Your withdrawal is stuck. You post a complaint on X or a Telegram group, and within ten minutes someone sends you a friendly direct message: "Hello, I'm from support, how can we help?" It feels fast and caring. It's also one of the most common ways people lose their entire balance.
Scammers don't need to hack an exchange. They wait for frustrated users to announce a problem in public, then pose as the help desk. This guide shows you how to find an exchange's real support channels before you need them, how to test a "support agent", and what to do if you've already replied to one.
Why fake support works so well
The trick relies on timing. You're stressed, you want a quick answer, and the person contacting you appears to know your problem because you described it publicly. Nothing about that is magic. They simply read your post.
Once you're talking, the script is usually the same. They ask you to "verify your account", then send a link, request a code, ask you to share your screen, or tell you to type your recovery phrase into a "validation tool". Every one of these ends with your funds moving to a wallet you don't control.
Crypto transfers can't normally be reversed. If you hand over access, there's rarely a way back, which is why prevention matters more than any later complaint.
The one rule that stops most of these scams
Real support never needs your password, 2FA code, email code, or seed phrase. Not for verification, not for "unfreezing", not for an upgrade. If anyone asks for these, the conversation is over, no matter how professional the logo looks.
A second rule: real support doesn't start conversations with you in direct messages because you complained in public. Some companies do reply publicly under a post, usually telling you to open a ticket inside the app. They don't move you to a private chat and ask for access.
Step by step: build your verified contact list today
Do this while everything is working. It takes about 15 minutes per exchange.
- Open the app you already use. Look for Help, Support, or Contact us inside the logged-in app. This is the safest route, because you're not relying on a link from a stranger.
- Find the official website by typing it yourself. Don't click ads. Search results can carry paid ads that copy real sites. Better still, use a bookmark you created from the app.
- Cross-check the social links. On the official site's footer, find the links to its social accounts. Then confirm that the account you'd follow matches what the site lists, not the other way round.
- Save the ticket method. Most exchanges handle serious issues through a ticket or in-app chat tied to your account. Write down how it works for your exchange.
- Bookmark and note it. Save the support page in your browser in a folder called "Crypto official". Keep the exact web address in your phone notes too.
- Check what the platform says about itself. Look in the terms and help pages for a statement on how support contacts users and what it will never ask for.
If you use more than one platform, repeat this for each. Also read each platform's withdrawal rules before depositing, which we cover in Read an Exchange's Withdrawal Terms Before You Deposit.
How to spot an impostor: a side-by-side check
| Check | Usually genuine | Warning sign |
|---|---|---|
| How contact starts | You open a ticket or chat inside the app | A stranger messages you after you posted a complaint |
| What they ask for | Ticket number, transaction hash, screenshots of errors | Password, codes, seed phrase, screen sharing |
| Links | Official domain you already have bookmarked | Shortened links, odd spellings, extra words in the web address |
| Tone | Calm, no deadline | "Act in 30 minutes or your account will be closed" |
| Payment | No fee to get your own money back | "Release fee", "tax clearance", "verification deposit" |
| Account name | Matches the link from the official site | Look-alike name, a few followers, new account, or a personal number |
| Channel | Official email domain or in-app message | WhatsApp number, Gmail address, or personal Telegram handle |
A hypothetical example
Suppose Tunde, a freelancer in Ibadan, withdraws the equivalent of ₦300,000 in stablecoins and it doesn't arrive after two hours. He tweets that the exchange is "stealing his money".
A profile with the exchange's logo and the word "Support" in its name sends a message: "We see your case. Please click this link and sign in to verify." The link opens a page that looks identical to the login screen.
What Tunde should do: don't click. Open the app directly and check the transaction status. Copy the transaction hash, look it up on a block explorer, and see whether the transfer was sent. Then open an in-app ticket with the hash and the destination address. Often the delay is a network issue, a wrong network choice, or a review hold, none of which a stranger can fix.
If Tunde had signed in on that fake page, the scammer would have captured his email and password, and maybe a live 2FA code to log in before it expired. That's how a delayed withdrawal becomes an empty account.
Common mistakes
- Trusting the blue tick. Verification badges can be bought on some platforms, and look-alike accounts copy logos perfectly. Check the account against the official website, not the badge.
- Joining "official" groups from search results. Telegram and WhatsApp groups often have fake admins who message members privately. Admin DMs asking you to "report your issue" are a red flag.
- Calling numbers from Google ads or social posts. Use only contact details from inside the app or the site you typed yourself.
- Posting screenshots with details. Account IDs, email addresses, wallet addresses and balances give scammers material to sound convincing. Blur or crop them.
- Installing remote-access apps. If anyone asks you to install software that shares your screen, refuse. They can then see codes and approve transfers.
- Paying to "unlock" funds. A genuine hold may need documents. It doesn't need a fee sent to a personal account or wallet.
Lock down your account so a mistake costs less
Assume that one day you'll be rushed and make a poor choice. Set things up to limit the damage.
- Use an authenticator app instead of SMS codes where the exchange allows it. SMS is exposed to SIM swap, which we explain in SIM Swap and Email Takeover: Securing Your Crypto Accounts.
- Enable an anti-phishing code if the exchange offers one. It places a personal word in genuine emails, so a fake email lacks it.
- Turn on withdrawal address whitelisting if available, so funds can only go to addresses you've pre-approved. Many platforms add a delay when you add a new address.
- Keep only what you're actively trading on the exchange. Longer-term holdings are better in a wallet you control, as we compare in Exchange Account or Self-Custody Wallet? A Decision Checklist.
- Use a separate email address only for crypto, with its own strong password and 2FA.
If you already replied to a fake agent
Move quickly, and in this order:
- Stop talking to them. Don't argue and don't send more information.
- Change your email password first, then your exchange password, from a device you trust. Sign out of all other sessions if the app offers that.
- Reset 2FA and remove any new devices or API keys you don't recognise.
- Contact the real support through the in-app route you verified earlier, and ask them to restrict withdrawals temporarily.
- If you shared a seed phrase, create a new wallet and move what's left immediately. Any wallet whose phrase someone else saw is compromised for good.
- If you paid from a bank account, call your bank through the number on your card or in its official app, and report it right away.
- Save evidence: screenshots, usernames, wallet addresses, transaction hashes. Then follow the reporting steps in our guide on fake crypto recovery agents, because victims often get a second wave of "recovery" offers.
Frequently asked questions
Can I trust a support agent who already knows my name and email?
No. Those details can come from your public posts, a data leak, or earlier phishing. Knowing information about you proves nothing. What matters is how the contact started and what they ask you to do.
Is WhatsApp support ever real?
Some companies do use it, but only for numbers listed on their official site. If the number came from a comment, a group, or a message sent to you, treat it as unverified.
What if the real support is slow?
Slow is annoying, but it isn't dangerous. Open one ticket, add the transaction hash and screenshots, and wait for a reply in the same ticket. Opening many tickets usually slows the queue.
Should I name and shame the exchange publicly?
You can, but remove personal details and expect impostors to reply. Say clearly in your post that you will only deal with support inside the app.
How do I know the exchange itself is legitimate?
That's a separate question from fake agents. Check its regulatory status with the relevant regulator, read its terms, and test with a small amount first. Rules in Nigeria have changed several times, so rely on official sources and not on social media claims.
Your next step
Tonight, open each crypto app you use and write down the official support route and website in a phone note. Then tell one friend who trades to do the same. Ten minutes now is cheaper than a rushed reply later.
This article is for general information only and is not financial, legal, or tax advice. Prices, rates and rules change quickly, so check current details before making money decisions.