Here is a sequence that plays out thousands of times a day. Someone has a wallet problem. They post about it in a public channel: a reply to the project, a forum thread, a comment under a video. Within minutes, a friendly account replies. It uses the right logo, the right name, the calm and competent tone of a real help desk. It offers to walk them through a fix.
It is not the help desk. It is a predator that was watching for exactly that post, now writing fluent support English with the help of an AI. By the end of the conversation, the funds are gone.
This is the most common way self-custody users get drained right now. Not a sophisticated hack. A conversation.
Why this works so well now
Two things made fake support explode.
First, AI removed the language tell. Fake support used to read like a scam. Now it reads like a real agent who genuinely wants to help, because a model is writing it. Patient, polite, knowledgeable-sounding. The warmth is the weapon.
First contact is also instant and tireless. Bots watch public channels for keywords like "stuck," "pending," "lost," "help," and reply faster than any real team could. The speed feels like good service. It is actually a trap that was waiting for you to walk into it.
Real support almost never reaches out to you first, and it never appears within seconds of a public post about a problem. If help arrives unsolicited and fast, treat that speed as a warning sign, not a kindness.
The two requests that end it
A fake-support conversation can wander for a while, building trust, but it has to arrive at one of two destinations. Both are absolute red lines.
- "Please share your seed phrase / recovery phrase / private key so we can restore your wallet." No. There is no legitimate version of this request. No real support process, anywhere, for any wallet, requires your seed phrase. The moment you see this ask, the conversation is over and the account is a thief. This is not a judgment call.
- "Connect your wallet here / sign this / enter your phrase on this validation page." They send a link to a site that looks official and asks you to "sync," "validate," or "restore" by entering your phrase or approving a transaction. Entering the phrase hands them the keys. Approving the transaction can hand them your tokens directly.
If you remember nothing else: support never needs your seed phrase, and you never type it into a website. Those two rules end the overwhelming majority of these attacks before they start.
Scammers also send you to "official support" via direct message after seeing your post. Switching to a private channel is part of the play: it gets you away from other people who might warn you. A move to DMs is not more secure. It is more isolated, which is what the predator wants.
How to read a profile in ten seconds
Fake accounts are cheap to make and easy to dress up. A few quick checks catch most of them.
- Account age and history. Brand-new account, or one with almost no real history, is a strong signal. Predators churn through accounts as they get reported.
- The handle, character by character. Lookalike names are everywhere: an extra letter, a zero for an o, an underscore, "support" or "helpdesk" bolted onto a real project name. Compare against the official handle posted on the project's own verified site, not against your memory.
- Who contacted whom. If they messaged you first, especially right after you posted a problem, the burden of proof is entirely on them. Verified badges and matching avatars are trivial to fake and prove nothing on their own.
- The pressure. Real help is calm about timing. Fake help nudges you toward a link, a phrase, or a "quick" action. Any push toward urgency is a tell.
These checks are not foolproof, and you should not rely on passing them as permission to share anything sensitive. They are a fast filter, not a green light.
The habit that keeps you safe
The durable defense is a rule about where you get help, not how well you can spot a fake.
Get support only through doors you open yourself. Find the official support channel by navigating from the project's verified website or the app you already installed, not by clicking a link someone sent and not by trusting whoever replied to your post. You go to support. Support does not come to you.
And bring the self-custody fundamentals with you. If you treat your seed phrase as something that never gets typed, spoken, photographed, or shared, then even a flawless fake-support agent has nothing to take. The conversation can be as convincing as it likes. It runs into a wall you built in advance.
The fix is a sourcing rule: you reach support through the official site or app yourself, never through whoever answered your public post or slid into your messages. Pair that with the unbreakable rule that your seed phrase is never shared or typed into any site, and the most common drain in crypto simply stops working on you.