Common crypto scams and how to avoid them

Why are scams so common in crypto?

Scammers like crypto for several reasons. Transactions on a BlockchainBlockchainA public ledger where transactions are grouped into blocks, each linked to the one before, so past records can't be altered without it showing. can't be reversed, they cross borders in minutes, and no name is attached to a wallet addressWallet addressA string of letters and numbers you give out to receive crypto, much like a bank account number.. Many people also know little about the technology, and scammers take advantage of that.

In February 2026, the Central Bank of Iceland passed on a warning from the European Supervisory Authorities (EBA, EIOPA and ESMA). It says the particular features of crypto-assets increase the risk of fraud and give consumers less protection. The capital area police in Iceland have also warned about investment scams where people set out to buy crypto and scammers offer to "help" by getting them to install a program on their phone or computer.

The main types of crypto scam

Fake investment platforms

You see an ad on social media promising remarkable returns from crypto. After you sign up, a friendly "adviser" calls and helps you deposit a small amount. On the website, your balance grows fast.

The catch is that nothing is invested. The figures on the screen are just figures. When you try to withdraw, you are told to pay a tax, a fee or a "deposit" first, and then another fee after that. This is an investment scamInvestment scamA scam that promises big, safe returns on an investment, often in crypto, while the scammers simply take the money paid in., and it is often part of a romance scam. Read more in Investment scams and romance scams.

Impersonating celebrities and companies

Scammers use the names and photos of well-known people in fake ads and "news stories" about someone getting rich from crypto. With AI, it is also easy to make videos where a celebrity appears to recommend an investment.

Others pretend to be from a bank, the police, a crypto exchange or a tech company. According to Auðkenni, Iceland's e-ID provider, scam calls often appear to come from an Icelandic number, but the caller usually speaks English. This is social engineeringSocial engineeringWhen scammers manipulate people, rather than hacking computer systems, to get them to reveal information or send money.: the scammer uses trust and time pressure rather than technology to fool you.

Giveaways: "send 1, get 2"

You see a post or a livestream where a famous person or company promises to double any crypto sent to a particular address. Send 0.1 bitcoin and get 0.2 back, the ad says.

Nobody doubles your money. Whatever you send is gone. The same goes for fake airdropsAirdropWhen a project sends free tokens straight to people's wallets, often to promote itself, though fake airdrops are also a common scam., where you are promised free tokens if you connect your wallet to a website and approve a transaction. That approval can give the scammer permission to empty the wallet.

Phishing

You get an email, text or message that seems to come from your crypto exchange, your bank or Skatturinn, the Icelandic tax authority. The link leads to a fake page that looks exactly like the real one. You type in your password, card details or seed phraseSeed phraseA list of 12 or 24 words that backs up every key in your wallet, so whoever has the words can restore the wallet and take the crypto., and the scammer uses them straight away. More in What is phishing?

Fake apps and wallets

Scammers build apps, browser extensions and websites that look like well-known crypto walletsCrypto walletAn app or device that holds the keys to your crypto and lets you receive, store and send it. and services. You are asked to "restore" your wallet with your seed phrase or to deposit crypto. The moment you do, the crypto is in the scammer's hands.

Only download apps from the App Store or Google Play, check the publisher's name, and find the link on the service's own website rather than in an ad.

Ponzi and pyramid schemes

A Ponzi schemePonzi schemeA fraud that pays earlier investors with money from new investors, while no real business generates any profit. promises high, fixed returns, for example 1% a day. In reality there is no business behind the promise. Money from new participants is used to pay those who joined earlier. A pyramid scheme adds a bonus for recruiting others.

The first participants often do get paid, which makes the scheme look credible. When new money stops coming in, it collapses and most people lose everything.

Pump and dump and rug pulls

A pump and dumpPump and dumpA scam in which the price of a small coin is hyped up so the organisers can sell high and leave others with the losses. is when a group buys a small, unknown token, such as a MemecoinMemecoinA cryptocurrency born from an internet joke or meme, usually with little or no practical use, whose price rests almost entirely on hype. built on a joke or internet meme, and then promotes it heavily on social media. The price shoots up, people buy for fear of missing out, and then the organisers sell everything. The price crashes and the latecomers are left with the loss.

A rug pullRug pullA scam where the people behind a new token or crypto project collect money from buyers and then vanish with it, leaving the token worthless. is a close relative. The people behind a new project collect money from investors, shut the project down and disappear with the funds.

Recovery scams

Recovery scams often follow another scam. Someone gets in touch claiming to be a lawyer, an investigator or even the police, and offers to recover your money for a fee. The Icelandic police specifically warn against online services that offer to get money back. It is a known scam.

The warning signs

Scams can look very professional. These signs should set off alarm bells:

• Promises of high, safe returns. No real investment is risk-free. If something sounds too good to be true, it is.
• Time pressure. "This offer is only valid today" or "your account will be closed".
• Requests for secrecy. The police say that if you are told to keep an investment secret, it is likely a scam.
• Requests for remote access. No honest adviser asks you to install AnyDesk or a similar program.
• Requests for your seed phrase, password or PIN. A legitimate service never asks for them.
• Payments to different accounts. If the "investor" wants payments sent to different bank accounts, it is certainly a scam, the police say.
• A fee to withdraw. If you have to pay in more to get your own money out, it is a scam.
• An unknown platform. The service doesn't appear on any register of licensed providers.

How can you tell if a service is legitimate?

Since 1 July 2026, only firms licensed as a crypto-asset service providerCASP (crypto-asset service provider)A company licensed under MiCA to provide crypto-asset services, such as buying, selling, custody or transfers. may provide crypto-asset services in Iceland. The Central Bank of Iceland encourages people to check whether a provider is on the Central Bank's register or on the public register of the European Securities and Markets Authority, ESMA.

Scam sites can lie about having a licence or copy the name of a real company. So look the company up in the registers themselves, and don't rely on badges or links on its website. How to check if a crypto provider is licensed walks you through it step by step.

What to do if you have been scammed

1. Stop paying. Don't send any more money, whatever you are promised. Stop replying to the scammer, but don't delete the conversation. Screenshots and receipts help the police.
2. Contact your bank straight away. The sooner you act, the better the chance of stopping the payment. Payments abroad are hard to recover, and crypto payments are almost impossible to get back.
3. Tell the crypto exchange. If you bought the crypto through a crypto exchangeCrypto exchangeA company or platform where you buy, sell and swap crypto, for example with krónur. and sent it to a scammer, let the exchange know through its official channels. The transaction won't be reversed, but if the scammer has an account with the same service, it can sometimes be frozen.
4. Report it to the police. The police website, logreglan.is, is now part of Ísland.is. You report fraud through the police reporting portal on Ísland.is↗: choose "Fjársvik" (fraud) if you lost money. In the report, you can give the police permission to look into the case with your bank. You can also report it at any police station, and in an emergency, call 112.
5. Secure your accounts. Change your passwords, starting with your email. If you let someone into your computer, get help from a computer repair service or CERT-IS, Iceland's national cybersecurity team. If you gave away a seed phrase, move whatever is left to a new wallet immediately. See How to protect your crypto account.
6. Watch out for recovery scams. People who have been scammed often receive "offers" to help get their money back. These are the scammers' next attempt.
7. Talk to someone. There is no shame in being scammed. Scammers are organised and trained to deceive.

Closing thoughts

Crypto scams take many forms, but the recipe is nearly always the same: trust, time pressure and the promise of easy money. Take your time, talk to the people around you, and never send money or information to anyone who contacted you first.

If things go wrong, speed matters most. Contact your bank straight away and report it to the police.