Updated Rules checked 2026-10-12
Most scams involving crypto exchanges fall into five types: fake apps and phishing sites, fake customer support, fake referral codes and fake rebates, signal groups and fake investment platforms, and scams that make you pay an “unfreeze fee” or a “deposit,” or pay someone to “recover your funds.” Whether the scammer borrows the name of Binance, OKX or Bitget, it always ends up on one of two paths: getting you to leave the exchange’s official website and app, or getting you to pay first and hand over your password and verification codes.
The quickest check is the URL. A legitimate referral link stays on the exchange’s own official domain when you open it, and the referral code is just a field on the sign-up page. Nothing is charged. The official help pages of Binance, OKX, Bitget, MEXC and BingX all state that support staff won’t message you privately to ask for your password or two-factor authentication code, and won’t ask you to move assets to some address.
Below, I go through how each type works, the giveaways you can spot and what to do, and finish with the official domains, app developer names and official verification tools of 13 exchanges.
Key points: According to Taiwan’s National Police Agency (NPA), there were 197,595 fraud cases in 2025 (ROC year 114), of which 58,675, or 29.69%, were investment fraud, the largest category. A legitimate referral link always lands on the exchange’s official domain, and the referral code is just a field on the sign-up page; you never pay or hand over account details. OKX states that the invitee rebate range is 0%–20%, so a promised rebate above an exchange’s published cap is a warning sign. A frozen withdrawal that you can only release by first paying an “unfreeze fee” or “deposit” is a scam pattern named by both Taiwan’s Financial Supervisory Commission (FSC) and the Criminal Investigation Bureau (CIB); HTX states that appealing a withdrawal restriction is completely free. Lawyers, hackers or blockchain analysts who claim they can recover the money you lost are running a second scam, and the CIB explains that lawyers cannot recover funds on their own.
The information below was checked against official pages on 2026-10-12 (fact-check date) and is provided for reference.
What are the main types of crypto exchange scams? 5 types in one table
| Type | Common opening | Key giveaway | What to do |
|---|---|---|---|
| 1. Fake apps / phishing sites | Search ads, links in text messages, “login guide” pages | Misspelled domain or not the official domain; the app developer name doesn’t match | Type the URL yourself or use a bookmark; download the app through the link on the official website |
| 2. Fake support | LINE, Telegram, social media DMs, calls saying something is wrong with your account | They message you first, ask for passwords or codes, ask you to transfer funds or share your screen | Only use the live chat inside the official app or website; check accounts with the official verification tool |
| 3. Fake referral codes / fake rebates | “Super-high rebates,” “pay an activation fee first to claim” | The rate exceeds the exchange’s published cap; you have to pay or buy a membership first | Check the sign-up page domain and the referral code field; compare with the official cap |
| 4. Signal groups / fake investment platforms | Investment groups, trading “mentors,” screenshots of small profits | They want you to send USDT to a “platform” outside the exchange; after you put in a large amount, you can’t withdraw | Copy trade only inside the exchange’s own app; never send crypto to individuals or unknown platforms |
| 5. Unfreeze fees, deposits, fund recovery | “Your account is frozen, pay a deposit,” “a lawyer or hacker will get it back for you” | You must pay before you can withdraw; recovery is guaranteed | Stop paying; in Taiwan, call the 165 anti-fraud hotline and report to the police (elsewhere, contact your local police or national fraud reporting service) |
Investment scams are a big problem in Taiwan. An NPA statistics bulletin states that there were 197,595 fraud cases in 2025, with “investment fraud” the largest category at 58,675 cases, or 29.69%, and investment fraud was also the most common type for victims in every age group from 24 up. In Q4 2025 there were 11,581 investment fraud cases, 52.65% fewer than in the same quarter a year earlier, but it was still the category with the most cases (NPA Police Statistics Bulletin, week 14 of ROC year 115, 2026-04-01).
How do you spot a fake app or phishing site?
How it works: scammers build a login page or app that looks just like the exchange’s, get you to enter your account, password and verification codes, then use them to log in and move your assets out. Binance warns that phishing sites often show up in search results, browser extensions, third-party apps and emails, and that before logging in you should confirm the domain is binance.com and the URL starts with https:// (Binance on URL spoofing). When I searched login-related terms for Bybit and HTX on 2026-10-12, the results already included “login guide” pages hosted on subdomains of free website builders, with an extra letter in the brand name.
Text messages get spoofed too. OKX explains that the sender name of a text message can easily be faked, and fake messages can even appear in the same thread as genuine OKX notifications. They usually talk about account problems, claiming rewards or security checks, and include a link or ask you to call back a “support number.” OKX recommends verifying only through the app or https://www.okx.com/ (OKX on SMS impersonation, updated 2026-08-26). Bitget also states that most of its official text messages contain no links, and that its app can only be downloaded from Google Play, the App Store or the official Bitget website (Bitget anti-phishing notice).
An easy-to-miss giveaway: the app developer name. I checked the listings on the Taiwan App Store and Google Play. Of the 13 exchanges, 12 have listing pages on both stores, and 8 of those 12 show different developer names on iOS and Android. For example, MEXC’s iOS developer is Onechain Technology Ltd, Pionex’s iOS developer is BitUniverse CO.,Limited, and HTX still shows its old name, Huobi, as the developer on Google Play. So a developer name that isn’t the exchange’s brand name doesn’t by itself mean the app is fake; compare it with the table at the end of this article. If the name is close but doesn’t match, don’t install it. Search ranking isn’t proof either: when I searched for Ourbit on the App Store, the top results included apps with similar names that have nothing to do with the exchange.
- To log in, type the URL yourself or use a bookmark; don’t click links in text messages, emails or ads.
- Go to the app store from the download page on the exchange’s official website, then check the developer name again.
- Turn on an anti-phishing code: official emails from Binance, OKX, Bybit and Bitget include a code you set yourself, and Bybit states that if the code is missing or wrong, the email or text message is very likely a scam (Binance on the anti-phishing code, Bybit on spotting spoofed emails, updated 2026-08-02).
Will exchange support contact you on LINE or Telegram?
How it works: the scammer first reaches you through a social media post, an exchange’s official group, or when you search for a support phone number. They then message you privately, say something is wrong with your account and that you need to go through a “verification” or “upgrade,” and walk you into handing over verification codes, sharing your screen, installing remote-access software, or moving your assets to a “safe account.” Some claim to be partners of the exchange and invite you into groups. OKX states that people have falsely claimed to work with OKX and called users to invite them into WeChat and Telegram groups; OKX has never authorized any third party to contact users by phone or through groups, and any call claiming to be from OKX is a scam (OKX on phone scams, updated 2026-09-22). Taiwan’s CIB puts it bluntly: if someone asks you to add them on LINE to invest, it is always a scam (CIB common scam tactics: fake investments).
Here is what each exchange officially says about its support channels:
| Exchange | Official support channels | What it officially says it won’t do | Source |
|---|---|---|---|
| Binance | Support only on the official website | Won’t message you on Telegram; any call claiming to be Binance is a scam; won’t ask for sensitive information or ask you to transfer to any address | Fake calls, Telegram impersonation, Scam prevention |
| OKX | Contacts users only through in-app voice calls | Doesn’t call mobile numbers, send text messages or use outside platforms to contact you; never asks for passwords or verification codes | Phone scam prevention |
| Bybit | Live chat in the Help Center or the web form | Won’t ask you to send funds to an unknown deposit address; won’t ask for your wallet seed phrase | Spotting spoofed emails |
| Bitget | Live chat in the Help Center | Never asks for passwords, 2FA codes or private keys; won’t message you first asking for personal information or funds | What to do after a scam, Verifying official channels |
| MEXC | Official website mexc.com | Won’t message you first asking for transfers, verification codes or private keys; never asks for passwords, SMS codes or Google Authenticator codes | MEXC Verify guide (2026-09-07) |
| Gate | Not stated officially | Support never asks for passwords, verification codes or 2FA codes | Anti-phishing guide |
| BingX | Live chat on the platform or the official support portal | Never asks for passwords, 2FA codes or private keys; never asks you to share your screen or install remote-access software | Identifying official support |
| HTX | In-app Help Center, [email protected] | Appealing a withdrawal restriction is completely free; any fee is a scam | HTX anti-fraud channel announcement (2025-10-16) |
| WEEX | Not stated officially | Official group admins won’t message you privately or ask you to transfer funds; support never asks for Google Authenticator codes, SMS codes, ID documents or card details | WEEX on spotting impersonators |
| Pionex | Live chat on the official website | Warns that people impersonate its official Telegram accounts | Pionex scam prevention |
I couldn’t find a complete description of support channels on the official pages of KuCoin, XT and Ourbit, but all three have official verification pages for checking accounts; see the table at the end. If a “support agent” messages you, run them through the official verification tool first, and block them if they don’t show up.
How can you tell a fake referral code or fake rebate?
Start with what a real referral rebate looks like: the referral link opens a sign-up page on the exchange’s official domain with the referral code already filled in, and the exchange pays the rebate back out of the fees you pay later. You don’t pay anything up front. The rate also has a cap: OKX states that the invitee rebate range is 0%–20% (OKX affiliate FAQ, updated 2026-09-15), and Binance states that an affiliate can share at most 20% with invitees (Getting started with the Binance Affiliate Program). Official caps for other exchanges are collected in the exchange referral rules dataset.
Fake rebates usually take one of three forms: the promised rate is above the exchange’s published cap; you have to pay an “activation fee” or “membership fee” or buy VIP status before you can claim; or they want your account password or an API key with withdrawal permission so they can “set it up for you.” Binance has described one of these: a scam site that requires you to upgrade to VIP membership to receive rewards, and lures you into sending crypto with “a discount for paying in USDT, 10% back” (Binance crypto scam warning). MEXC also warns that scammers first send small “rebates” to build trust, then steal funds on a large scale (MEXC on investment transfer scams).
Does “pay first to get rebates” ever make sense? For regular OKX users the futures taker fee is 0.05%, and the invitee rebate cap is 20%, so every 10,000 USDT of volume returns at most 10,000 × 0.05% × 20% = 1 USDT. If someone asks you to pay a 100 USDT “activation fee,” you would need 100 ÷ 1 × 10,000 = 1,000,000 USDT of taker volume just for the rebates to cover it. Real referral rebates never charge this fee in the first place; anything that charges you isn’t an exchange rebate.
Fee rate from the OKX futures fee calculation guide (Lv1 taker 0.05%). It’s normal for a rebate site to ask for your exchange UID: a UID is only an account number, and nobody can log in with it. Never give anyone your password, verification codes or withdrawal permissions. For more detail, see rebate scam warning signs; to confirm after sign-up whether your referral code was bound, see how to check whether your referral code is bound.
How do signal groups, copy-trading scams and fake investment platforms work?
The CIB lays out the process like this: scammers meet you through online communities or dating apps and pull you into a LINE investment group. At first they let you make small profits, then use “the more you put in, the more you make” to lure you onto an investment website or into downloading an app and putting in a large sum. After that they refuse withdrawals with excuses such as insufficient turnover volume, a required deposit or IP anomalies, and in the end the account is frozen or the website shuts down (CIB common scam tactics: fake investments). The US FBI adds that most of the “happy students” in these groups are actually scammers playing a role (FBI IC3 on investment fraud).
In this process, exchanges are often used as the on-ramp. The steps the FBI describes: open an account at a legitimate exchange, deposit from your bank, buy a specified coin (USDT, for example), then withdraw it to the “investment platform” the scammer gives you. The damage is done the moment the money leaves the exchange and goes to that address, so the thing to watch is the address you’re withdrawing to. OKX lists the same pattern: a scam platform first shows some profit, waits for you to put in a large amount, then refuses withdrawals because your “credit score is too low and you must pay a fee first” or demands another deposit (OKX common scam tactics, updated 2026-09-07).
- Real copy trading happens inside the exchange app: OKX, Bitget and BingX all have copy trading in the menus of their official sites. Your funds stay in your own account, and you never need to send USDT to a trading mentor or another website. Futures copy trading still uses leverage, and if the market moves against you, the position may be liquidated.
- Check the domain: if the “platform” URL isn’t one of the 13 official domains at the end of this article, and they want you to withdraw crypto from an exchange to it, stop right there.
- Check with 165 (Taiwan): Taiwan’s 165 anti-fraud website and the “165 anti-fraud awareness” LINE official account let you look up scam LINE IDs, fake investment websites and scam phone numbers (same CIB page as above). Outside Taiwan, check with your local police or national fraud reporting service.
What are “unfreeze fee,” “deposit” and “we’ll get it back for you” scams?
This is how a fake investment platform wraps up, and how a second scam begins. Taiwan’s FSC warns that scammers ask for unfreezing fees, deposits or taxes that must be paid before you can withdraw (FSC press release, 2025-09-22). The FSC’s financial literacy site states that a common tactic is to set up a fake exchange and, when people try to withdraw, demand a deposit citing anti-money-laundering or tax rules (FSC financial literacy site, updated 2025-04-21). Real exchanges have impersonation versions too: HTX announced that people were posing as its staff and charging fees to “lift withdrawal restrictions,” and stated that appeals can only go through the in-app Help Center or the official support email, and are completely free (HTX anti-fraud channel announcement, 2025-10-16). The FBI’s advice: if you have already invested, don’t pay any more fees or taxes to withdraw (FBI IC3 announcement, 2023-03-14).
After you’ve been scammed, the next wave is “fund recovery.” On 2026-01-31 the CIB published a case: a pharmacist lost TWD 800,000 on a fake investment app. After searching online for “recover scammed funds,” she met people claiming to be an international lawyer and a blockchain analyst, who said they could manipulate a gambling site’s back end to help her “win it back.” She handed over TWD 1,150,000 in cash in person, converted into Tether (USDT), then borrowed another TWD 500,000 to add more, and was about to mortgage her home when staff at the land office noticed and called the police (CIB announcement). Added up, the TWD 1,150,000 + 500,000 = 1,650,000 she put into the second scam was more than twice what she lost the first time.
The CIB explains that a lawyer can only act as a litigation representative, has no public authority and cannot recover funds on their own. After a scam, you should report it right away; the police will notify financial institutions to freeze suspicious funds or flag accounts as alert accounts, and the money can only possibly be recovered through an incidental civil action after a guilty verdict in the criminal case. The FBI also advises against paying services that claim they can recover your losses. Bitget states that an exchange cannot directly recover funds transferred out in a scam, but can assist investigations after a formal request from law enforcement (Bitget on what to do after a scam).
Related reading: if an exchange really has frozen your account, the official appeal routes are in What to do when an exchange freezes your account; if you are told to pay before you can withdraw, see Paying to withdraw is a scam; before buying on P2P, read How to buy USDT on P2P safely.
What should you do if you’ve been scammed?
- Stop paying: don’t pay any more unfreeze fees, deposits, taxes or “recovery service fees.”
- Secure your account: through the official app or a website URL you typed yourself, change your password, reset two-factor authentication, and delete any API keys and login devices you don’t recognize; change your email password too (the steps Bitget recommends).
- Keep evidence: chat logs, the other party’s accounts, URLs, transfer times and amounts, receiving addresses and transaction hashes (TXIDs).
- Report it: in Taiwan, call the 165 anti-fraud hotline or check and report on the 165 anti-fraud website. The sooner the better, so the police can notify banks to freeze the funds. If you’re outside Taiwan, contact your local police or your country’s national fraud reporting service.
- Contact the exchange: use only the live chat inside the official app or website, not a support number or social media account you found by searching. Bitget states that it may temporarily freeze the account during an investigation to prevent further losses.
- Don’t look online for someone to get it back: anyone claiming to be a lawyer, hacker or blockchain analyst who can recover your money is the next scam.
Official domains, app developers and verification tools for 13 exchanges
The developer names below are what I found on the Taiwan App Store and Google Play listing pages on 2026-10-12. Store data can change at any time, so before downloading, go by the store page that the exchange’s official download page links to. A “verification tool” is a page run by the exchange itself where you can enter a URL, email address, phone number or social media account to check whether it’s an official source.
| Exchange | Official domain | App Store developer (Taiwan) | Google Play developer (package ID) | Official verification tool |
|---|---|---|---|---|
| Binance | binance.com | Binance Switzerland AG | Binance Inc. (com.binance.dev) | Binance Verify |
| OKX | okx.com | OKX Inc. | OKX INC. (com.okinc.okex.gp) | Official channel verification |
| Bybit | bybit.com | Bybit Fintech Limited | Bybit (com.bybit.app) | Authenticity Check |
| Bitget | bitget.com | BG LIMITED | BG LIMITED (com.bitget.exchange) | Official verification |
| MEXC | mexc.com | Onechain Technology Ltd | MEXC Ltd (com.mexcpro.client) | MEXC Verify |
| Gate | gate.com (changed from gate.io to gate.com in May 2025) | GATE GLOBAL UAB | Gate.com (com.gateio.gateio) | Official verification |
| BingX | bingx.com | BingX Group Limited | BINGX GROUP LIMITED (pro.bingbon.app) | BingX Verify |
| KuCoin | kucoin.com | KuCoin Pro (seller: Kugame Global Limited) | Kugame Global Limited (com.kubi.kucoin) | Official Verification Center |
| HTX | htx.com | Not found in the Taiwan store | Huobi (pro.huobi) | No public verification tool found |
| XT | xt.com | XT LTD, LLC | XT.COM Inc. (com.app.xt) | Official verification page (checks official email addresses) |
| WEEX | weex.com | Weex Virtual Currency Exchange LLC | WEEX PRO (com.wake.weexprd) | Contact Verifier |
| Pionex | pionex.com | BitUniverse CO.,Limited | Pionex (com.pionex.client) | Pionex official channel verification (checked 2026-10-15) |
| Ourbit | ourbit.com | Ourbit Holdings Ltd | Ourbit (com.ourbit.client) | Official verification |
Domains are based on each exchange’s official pages: MEXC states that its only official website is https://www.mexc.com, Bitget states that you should trust only www.bitget.com, and Binance recommends confirming that the SSL certificate belongs to *.binance.com or *.binance.net (Binance scam prevention); for Gate’s domain change, see the Gate new domain announcement. The contact emails listed on the App Store and Google Play pages are all under the exchange’s domain or its group’s domain (huobigroup.com for HTX, weexglobal.com for WEEX), which is one more thing to check. Bybit warns that even when a verification tool says “official,” the sender of an email or text message can still be spoofed, so check the anti-phishing code as well.
You can run the same check on any referral link, including this site’s Binance referral code and OKX referral code pages: after opening the link, check that the domain in the address bar is the official domain in the table above and that the referral code field shows the code you expect, then start signing up.
FAQ
Is a “Binance scam” Binance itself scamming people?
What people online call a “Binance scam” is usually fake support, fake websites, fake apps or fake investment groups using Binance’s name, not trades that happen on binance.com. To check, confirm the domain and run any suspicious URL, email address, phone number or Telegram account through Binance Verify. Also keep in mind that the FSC’s financial literacy site states that virtual asset trading platforms are not institutions established with the approval of Taiwan’s FSC, so you need to assess the risks yourself before trading.
OKX called to say something is wrong with my account. Is it real?
No. OKX states that its official support contacts users only through the in-app voice feature and won’t reach out by mobile phone call, text message or outside platforms, and that any call claiming to be OKX is a scam. Hang up, then open the OKX app yourself to check your account status.
Someone on Dcard says a Bitget trading mentor is really accurate and wants me to add them on LINE. Can I trust it?
Don’t add them. Taiwan’s CIB states that being asked to add someone on LINE to invest is always a scam, and Bitget also states that it won’t message you first asking for personal information or funds. Bitget’s copy trading is inside its official app, your funds stay in your own account, and you never need to send crypto to anyone. If you’re unsure about an account, check it with Bitget’s official verification tool.
My withdrawal is frozen and they say I have to pay a deposit first. What should I do?
Don’t pay. This is a scam pattern named by both Taiwan’s FSC and the CIB. Account restrictions at a real exchange are appealed through support inside the official app or website, and HTX states that appeals are completely free. If that “platform” isn’t on the list of official domains, the money is most likely already in the scammer’s hands; in Taiwan, call 165 to report it, and elsewhere, report it to your local police.
What are the most common USDT scams?
The most common one gets you to send USDT to an “investment platform” or personal address outside the exchange, then blocks your withdrawals with one excuse after another. Binance warns that blockchain transactions can’t be reversed, so you may not get the money back after a scam. OKX also warns about “address poisoning”: the scammer sends you a small amount from a fake address whose first and last few characters match an address you use often, then waits for you to copy the wrong address from your history. Check the full address before every transfer.
Do I have to pay to sign up with a referral code?
No. A referral code is just a field on the sign-up page. The exchange pays the rebate back out of the fees you pay later, and the rate has an official cap; for OKX it’s 0%–20%. Anything that makes you pay an activation fee, buy a membership or hand over your password before you can claim is not an exchange referral rebate.
Can a lawyer or hacker recover the money I lost to a scam?
No, and that pitch is the most common line in second scams. Taiwan’s CIB explains that lawyers have no public authority and cannot recover funds on their own; recovery goes through a police report, investigation and prosecution, and compensation is sought through an incidental civil action after the criminal verdict. In Taiwan, call 165 right away to report it so the police can notify banks to freeze suspicious funds; elsewhere, contact your local police or national fraud reporting service as soon as possible.
How do I make sure the exchange app on my phone is the official one?
Go to the App Store or Google Play from the download page on the exchange’s official website, then check the developer name against the table above. Don’t install installer files or download links that someone sends you in a private message; the FBI also advises against downloading investment apps whose source you can’t verify (FBI IC3 announcement, 2022-10-03).
For more on rebate-related scams, see rebate scam warning signs. The referral rebate caps each exchange publishes are collected in the exchange referral rules dataset, and legitimate referral codes and links are in all exchange referral codes. A rebate that hasn’t arrived doesn’t necessarily mean you’ve been scammed; start with how to check a missing rebate. For the rules on changing your referrer, see the guide to switching exchange referral codes.