Crypto scam

What you need to understand

• For the blocked-wallet or investment case, first check the requested action, the channel used and what may already have happened if you clicked, paid or shared a code.
• Use an official channel for the blocked-wallet or investment case that you open yourself. A received link, QR code or phone number is not a reliable starting point.

The scenario, step by step

• The victim is led to a fake wallet, a fake platform or a malicious contract presented as an investment or a reward.
• Connecting the wallet or signing can authorise a transfer; the seed phrase, on the other hand, gives full control over the assets.
• The gains shown may be fake. New fees are then requested to withdraw the funds, and a fake recovery service may target the victim a second time.

What the fraudster is trying to get

• Crypto payments and wallet permissions.
• The seed phrase, private key or remote access.

Common variants

• Fake exchange or wallet.
• Drainer after signing a contract.
• Fake airdrop, staking or recovery service.

Warning signs in your case

• Guaranteed return
• App to install
• Urgent payment
• Private group

What a legitimate service would do

• No legitimate service asks for the seed phrase.
• The absence of an FSMA warning is not proof of authorisation or reliability.

Belgian context and fraud chain

• Crypto offers targeting Belgian residents can combine advertising, a private group, a fake adviser and a foreign platform. The technical vocabulary and market interfaces make it hard to tell the difference between a market loss and a theft.
• Checking an actor with the FSMA is important, but the absence of a warning is never a validation. The domain name and legal entity must match exactly.

Decision points to check

• Never share a seed phrase or private key. No legitimate support team needs them to diagnose or recover a wallet.
• Before signing, identify the authorisation being granted, the contract and the assets concerned. A signature can have an effect even if no payment is visible immediately.
• Refuse extra fees that are supposed to unlock a withdrawal or recover a loss. They often keep the same scam going.

How to check without taking a risk

• Do not reply to the message and do not use the link, QR code or number it contains.
• Open the official app or website yourself, then check whether the same request appears in your personal account.
• If in doubt, contact the organisation using a number found on its official website, a reliable invoice or your bank card.

What to do immediately

• Do not pay anything and do not connect any wallet.
• Check on fsma.be whether the actor claims to be legitimate.

If you have already clicked, paid or replied

• Stop the exchange and do not try to negotiate with the sender of the message.
• Change the access details through the official service. Contact the bank immediately if a payment, card, IBAN or validation is involved.
• Keep the exchanges, payment references and addresses you have seen for reporting, without sharing personal data publicly.

What to do after an incident

• If a seed phrase or private key has been exposed, consider the wallet compromised and ask a trusted professional for help moving the remaining assets without following instructions from a stranger.
• Revoke malicious permissions only with recognised tools and from a trusted environment. Do not reconnect the wallet to the suspicious site.
• Keep the public addresses, transaction IDs, domains and conversations for reporting; do not pay for an unverified recovery service.

Limits and level of proof

• A price drop or a slow withdrawal does not automatically prove fraud. The impossibility of verifying the entity, fee requests and fake balances are separate elements to document.
• The site does not guarantee asset recovery and cannot assign a blockchain address to a person without external proof.

Analysis grid for the blocked-wallet or investment case

• To review a the blocked-wallet or investment case case, split it into four questions: who makes contact, through which channel, which action is requested and which independent element can confirm it. One reassuring answer does not make up for the other inconsistencies.
• The priority signals in this case are: guaranteed return; app to install; urgent payment; private group. Their combination matters more than the isolated presence of a word, logo or spelling mistake.
• Always compare the message with the actual state of the service. For the blocked-wallet or investment case, a request that is not present in the app, account or official contact should not be carried out until it has been confirmed.

When to ask for immediate help

• In a the blocked-wallet or investment case case, contact the service concerned without delay if a code, validation, payment, card, identity document or remote access has already been shared. Describe the exact action rather than saying only that you have been hacked.
• If no sensitive action has been taken, keep the useful elements, block the contact and use the detector to document the signals. This difference avoids confusing prevention, a confirmed incident and a simple unsolicited message.

What to do now

• If you have not acted, do not click further and open the named service's official channel yourself.
• If you clicked, close the page, enter nothing else and note what information was shown or requested.
• If you shared a code, card, password or payment, contact your bank or the relevant official service immediately.
• Keep the message, time, link used and any useful screenshots. Share them only with an official reporting channel or a trusted helper.

Limits of this page

• This page does not prove that a message is safe and does not replace your bank, the police, Safeonweb, a platform or a public service.
• A scam may be new, very well written or described with too little context. Use the result as decision support, not as absolute certainty.
• Before taking a final action, checking through the official channel matters more than the appearance of the received message.

Check through an official channel

• Type the service address yourself or open the official app. Do not use a phone number, link or QR code from the suspicious message to verify the situation.
• When money, card details, a code or account access are involved, the safety action comes first. The analysis can then help organise the evidence.

How to read the result

• A low number of signals does not mean that everything is safe. It only means that this page or analysis did not find decisive evidence with the information available.
• Focus on the requested action: paying, sharing a code, installing an app, approving a bank action or leaving an official platform. That action matters more than a logo, sender name or polished wording.
• If the situation feels urgent, step away from the received message first. Then check calmly through a channel you already trusted before the message arrived.

Belgian reading of this situation

• For the blocked-wallet or investment case, focus on the relevant Belgian next step: open the official channel yourself, contact the bank, use Safeonweb or preserve evidence.
• The right decision for the blocked-wallet or investment case depends on what has already happened. Reading a message is not the same as clicking, paying, sharing a code or granting remote access.

Frequently asked questions

Useful official sources

• FSMA - Mise en garde contre des groupes WhatsApp d'investissement douteux - link checked on 2026-09-17
• FSMA - Plateformes frauduleuses de trading et faux articles de presse - link checked on 2026-09-17
• FSMA - Questions sur la fraude à l'investissement ? - link checked on 2026-09-17
• Febelfin - Fraude à l'investissement - link checked on 2026-09-17
• SPF Économie - Victime d'une arnaque ? Que faire ? - link checked on 2026-09-17