Is this crypto site legit? How do I check before I connect, send or download?
Published · Updated
Short answer: Assume any crypto site reached from an unsolicited message, ad or online "friend" is a scam. Type the address yourself, check domain age at lookup.icann.org and confirm FinCEN registration. Stop if it wants your seed phrase, a "connect to claim" signature or a withdrawal fee. A clean checker result isn't proof. (CFTC; FBI IC3; DC DISB)
What this covers: how to check if a crypto website, exchange, trading platform or app is legit before you use it: a 7-point check you run yourself with free official tools (domain age, US registration, scam trackers), the three stop signs that end the check early, and what a "clean" scam-checker result does and doesn't tell you. Who it's for: you, if a link, DM, ad, text or new online friend just sent you to a crypto site and you're about to connect your wallet, send or deposit crypto, or download an app, including if you're checking for a parent. What it isn't: a rating of exchanges or coins, a scam-checker tool, or a recovery service. We don't refer anyone to exchanges, and no check can prove a site is safe.
Key facts
- The CFTC says the "vast majority" of crypto and forex trading frauds begin on social media or messaging apps, and if someone you met online introduces you to a trading site you've never heard of, "chances are it's a fraud." (CFTC)
- US crypto trading platforms are money services businesses that must register with FinCEN. The CFTC says registration alone won't protect you, but most scams involve unregistered entities. (CFTC; DC DISB)
- The FBI says fake investment platforms tell victims who try to cash out that they must first pay "income taxes or additional fees," and victims still can't get their money. (FBI IC3; IC3)
- A padlock and "https" only mean the connection is encrypted. The FBI says not to trust a website just because it has them. (FBI IC3)
- Measured (PBS, 2026-10-28): only 4 of about 800 fake-platform web addresses in California's DFPI Crypto Scam Tracker appeared on MetaMask's public phishing blocklist. A quiet wallet isn't a green light. (Method; DFPI; MetaMask list)
Three stop signs: end the check here
You don't need all seven checks if you hit one of these. Any one of them means the site isn't legit, or is being used for a crypto scam. Stop. Don't connect, send or download.
- It wants your seed phrase or recovery phrase for anything: "verify," "sync," "unlock," "validate." No real site or app needs it. See seed phrase phishing.
- It wants a fee, tax or "deposit" before you can withdraw. That's how fake platforms take a second payment. (FBI IC3) See the pig-butchering warning signs.
- A person you've only met online is coaching you onto it, or "support" contacted you first. (CFTC) Real support doesn't message you first: see fake wallet support.
How do I check if a crypto website is legit? The 7-point check
Run all seven. It takes about 5 minutes. Use your own browser tab, not the link you were sent. Checking for a parent or friend who says they're "making money" on a platform? Run the same seven on their site, with them.
1. Check how you got here
Ask yourself: did you go looking for this site, or did it find you? A DM, text, ad, "wrong number," dating match, LinkedIn contact, or WhatsApp or Telegram group are all unsolicited routes, and that's the biggest single red flag. Government warnings also flag promised or "guaranteed" returns and pressure to act fast. (CFTC; CFTC alert; DC DISB)
"If someone contacts you out of the blue, or you meet someone online who introduces you to a trading website you've never heard of before, chances are it's a fraud."
In California's scam tracker, about 1 in 3 entries (234 of 645) mention WhatsApp or Telegram. (DFPI; method under checkers) If a new online friend is coaching you to invest, read how pig-butchering scams work before you go further. Got the link from a recruiter? See a "job" that wants you to deposit crypto.
2. Check that the address is the real one
- Type the brand's address yourself, or use a bookmark you saved earlier. Don't use the link you were sent or a search ad.
- Compare it letter by letter. Scammers "typosquat": they register addresses with one or two characters changed, or an extra word like "-app" or "-login." The FBI also warns about slightly misspelled web addresses that copy real firms. (MetaMask; FBI IC3)
- Don't trust the look. MetaMask says not to assume a site is legit just because it looks good. (MetaMask)
About 18% of California tracker entries (116 of 645) carry a "not to be confused with" note, where the fake used a name close to a real company's. (DFPI) About to call or chat with "support" you found in a search result? Here's how to reach real wallet support safely. Checking a wallet address rather than a website works differently: see address poisoning. Got the link in a "Coinbase" text? See fake Coinbase texts and calls.
3. Check how old the domain is
- Paste the bare domain (for example
example.com, no "https" or path) into lookup.icann.org and read the creation date. (ICANN) - Compare it with what the site claims. The CFTC says a company that claims years in business on a domain registered a few weeks ago is a scam, and so are claims of millions of customers on a months-old site. (CFTC; DC DISB; Moneysmart)
- [Our advice: a new domain is a red flag, but an old one isn't proof. Old domains can be hacked or bought secondhand.]
4. Check that the company is registered where it must be
Find the legal company name in the site's Terms of Service or footer. Then look it up yourself:
- FinCEN MSB Registrant Search at fincen.gov/msb-registrant-search, for any platform that trades crypto for US customers. (FinCEN; CFTC; DC DISB)
- NFA BASIC at nfa.futures.org/basicnet, if it offers futures, options, forex or "contracts." Firms that offer these to US customers must register with the CFTC and be NFA members. (NFA; CFTC)
- Your state regulator. Many states have their own registration rules. In California, also search the DFPI Crypto Scam Tracker by name. (CFTC; DFPI)
- The address and phone. DC's securities regulator suggests checking that the street address is real on a map and that the phone number works. (DC DISB)
Registration isn't a safety rating. Michigan's attorney general notes that registration "isn't a guarantee that the exchange is safe or stable," and points out FTX was registered as a money transmitter. (Michigan AG; CFTC) [Our advice: don't trust a license number or regulator logo shown only on the site. Check it in the register yourself.]
5. Check what it's asking you to do
What the site wants from you tells you more than how it looks. Find your row:
| If it asks you to… | What that means | Go here |
|---|---|---|
| Type or import your seed phrase | Always a scam. No real site needs it | seed phrase phishing |
| "Connect wallet to claim" free tokens or an airdrop | Likely a drainer signature that hands over your tokens | airdrop claim scams · how drainers use approvals |
| Buy crypto somewhere else, then send it to them (no bank transfers accepted) | Classic fake crypto trading platform pattern (CFTC; DC DISB) | pig-butchering warning signs |
| Deposit more to earn a higher "guaranteed" return | Returns tied to how much you deposit are a fraud signal (CFTC; DC DISB) | Point 6 |
| Install a "beta" or "test" app, a web-clip app, or a configuration profile from a link | Beta apps skip normal app-store review (FBI IC3); DFPI entries describe installs via QR codes and profiles (DFPI) | Stop. Don't install |
| Pay cash at a Bitcoin ATM | Always a scam pattern | crypto ATM scams |
| Send to an address they pasted in chat | Check the full address. Lookalikes are common | address poisoning |
The FBI says criminals have built fake crypto investment apps using the names of real financial firms. (FBI) Only install from the official app store listing you found yourself.
6. Check whether you could actually leave
- Read the withdrawal rules before you deposit. Any fee, tax, "verification deposit," "VIP upgrade" or "anti-money-laundering deposit" required to withdraw means it's a scam. The FBI describes victims told to pay taxes or fees to cash out, who then lose that money too. (FBI IC3; IC3)
- A small test withdrawal proves nothing. In California's tracker, about 65 entries (roughly 10%) describe a small early withdrawal that worked before the big one was blocked. Treat that count as a floor; phrasing varies. (DFPI; method under checkers) More on why a small withdrawal doesn't prove it's real.
- Don't trust the balance. MetaMask says fake exchanges can show balances and trades that never happened. A fake crypto trading platform's dashboard is just a web page. (MetaMask)
- Remember crypto can't be clawed back. The CFTC notes blockchain transfers are irreversible and lack bank-style fraud protections, and the FTC warns crypto payments typically can't be reversed. (CFTC; FTC)
If the site says you must deposit to withdraw, that's the deposit-to-unlock withdrawal trick.
7. Check what others and the warning lists say, and what they miss
- Search the domain plus "scam," "fraud" or "reviews." Ignore the testimonials on the site itself. (CFTC)
- Check the lists: the DFPI Crypto Scam Tracker, the CFTC RED List of unregistered firms, and Chainabuse, a public scam-report database. (DFPI; CFTC; Chainabuse)
- If your wallet shows "Deceptive site ahead," don't connect. (MetaMask)
- But no warning doesn't mean safe. A crypto scam checker, free or paid, can only flag what's already on a list. See the next section.
Is a free crypto scam checker enough?
No. Use one as one signal, never the last one. Free checkers and wallet warnings mostly match a site against lists of known bad addresses. Fake platforms change domains fast: 393 of 645 California tracker entries (61%) say the site is gone, down or seized, and the CFTC says scam sites "disappear only to pop up again under a different brand and web address." (DFPI; CFTC)
Measured, 2026-10-28: On October 28, 2026, only 4 of about 800 fake crypto platform web addresses listed in California's DFPI Crypto Scam Tracker appeared on MetaMask's public phishing blocklist.
How we measured: we downloaded the tracker's 645 entries and pulled 804 hostnames from its Website column, then compared them with MetaMask's public eth-phishing-detect list (112,034 entries), matching the exact host or its main domain. Four matched (0.5%). Other counts on this page are keyword matches on the tracker's complaint text, not a coded study; the test-withdrawal count was hand-checked on a 20-entry sample. DFPI says it hasn't verified the losses complainants report. (DFPI; MetaMask list)
Limits: MetaMask's live protection can also draw on other services, so this measures only the public list. That list targets wallet phishing and drainers, while most tracker entries are fake trading platforms. The takeaway is that wallet phishing lists don't cover fake trading platforms well, not that any one wallet is bad.
Some checker tools say in their own fine print that a clean result isn't a guarantee. That's the honest reading: "no red flags found" means "not on our lists yet." Points 1, 5 and 6 catch what lists miss, because they test what the site is doing to you, not whether someone reported it. Address checkers have the same limit: see what free checks missed on real scam addresses.
[Our advice: if any "checker" or "helper" asks for your name and phone number and later contacts you offering to recover money, that's the second scam.]
What are you about to do? Pick your next page
| You're about to… | Points that matter most | Read next |
|---|---|---|
| Connect your wallet, sign, or "claim" | 2, 5, 7 | airdrop claim scams · token approvals |
| Send crypto to an address | 2, 5 | address poisoning |
| Deposit on an exchange or "trading platform" | 1, 3, 4, 6 | pig-butchering warning signs |
| Download an app | 2, 5 | Point 5 on this page |
| Call or chat with "support" | 1, 2 | fake wallet support |
| Type your seed phrase | Stop | seed phrase phishing |
| Pay cash at a crypto ATM | Stop | crypto ATM scams |
| Buy a hardware wallet from a store site | 2, 4 | where to buy a hardware wallet |
Out of scope here: auditing a token's smart contract or judging a coin's prospects. We don't make coin calls.
Already connected, sent or paid?
- Connected or signed, and funds are gone? Go to the first 30 minutes after a drain.
- Connected or signed, nothing gone yet? check and revoke token approvals now.
- Typed your seed phrase? Treat the wallet as compromised and follow the seed phrase steps.
- Sent money to a platform? Don't pay any withdrawal fee. Then report it in order, using the evidence template.
- Someone now offers to get it back? Read about recovery scams before you reply.
Frequently asked questions
How do I check if a crypto website is legit?
Run seven checks: how you got there, the exact address, the domain's age at lookup.icann.org, US registration (FinCEN MSB search, NFA BASIC), what the site asks you to do, whether withdrawals carry fees, and what scam trackers say. Stop at any seed-phrase request, withdrawal fee, or online "coach."
Is there a free crypto scam checker I can trust?
Free checkers can catch known scam sites, but a clean result only means the site isn't on their lists yet. On October 28, 2026, only 4 of about 800 fake-platform addresses in California's DFPI scam tracker were on MetaMask's public phishing blocklist. Use a checker as one signal alongside the seven checks.
How can I tell if a crypto exchange is legit?
Confirm the legal company is registered with FinCEN as a money services business and with your state, and type the exchange's address yourself. Registration isn't a safety guarantee (FTX was registered as a money transmitter), but an unregistered "exchange" that won't take a bank transfer is a red flag.
The platform let me withdraw a small amount. Does that mean it's real?
No. Scam platforms often allow a small early withdrawal to build trust, then block the large one. About 1 in 10 complaints in California's DFPI scam tracker describe a small withdrawal that worked before a bigger one was blocked.
The site says I owe a tax or fee before I can withdraw. Should I pay?
No. The FBI warns that fake platforms demand taxes or fees from people trying to cash out, and paying leads to more losses, not your money. Stop sending, save your records, and report it at ic3.gov.
Is a crypto site safe if it has https and a padlock?
No. The padlock only means the connection is encrypted. The FBI warns that criminals use https on phishing sites and says not to trust a website just because it has a lock icon.
Is a crypto app safe if someone sent me a link to install it?
Be very careful with any app that comes from a link instead of the official store listing, especially a "beta" or test app. The FBI warns that beta-testing apps skip normal app-store review and have been used to fake crypto exchanges.
I already connected my wallet or sent money. What now?
If funds left your wallet, follow our first-30-minutes checklist. If you sent money to a platform, don't pay any fee to withdraw. Report it in order, starting with ic3.gov.
What to do next
Before you connect your wallet or send crypto to a site you were sent: type the address in yourself, look up the domain at lookup.icann.org, and search the company at fincen.gov/msb-registrant-search. If it wants your seed phrase or a fee to withdraw, stop: it's a crypto scam. Already sent money? Report it in order, starting at ic3.gov, with your evidence template. Lost funds from your wallet? Our 30-minute checklist.
Get one crypto scam warning a week from Pause Before Send: join the newsletter.
No affiliate links, exchange referrals, coin calls or recovery-service referrals on this page, by policy. Tools and registers are named because the cited agencies point to them. We have no relationship with any scam checker, wallet or register named here.
Sources
- Commodity Futures Trading Commission, "10 Signs of a Scam Crypto or Forex Trading Website" (undated PDF). cftc.gov (accessed 2026-10-27)
- CFTC Investor Alert, "Watch Out for Fraudulent Digital Asset and 'Crypto' Trading Websites" (undated). cftc.gov (accessed 2026-10-28)
- CFTC, "RED List" (Registration Deficient list, living page). cftc.gov/redlist (accessed 2026-10-27)
- FBI IC3, "Cryptocurrency Investment Schemes" (PSA I-100322-PSA), 2022-10-03. ic3.gov (accessed 2026-10-27)
- FBI IC3, "Investment Fraud" (crime information page, undated). ic3.gov (accessed 2026-10-27)
- FBI IC3, "Cyber Actors Exploit 'Secure' Websites in Phishing Campaigns" (PSA I-061019-PSA), 2019-06-10. ic3.gov (accessed 2026-10-27)
- FBI IC3, "Cyber Criminals Targeting Victims through Mobile Beta-Testing Applications" (PSA I-081423-PSA), 2023-08-14. ic3.gov (accessed 2026-10-27)
- FBI, "Cyber Criminals Create Fraudulent Cryptocurrency Investment Applications to Defraud US Investors" (Private Industry Notification 20220718-001), 2022-07-18. ic3.gov (accessed 2026-10-28)
- Federal Trade Commission, "What To Know About Cryptocurrency and Scams" (undated consumer article). consumer.ftc.gov (accessed 2026-10-27)
- DC Department of Insurance, Securities and Banking, "Beware of Bogus Digital Asset Exchanges" (undated). disb.dc.gov (accessed 2026-10-27)
- California Department of Financial Protection and Innovation, "Crypto Scam Tracker" (living page; 645 entries downloaded 2026-10-28). dfpi.ca.gov (accessed 2026-10-28)
- Michigan Department of Attorney General, "What is a Cryptocurrency Exchange? Is It Safe?" (undated consumer alert). michigan.gov (accessed 2026-10-27)
- ASIC Moneysmart (Australia), "How to spot a scam website" (undated; cited for the domain-age method only). moneysmart.gov.au (accessed 2026-10-27)
- MetaMask Help Center, "Fake crypto exchange scams" (undated). support.metamask.io (accessed 2026-10-27)
- MetaMask Help Center, "'Deceptive site ahead' warning when connecting to a site" (undated). support.metamask.io (accessed 2026-10-27)
- MetaMask,
eth-phishing-detectpublic configuration (blacklist of 112,034 entries, snapshot 2026-10-28). github.com (accessed 2026-10-28) - Chainabuse, public scam-report database (living page). chainabuse.com (accessed 2026-10-27)
- ICANN, "Registration Data Lookup" tool. lookup.icann.org (accessed 2026-10-27)
- FinCEN, "MSB Registrant Search" tool. fincen.gov (accessed 2026-10-27)
- National Futures Association, "BASIC" registration search. nfa.futures.org (accessed 2026-10-27)
Changelog
- 2026-10-28: Added link to how to check a wallet address.
- 2026-10-28: Added links to task-scams guide.
- 2026-10-28: First published. Official links checked and the DFPI/MetaMask counts measured the same day.