Online safety: Spotting fake messages and impersonation attempts

It often starts with a message that doesn't seem out of place.

Perhaps it's an email asking you to verify your account, a text message about unusual activity, or a WhatsApp message claiming to be from customer support. The branding looks familiar, the language sounds professional, and the request appears genuine.

That's exactly what phishing and impersonation scams are designed to do. By appearing legitimate and creating a sense of urgency, scammers hope you'll act before taking the time to verify the message. Knowing what to look for can help you recognise these scams before they put your personal information or online accounts at risk.

Not every message is what it seems

Phishing and impersonation attempts can arrive through email, SMS, or messaging apps such as WhatsApp, Telegram, and Discord. Some direct users to fake login pages that closely resemble legitimate websites, while others ask recipients to confirm account details or verify recent activity.

As technology continues to evolve, scammers are becoming more sophisticated. Artificial intelligence has made it easier to create convincing emails, messages and websites that can appear authentic at first glance, making it even more important to pause before responding.

Examples of phishing and impersonation messages

Example 1: Fake rewards email
Promises free Bitcoin to lure victims.

Example 2: Fake support verification message
Used to impersonate BTC Markets support.

Example 3: Fake account update email
Creates urgency to trick users into clicking malicious links.

What should make you pause?

Not every unexpected message is a scam, but there are several warning signs that deserve a closer look.

Be cautious if a message creates a sense of urgency, asking you to act immediately to avoid restrictions, confirm your identity, or resolve an issue with your account. Scammers often rely on time pressure to discourage people from stopping to verify the request.

You should also be wary of messages asking you to click a link, log in to your account, or provide passwords, one-time verification codes or other sensitive information.

Sometimes the clues are more subtle. An email address may contain an extra character, or a website domain may look almost identical to the genuine one with only a slight variation that's easy to miss.

If something feels rushed or out of the ordinary, it's worth taking a moment to verify the message before taking any action.

What BTC Markets will never ask you to do

One of the simplest ways to assess whether a message is genuine is to consider what you're being asked to do. BTC Markets will never:

• Ask you to share your password or one-time verification (2FA) codes by email, SMS or messaging apps.
• Ask you to move your funds to another wallet or platform to "protect" them.
• Request your recovery phrase or other sensitive account credentials.
• Ask you to install remote access software to resolve an account issue.

If you receive a request like this, even if it appears to come from BTC Markets, stop and verify it through our official support channels before responding.

Before you respond

If you receive a message that seems unusual, avoid clicking any links or replying straight away. Instead, visit the organisation's official website directly or log in through its official app.

If you're unsure whether a message is genuine, contact the organisation using the support channels listed on its website rather than the contact details provided in the message itself.

Taking a few extra moments to verify a request may seem like a small step, but it can help protect your personal information and reduce the risk of falling victim to phishing scams.

Final thoughts

Phishing and impersonation scams continue to evolve, but many still rely on the same principle: encouraging people to act before they have time to think. Slowing down, verifying requests independently and using official communication channels can go a long way towards protecting your personal information and online accounts. If you receive suspicious communication claiming to be from BTC Markets, contact our Support team through our official channels before responding.

For examples of phishing emails targeting BTC Markets clients and information about what BTC Markets will never ask you to provide, you can also read our previous article, Scam awareness: Phishing and impersonation emails targeting BTC Markets clients.

Learn more about how to protect yourself at https://www.scamwatch.gov.au/

Disclaimer: The information provided on this page is issued by BTC Markets Pty Ltd (BTC Markets, we, us, our). The information is general only and is not intended to constitute an opinion or recommendation with respect to its contents. Past performance is not a reliable indicator of future performance. Any reference to past performance is intended to be for general illustrative purposes only. The information cannot be relied upon for any purpose and is not intended to be a substitute for professional advice.

The information does not purport to be complete, accurate, or contain all the information that a person may require to make a decision. It may also contain forward-looking statements, which are subject to known and unknown risks, uncertainties, and other factors. We recommend you obtain professional advice before making any decision with respect to the matters discussed in this document. To the maximum extent permitted by law, BTC Markets will have no liability for any loss or liability of any kind: (i) arising in respect of the information contained (or not contained) on this page; or (ii) arising from a person relying on any information or statement contained on this page. The information provided is only intended for recipients in Australia. This information cannot be reproduced without our prior written permission.