship cons and recovery scams says “Recovering money lost to fraud is rare and more difficult” once dollars are converted to crypto, and that “The criminals know this, so they may call you claiming they can get your lost money back.” These offers are advance-fee fraud: you are told your money has been found “if you first pay a tax, fee, or retainer.” Often the same gang runs both scams.

Washington DFI is direct about it: “Government agencies like DFI, police, and legitimate investigators will never ask for payment to investigate a fraud case.” Our guide to the crypto recovery scam covers fake asset recovery firms and fake FBI agents in detail.

The CFTC describes a possible third act too: a “job” offer to open bank or crypto accounts and forward money for others. That is money laundering and could land you in jail, the CFTC warns. Our task scam guide explains how fake jobs pull people in.

Where crypto ATMs and AI fit in

The SEC alert says fraudsters may tell targets to buy crypto at a bitcoin ATM or kiosk to fund the “investment.” The 2025 IC3 report counted 13,460 crypto ATM and kiosk complaints with $389 million in losses, most of it reported by people 60 and over. See our report on the Albuquerque crypto ATM ban.

The SEC alert also warns that “New artificial intelligence (AI) technologies can make these images and videos convincingly realistic.” A platform that claims an AI bot trades for you needs the same checks; see Is AI Wealth Machine a scam? and our catalog of AI scams that steal money in 2026.

How we checked this

We read FBI and IC3 reports and alerts, FinCEN’s pig butchering alert, the joint SEC, CFTC, FINRA and NASAA investor alert, CFTC consumer pages, and Washington DFI’s scam tracker and guidance. Every number and quote comes from those pages. Facts checked on October 21, 2026.