Official Wallsec emails only ever come from an @wallsec.co.uk address.

Fraud tactics · 9 min read

Common cryptocurrency scams in the UK and how the money moves

Short answer

The most common cryptocurrency scams reported in the UK are fake investment platforms, long-form romance and investment fraud, wallet drainers using malicious approvals, impersonation of banks, exchanges or police, fake job and task schemes, and advance-fee approaches made after a loss. Nearly all rely on urgency and on moving you to a private channel.

Most cryptocurrency losses reported in the UK follow a small number of repeated patterns. Recognising which one you are dealing with matters, because each moves funds differently and each leaves a different evidence trail. This guide covers the patterns we see most, in plain English.

Written and reviewed by the Wallsec investigations team · Last updated

Fake investment platforms

A website or app shows a growing balance that exists only in the operator's database. Deposits leave for operator-controlled wallets within minutes, and withdrawal is eventually blocked behind a fee, tax or compliance charge.

  • Usual asset: USDT, most often on Tron, because fees are negligible and settlement is instant.
  • Money movement: deposit address, rapid automated forwarding, consolidation with other victims' funds, then layering.
  • Preserve: platform URL and app download link, dashboard screenshots, deposit confirmations, all correspondence.

Relationship-led investment fraud

Contact begins socially and runs for weeks before money is mentioned. A small early withdrawal is permitted to build confidence, then deposits escalate. The pattern is covered in detail in our dedicated guide.

  • Money movement: identical to fake platforms, but spread across more payments over a longer period.
  • Preserve: full chat exports, profile photographs, any voice or video call records, and the sequence of payments with dates.

Wallet drainers and malicious approvals

Rather than asking for a transfer, the attacker obtains a signature. A token approval granted on a fake mint, airdrop or support page allows an address to move assets out of your wallet later, without any further action from you.

  • Money movement: direct sweep from your wallet to the drainer's address, often instantly and repeatedly.
  • Immediate step: revoke outstanding approvals and move remaining assets to a newly created wallet.
  • Preserve: the transaction hash of the approval, the site URL, and the wallet address involved.

Impersonation of exchanges, banks and support desks

A caller or message claims your account is compromised and instructs you to move funds to a 'safe' wallet. The wallet belongs to the caller. Numbers and sender IDs are frequently spoofed to match the real business.

  • Money movement: a single large transfer, usually followed within minutes by onward layering.
  • Preserve: the number or account that contacted you, call times, and the exact instructions given.
  • Rule of thumb: no legitimate exchange, bank or police force will ever ask you to move funds to a wallet they supply.

Giveaway, airdrop and cloned-brand schemes

  • A well-known name promises to return a multiple of anything sent. Nothing is ever returned.
  • Cloned websites and sponsored search results imitate real exchanges down to the domain spelling.
  • Preserve: the URL exactly as typed or clicked, the advert or post that led you there, and the payment record.

What to do in the first 24 hours

  • Stop all further payments, including any described as a release, tax or compliance fee.
  • Export wallet history, exchange statements and correspondence before access is removed.
  • Report it: Action Fraud in England, Wales and Northern Ireland; Police Scotland on 101 in Scotland. Keep the reference.
  • Notify the exchange or bank you funded from, and revoke wallet approvals if a site ever connected to your wallet.
  • Do not tell the other party you are investigating — it usually triggers immediate cash-out and account deletion.

If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.

Common questions

Which cryptocurrency scam is reported most often in the UK?
Fake investment platforms, including relationship-led variants, account for the majority of losses reported to us. They share a structure: a dashboard balance that is not real, and deposits that leave for operator wallets within minutes.
Why was I asked to pay a fee before withdrawing?
Because the balance shown is a database entry rather than money held for you. Fees exist to extract further payments, and each one paid tends to produce another demand.
My wallet was emptied without me sending anything. How?
Most likely through a token approval you signed on a fraudulent site, which lets another address move assets out later. Revoke outstanding approvals and move any remaining assets to a newly created wallet.
Can these losses be traced?
The transfers are permanently recorded and can be followed to a terminal point such as an exchange deposit address, a bridge or a dormant wallet. Tracing establishes the route funds took; it does not reverse transfers or identify individuals from ledger data alone.
This guide is general information, not legal or financial advice. Wallsec does not hold, handle or return client funds. We provide investigative and reporting services only, and no report can guarantee an outcome.

Have a case you want reviewed?

We scope at intake and tell you honestly whether the onchain data supports a traceable case.

Request a case review

Related guides