Fake support scams: the anatomy

How the approach begins

The attack is reactive, and that is what makes it effective. Rather than cold-messaging at random, operators monitor the places people go when something has gone wrong: a project’s Discord server, a wallet’s Telegram group, replies under a company’s posts on X, and the review sections of app stores. When you post that a transaction is stuck, a balance looks wrong, or a swap failed, you have self-identified as someone who is anxious, wants a fast resolution, and is primed to accept help. Within minutes a direct message arrives.

The sender presents as official. The display name matches the project, the avatar is the real logo, and the bio may claim a support or moderator role. Some operators also run fake accounts that post a phone number or a help desk link in the channel so that a victim searching for support finds the scammer’s contact first. In every variant the common thread is that the contact is unsolicited relative to any official process: you did not open a ticket through the project’s own verified system, the project came to you. Coinbase, MetaMask, and others document this pattern across Discord and Telegram specifically because those platforms make impersonation easy, which is why MetaMask states it does not provide support over Telegram at all.

What the victim sees

From the inside, the experience is designed to feel like ordinary customer service. The agent is polite, uses the project’s vocabulary, and expresses sympathy about the problem. Frequently the victim is moved off the public channel, invited to a dedicated support group or a one-to-one chat, or handed a link to a help portal. This step matters to the attacker: it removes the victim from a space where other members might interject with a warning, and places the conversation in an environment the attacker fully controls.

The troubleshooting then proceeds through plausible-sounding steps. The agent may ask you to describe the issue, share your public address, or run a harmless-seeming action first to build trust. The tone is competent and unhurried until the final step, at which point a reason is introduced that requires the one thing that matters: your recovery phrase, or your signature.

What actually happens technically

Underneath the customer-service theatre, the payload is one of two things.

Seed-phrase capture. The agent asks you to verify, validate, restore, or re-sync your wallet by entering your twelve or twenty-four words, often into a form on the support portal or by pasting them into chat. As covered in wallet security guidance, the recovery phrase deterministically regenerates every private key in the wallet. The moment it is disclosed, the attacker imports the wallet on their own device and transfers everything out. Nothing about your device is compromised; the words alone are sufficient, and the theft can happen minutes or days later.

Malicious signature or approval. The more modern variant never asks for the phrase, because asking has become a known red flag. Instead the agent directs you to a site that prompts a wallet action: connect your wallet, then sign a message or approve a transaction to validate, claim, or unlock. The signature is in fact a token approval or a permit that authorizes a drainer contract to move your assets, or a transaction that transfers control outright. Security researchers document drainer kits and WalletConnect-based lures built precisely for this step; because you clicked approve, the transfer that follows is a valid, authorized transaction that the network will not reverse. Some drainers enumerate your holdings first and craft the request to sweep the most valuable assets.

In both paths the underlying deception is identical: a manufactured maintenance task, validation, synchronization, migration, or a stuck transaction, that does not exist in how wallets actually work, used to justify the one action that hands over control.

The tell

The reliable signal cuts through every variation and does not require you to evaluate how convincing the persona is. It has two parts, and either alone is enough to disengage:

• Unsolicited contact. Legitimate support responds to a ticket you opened through an official, verified channel. It does not DM you first because you posted in a group. As MetaMask and Coinbase state, support teams do not initiate private conversations.
• A request for a secret or a signature. No legitimate support process ever needs your recovery phrase, your private key, or a validation signature, because none of those is required to diagnose or fix any genuine problem. A request for any of them is conclusive proof of a scam.

Combined, the rule is memorable: real support never DMs first, and never needs your seed phrase or a validation signature. If an interaction has both properties, or even just the second, the identity of the sender is irrelevant.

Two secondary signals reinforce the primary tell. The first is pressure to move the conversation off the official platform, into a one-to-one DM, a separate support group, or a link to a portal. Legitimate support has no reason to relocate you away from a space where others can witness the exchange; the relocation exists to isolate you. The second is manufactured urgency, a warning that your funds are at risk right now, that a security hold expires shortly, or that you must act before a deadline. Urgency is the mechanism that suppresses the pause during which a victim would otherwise reconsider. Neither signal is necessary for the scam to work, but their presence alongside unsolicited contact should end the interaction on its own.

What to do if already caught

Speed matters, and the correct actions differ depending on which payload you encountered. If you are unsure which happened, assume the worse case, phrase exposure.

• Stop the interaction immediately. Do not send a further payment to unlock anything and do not sign or approve anything else. Escalating requests, an additional fee or tax to release funds, are the same scam continuing.
• If you revealed your recovery phrase or private key: treat that wallet as permanently compromised. Generate a brand-new wallet with a new phrase on a clean device and move any remaining assets to it as fast as possible. Do not keep using the exposed wallet; the attacker retains the keys forever, so anything sent back to it can be taken again.
• If you connected and signed something: disconnect the site, then review and revoke token approvals for the affected wallet using a reputable approvals-management tool. Move remaining assets to a fresh wallet, since a broad approval or a compromised smart-contract wallet can still be exploited later.
• Preserve evidence and report. Keep the messages, usernames, links, and transaction hashes. Report the impersonating account to the platform and the project’s real team, and file a report with the appropriate authority, in the United States the FBI’s Internet Crime Complaint Center and the FTC.
• Warn the channel. Because the scam feeds on public help requests, posting what happened helps others recognize the same approach.

The structural lesson is that this attack does not defeat any technology. It defeats the expectation that someone offering help is who they claim to be. Removing that assumption, by refusing unsolicited support contact and never disclosing a phrase or signing an unsolicited request, removes the attack.

Sources

• How Scammers Are Targeting Crypto Communities on Discord and Telegram (Coinbase)
• Basic safety and security tips (MetaMask Help Center)
• Crypto wallet drainers: how they work (Group-IB)
• FBI Internet Crime Complaint Center (IC3)
• Report fraud (U.S. Federal Trade Commission)