Scam alert: How impersonation scams work

A concerning trend we’re seeing is the rise of impersonation scams, where malicious actors pose as trusted institutions, customer support agents, or even individuals, to trick users into giving up sensitive information.

These scams can lead to devastating financial losses, as shown by a recent case that involved over AU$1m being stolen from a single victim. The method was calculated, deliberate, and exploited the victim’s trust in familiar platforms and processes.

Here’s what you need to know about how these scams typically work and, more importantly, how to protect yourself from becoming a target.

The anatomy of an impersonation scam

Impersonation scams are not new, but they’ve become more sophisticated with the rise of digital finance and cryptocurrencies. Scammers leverage social engineering, manipulating people into taking actions they wouldn’t normally take, and mimic real-world communication patterns to build credibility.

Let’s explore a typical scam scenario:

1. Initial contact: A trigger event

The scam usually begins with a message, often a text, email, or app notification, alerting the user to something suspicious. In one recent case, the victim received a message indicating that a new device had logged into their account. This was entirely fabricated, but it created immediate panic.

2. Follow-up: Phone calls from fake support

Shortly after, the victim received calls from someone claiming to be from customer support. These individuals were well-rehearsed and used insider terminology. They spoke with urgency and authority, pushing the victim to act quickly to "protect their account."

3. Email reinforcement: Spoofed communication

To add legitimacy, the scammers followed up with emails using spoofed addresses. These emails closely mimicked official communications, including logos, employee names, case numbers, and even links that looked genuine. These details were designed to reduce suspicion and build trust.

4. The critical moment: Extracting credentials

Through a mix of fear and perceived authority, the scammers coerced the victim into revealing highly sensitive details. In the case of crypto, it can be account information or a seed phrase. Once the scammers have this information, they are able to drain the wallet of its entire balance.

5. Aftermath: Realisation and loss

By the time a victim recognises the deception, it’s too late. Funds transferred on blockchain networks are irreversible. Recovery options are extremely limited once assets have been moved to scammer-controlled wallets.

Why impersonation scams are so effective

These scams work because they manipulate fundamental human behaviours: fear, urgency, and trust. They also rely on:

• Familiarity with platform interfaces: Scammers study the UI and processes of crypto platforms to sound credible.
• Technical spoofing: They spoof email addresses and caller IDs, making their messages seem legitimate.
• Layered communication: The use of multiple touchpoints (text, phone, email) creates a sense of continuity and authenticity.

Red flags to watch for

To protect yourself, it’s crucial to recognise warning signs. Common red flags include:

• Unsolicited contact: Any call, text, or email you didn’t initiate, especially those about "urgent account issues."
• Requests for private information: No legitimate platform will ever ask for this. Not under any circumstances.
• Fake support tickets: Look out for emails with case numbers or names that seem slightly off or unfamiliar.
• Pressure to act quickly: Scammers use urgency to bypass your usual caution.
• Slight variations in domain names: Emails from domains like [email protected] instead of [email protected] are red flags.

How to protect yourself

Taking proactive steps can dramatically reduce your risk of falling victim to an impersonation scam:

Never share personal information with someone who contacts you directly

This cannot be overstated. Never provide account details, passwords or private keys with someone who reaches out to you.

Enable two-factor authentication (2FA)

Use an authenticator app rather than SMS-based 2FA, which can be vulnerable to SIM-swap attacks. This adds an extra layer of protection to your accounts.

Verify communication channels

If you receive a suspicious call or email, don’t engage. Instead, go directly to the official website of the platform, log in securely, and reach out through their verified support channels.

Take your time

Scammers create urgency to push you into hasty decisions. Pause. Consult someone you trust. If it doesn’t feel right, it probably isn’t.

Educate yourself and others

The more informed you are, the harder it is to deceive you. Share knowledge with friends, family, and colleagues to help build awareness in the community.

If you think you've been targeted

If you believe you’ve been contacted by a scammer or may have fallen victim to a scam:

• Stop all communication immediately.
• Do not provide any further information.
• Report the incident to the platform in question and to Scamwatch (run by the ACCC) at www.scamwatch.gov.au.
• Contact your bank or crypto exchange to discuss next steps, especially if you’ve shared financial details.

Impersonation scams in crypto are becoming more refined and convincing. They prey on your trust, mimic authority, and create pressure to act quickly. But with awareness, scepticism, and a few preventative steps, you can significantly reduce your risk.

At BTC Markets, we are committed to educating and protecting our clients. We will never ask for your seed phrase, private keys, or access to your personal wallet. If you’re ever in doubt about a message, please contact us directly through our verified support channels.

Stay alert, stay informed, and never let urgency override your judgement.

Disclaimer: The information provided on this page is issued by BTC Markets Pty Ltd (BTC Markets, we, us, our). The information is general only and is not intended to constitute an opinion or recommendation with respect to its contents. Past performance is not a reliable indicator of future performance. Any reference to past performance is intended to be for general illustrative purposes only. The information cannot be relied upon for any purposes and is not intended to be a substitute for professional advice.

The information does not purport to be complete, accurate or contain all of the information that a person may require to make a decision. It may also contain forward looking statements, which are subject to known and unknown risks, uncertainties, and other factors. We recommend you obtain professional advice before making any decision with respect to the matters discussed in this document. To the maximum extent permitted by law, BTC Markets will have no liability for any loss or liability of any kind: (i) arising in respect of the information contained (or not contained) on this page; or (ii) arising from a person relying on any information or statement contained on this page. The information provided is only intended for recipients in Australia. This information cannot be reproduced without our prior written permission.