Know the Scam
Know the Scam is the fraud-education project published by SimpleSwap. This page condenses it into a reference: each pattern, the signal that exposes it, and the habit that neutralises it.
It is built to be scanned rather than read through — the point is recognising a shape quickly, while a transfer is still reversible by simply not making it.
Universal signals
Six markers that apply to every row in the table below.
| Manufactured urgency | A deadline you did not set. |
| Guaranteed returns | Nothing on-chain provides one. |
| A request for your seed phrase | No service needs it, ever. |
| Contact you did not start | The approach arrived first. |
| Pressure to move platforms | Into a channel that keeps no record. |
| A fee to release your funds | Your own money has no paywall. |
Confirming the site is genuine
Any other domain carrying the name is a copy, however exact the interface.
Logos, colours and layout clone in minutes. The domain does not.
HTTPS encrypts the connection. Phishing sites hold valid certificates too.
Standard swaps never require one, and never a seed phrase.
An account that contacts you first did not come from SimpleSwap.
Once confirmed there is no chargeback, so the check belongs before you send.
Pattern reference
Each links to its full write-up in Know Scam on the SimpleSwap blog.
| Pattern | What it does | What exposes it | Full write-up |
|---|---|---|---|
| Lookalike domains | Interface cloned, domain altered, deposit address replaced. | Domain, not design. | Safety Academy → |
| Convincing phishing | Copies now match the original closely enough to defeat visual checks. | Bookmark, never a supplied link. | Read → |
| Investment grooming | Weeks of rapport ending at a platform that blocks withdrawals. | Stalled withdrawals expose it. | Safety Academy → |
| Synthetic giveaways | Generated video promising to return double what you send. | Nothing real asks you to send first. | Read → |
| Malicious approvals | One signature grants lasting permission over your tokens. | Audit and revoke approvals. | Read → |
| Mempool extraction | Bots trade around your pending transaction and take the difference. | Control slippage. | Read → |
| Poisoned history | A lookalike address planted for a later copy-paste. | Verify the middle characters. | Read → |
| Address-swapping malware | The copied address is substituted before you paste it. | Re-read the full string. | Read → |
| Unsellable tokens | Buy succeeds; sell is blocked or liquidity is pulled. | Check for prior successful sells. | Read → |
| Bonus-script fraud | Scripts promising rewards, built to take credentials or signatures. | No reward needs a script. | Read → |
| Impersonated support | Fake agents answer public help requests first. | Support never initiates contact. | Read → |
| Airdrop drainers | Unrequested tokens leading to a wallet-draining claim page. | Unexpected tokens are the trap. | Read → |
The full versions
Each row here compresses a full write-up in the SimpleSwap Safety Academy.