Official Threat Desk

Treat an unsolicited demand to buy or send cryptocurrency as a stop signal. Open the organization’s official site independently and verify through a known channel.

1. 1Stop the conversation and do not use its links or QR codes.
2. 2Contact the claimed organization through independently located information.
3. 3Preserve the message and report attempted fraud.

Scammers create a crisis and try to prevent independent checking. Slow the process down and involve a trusted person.

1. 1Do not send money or disclose credentials while under time pressure.
2. 2End the inbound conversation.
3. 3Verify the story through a separate channel.

A caller who says a government or business account must be protected through a cryptocurrency ATM is using a documented impersonation pattern.

1. 1Do not scan the supplied QR code.
2. 2Leave the transaction flow.
3. 3Contact the purported organization independently and report the attempt.

People who have already lost money are frequently targeted again by people claiming they can recover it.

1. 1Do not pay an advance recovery fee.
2. 2Verify any agency or professional independently.
3. 3Report the new approach as a separate incident.

Use the provider’s independently opened account-compromise flow and protect the connected email before responding to messages about the event.

1. 1Open the provider directly, not through an alert link.
2. 2Secure the connected email and revoke unfamiliar sessions.
3. 3Record identifiers and report unauthorized transfers.

Transaction hashes, addresses, amounts, timestamps, domains, and communication records can make an incident report more useful.

1. 1Preserve transaction and provider references.
2. 2Keep a chronological incident timeline.
3. 3Submit through the official reporting channel without paying a recovery intermediary.