Crypto Scams: How Fake Investments and Wallet Tricks Work

What a crypto scam usually looks like

Most crypto scams in Pakistan reach people the same way. A stranger messages you on WhatsApp, Telegram or social media. You see a screenshot of large profits, or a "mentor" offers to help. Then you are asked to send money to a platform or connect a wallet.

Crypto fraud is hard to reverse. A blockchain transfer cannot be cancelled like a card payment. Once coins leave your wallet, getting them back depends on the receiving party, and scammers do not return funds.

The SECP has described this pattern in its public warnings: SECP warnings by press release naming platforms (Quotex 09.04.2025; IBKR look-alikes, IGIL Securities, BMA Capital No.108 etc. 22.05.2025; Hillhouse Capital, S-169 Wharton 13.01.2026), none of which names Exness. Its releases say: "The SECP regularly cautions the general public to remain vigilant against such illegal investment and trading platforms, which are often promoted through WhatsA…"

For the general red flags that apply to any investment, see Scam Warning Signs.

Fake crypto exchanges and investment platforms

A fake crypto investment platform looks like a real exchange or trading site. It has a login page, a balance and charts. The balance is just a number in the scammer's database, not money you hold.

The usual sequence:

• You make a small deposit and see fast "profits".
• A small withdrawal may be paid to build trust.
• You are encouraged to deposit more, often through a "VIP" or "upgrade" plan.
• When you try to withdraw a larger amount, you are told to pay a "tax", "unlock fee" or "verification fee" first.
• After that payment, the account is frozen or the site disappears.

A demand to pay before you can withdraw is a strong sign of fraud. Some scam sites copy the name and design of a real company. Clone Sites and Fake Apps explains how to spot copies. Guaranteed Profit Claims explains why fixed daily returns are not realistic.

Rug pulls

A rug pull happens when the people behind a new token or project take the money and abandon it. The token is promoted heavily, buyers push the price up, and then the creators sell their holdings or drain the liquidity pool. A liquidity pool is the pot of coins that lets people trade a token on a decentralised exchange. Once the pool is drained, the token cannot be sold at any meaningful price.

Common signs:

• An anonymous team with no verifiable history.
• Pressure to buy before a "launch" or "listing".
• Most of the token supply held by a few wallets.
• Code that blocks selling, or lets the owner create new tokens at will.
• Returns promised for bringing in new buyers. This overlaps with Ponzi and Pyramid Schemes.

Airdrop phishing

An airdrop is a free distribution of tokens to wallet holders. Scammers use fake airdrops as bait. You receive an unknown token, or a message saying you have "rewards to claim". The link leads to a site that asks you to connect your wallet or type your recovery phrase.

The recovery phrase (also called a seed phrase) is the master key to your wallet. Anyone who has it can take everything. No genuine exchange, wallet or support agent will ever ask for it. Do not enter it on any website, form or chat.

If an unknown token appears in your wallet, do not interact with it, and do not visit the website written in its name. Phishing and Fake Logins covers fake login pages in more detail.

Approval exploits

When you use a decentralised app, your wallet often asks you to "approve" a smart contract to spend a token. An approval is a permission. It is not a transfer, so many people sign approvals without reading them.

A malicious contract can ask for unlimited spending rights. Later, it can move that token out of your wallet at any time, without asking again. Some scam sites also ask you to sign messages that look harmless but grant transfer rights.

To reduce the risk:

• Read every wallet prompt. Check which contract is asking and for how much.
• Avoid unlimited approvals where your wallet lets you set a limit.
• Review and revoke old approvals regularly using your wallet's own tools or a well-known approval checker.
• Keep a separate wallet with small balances for new apps.
• Turn on extra login protection on exchange accounts. See Two-Factor Authentication.

What Pakistani regulators say about offshore platforms

Pakistan's securities and futures supervisor is the Securities and Exchange Commission of Pakistan (SECP), with trading in listed securities and commodities only via SECP-licensed securities and futures brokers. In its words: "In Pakistan, trading in securities of listed companies and commodities can only be carried out through SECP-licensed securities and futures market brokers."

On offshore trading sites, per the SECP, offshore forex/CFD platforms operate without regulatory approval in Pakistan. Also, per the SECP, offshore platforms have no Pakistani licence or oversight and offer no legal protection or recourse. In practice, a Pakistani regulator cannot help you recover money lost on such a site.

The law sets a licensing rule: under the Futures Market Act 2016, s.47(1), no one may carry on a regulated activity (futures broker, adviser, representative) without an SECP licence. The penalty is set out as well: under the Futures Market Act 2016, s.104(3), operating without a licence carries, for an individual, a fine of up to PKR 250 million or up to 3 years' imprisonment, or both.

The State Bank of Pakistan (SBP) has also addressed payments. On this point, the rule is that per the SBP, remitting foreign exchange to overseas forex/margin/CFD platforms is not allowed through any payment channel (FERA s.5(1)).

These statements are about forex, margin and CFD platforms, including crypto CFDs. Crypto CFDs are contracts on crypto prices, not coins you own. They are leveraged, so losses can be fast and can exceed what you expected to risk. See Crypto CFDs and Law and regulators.

How to check a platform before you pay

• Search the exact company name together with "SECP warning". Read the regulator's own release, not a repost.
• For brokers in Pakistan, per the SECP, lists of licensed brokers are on the PSX and PMEX websites. Use the official lists, not a link someone sends you.
• For a foreign firm, check the regulator's register yourself. See Verify a Broker and Other Regulator Registers.
• Type website addresses yourself instead of following links.
• Install apps only from official app stores, and check who the publisher is.
• Treat any "account manager" who trades for you as a risk. See Managed Account Risks.

The Broker Checklist puts these steps in order.

If you have already been scammed

• Stop sending money. Paying a "release fee" does not unlock your funds.
• Save the evidence: transaction IDs, wallet addresses, chats, website addresses and screenshots.
• Contact your bank or the exchange you sent from straight away.
• Report the case. Report a Scam explains where to go.
• Ignore anyone who offers to recover your crypto for an upfront fee. See Recovery Scams.

Frequent questions

What are the most common crypto scams in Pakistan?

Fake exchanges and investment apps promoted through WhatsApp and Telegram, fake signal groups, romance investment scams, rug pulls and airdrop phishing. See Fake Signal Groups and Romance Investment Scams.

Can stolen crypto be recovered?

Usually not. Blockchain transfers cannot be reversed by your bank. Report the case quickly, and do not pay anyone who promises recovery.

Is a token in my wallet that I did not buy dangerous?

It can be. Do not try to sell it, and do not visit any site linked to it. Interacting with it may trigger a malicious approval.

Does the SECP protect money on offshore platforms?

No. Per the SECP, offshore platforms have no Pakistani licence or oversight and offer no legal protection or recourse.

Should I ever share my seed phrase?

No. Anyone who asks for it, including someone claiming to be support staff, is trying to take your funds.