The Support Agent Who Contacted You First: How Fake Help Desks Take Over Crypto Accounts

The one thing impersonators cannot fake

Almost every checklist for spotting a fake message asks you to grade its appearance. Look for spelling errors, check the sender's address, see whether the logo is right. That advice made sense when fakes were sloppy. It has aged badly: branding is copied perfectly, sender names are registered with characters that look identical to the real ones, and phone numbers are spoofed to display an institution's real caller ID. Grading appearance now means competing with people whose full-time job is appearance.

There is a structural feature they cannot copy, because it is not a property of the message at all. It is the direction the contact travelled. Genuine support is reactive: you open a ticket, you start a chat, you call a number you found yourself, and a reply comes back into that channel. Fraud is proactive: it has to reach you, because you were never going to reach it. The FBI's advisory on exchange impersonation describes the opening move plainly — the fraudster makes contact by unsolicited call or message, claims to be exchange staff, and says there is a problem with your account or that someone is trying to compromise it. Read that as a rule rather than a description and it does real work: an unsolicited contact about your account can be discarded without you ever assessing whether it looks convincing. You are no longer grading a forgery. You are noticing that a conversation started from the wrong end.

How they find you, and why the handle looks right

Impersonators do not usually guess. Public spaces where people ask for help are the hunting ground: a project's community chat, a support forum, the replies under an exchange's social media post, a comment describing a stuck withdrawal. Someone posting a problem in public has self-identified as a person who currently wants help from that company, and a direct message arrives minutes later from an account whose display name and avatar match the official one. The FBI's guidance on tech and customer support impersonation notes that criminals pose as representatives across a wide range of services and explicitly includes cryptocurrency exchanges in that list, alongside banks, utilities, and software vendors — the same playbook, aimed at a faster and less reversible payment rail.

The other route is that you go looking and find them. Searching for a company's support number or help page can surface paid advertisements and lookalike sites positioned above the real result, so the number you dial is one the scammer bought placement for. This is why 'I contacted them, they did not contact me' is not by itself sufficient — the direction rule only protects you if the destination came from somewhere you trust. Reach a company through its own app, a bookmark you saved, or the domain typed by hand, and treat search results and links in messages as untrusted routes to a trusted-looking place.

The three asks, and what each one actually costs

Whatever the story, a fake help desk needs one of three things, and it helps to know the cost of each before you are under pressure. The first is your credentials — the password, and then the two-factor code, usually framed as 'verifying your identity' or 'confirming it is really you'. Handing over a one-time code is the moment the account changes hands, which is why no legitimate support process asks for one; the code exists precisely to prove you and not the caller are present. The second is control of your device, usually through remote-support software installed 'so we can fix it for you'. That grants a stranger your screen, your session, and anything you unlock while they watch, and the FBI's guidance is direct about it: do not allow an unknown individual who contacted you to have control of your devices or accounts.

The third ask is the one specific to crypto, and it is the most final. You are told your funds are at risk and must be moved immediately to a 'safe wallet', a 'secure account', or a 'protected address' — an address the caller supplies. It sounds like protective advice, and it is the entire theft. No legitimate institution needs your assets to travel in order to secure them: a real provider freezes withdrawals, locks the session, or disables the account, all of which happen where the funds already are. The federal guidance makes the general form of the rule explicit, warning that government and law enforcement will never ask you to send money by wire, cryptocurrency, crypto ATM, gift card, or by mailing cash — and the same logic extends to a company that supposedly employs the person calling you. Treat any instruction to move your own money to safety as a confession. Once a transfer leaves your wallet it does not come back, which is why this ask is reserved for the payment rails that cannot be reversed.

What the 2025 federal data shows about the scale

This is not a fringe category. The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses, a 26% rise in losses over the previous year. Within that, tech and customer support fraud accounted for 47,794 complaints and $2,134,675,818 — the third-largest loss category of the year, behind only investment fraud and business email compromise, and ahead of romance scams. Government impersonation added a further 32,424 complaints and $797,943,193. The report also breaks out account takeover fraud carried out through impersonation of financial institution support: roughly 4,700 complaints and $359.7 million, which is a narrow slice describing this exact manoeuvre.

Two further figures put it in context. Complaints carrying a cryptocurrency descriptor numbered 181,565 with $11,366,669,732 in losses, so crypto is where a large share of all reported fraud value now lands. And the age distribution is stark: complainants aged 60 and over filed 201,266 complaints with $7.7 billion in losses, more than any other group. If you help an older relative with anything technical, the direction-of-contact rule is the single most useful thing to hand them, because it requires no technical knowledge to apply — it is a rule about who started the conversation, not about how convincing it was.

The callback habit, and the hardening underneath it

The response to an unsolicited account warning is not to argue, test the caller, or ask questions that might expose them. It is to end the contact and re-establish it yourself. Hang up or close the chat, then reach the company through its official app or a number you find independently, and ask whether anything is actually wrong. This costs a few minutes and is completely reliable, because it does not require you to be right about the message. The FBI's advice on exchange impersonation is the same: do not respond even if it appears official and demands immediate action, and do not visit websites or click links the caller sends. Urgency is the pressure that stops people doing this, so treat urgency itself as the signal — a genuine problem will still be there in ten minutes, and any real institution will wait while you call back.

Underneath the habit, a few structural changes make the whole category harder to run against you. Move two-factor authentication off SMS where you can, since text codes can be intercepted by the SIM-swap route covered in our SIM-swap guide; an authenticator app is better, and a hardware security key is better still because it is bound to the real domain and will simply not produce anything on a lookalike site. Turn on withdrawal address allowlisting with a time delay if your exchange offers it, so a compromised session cannot immediately send funds somewhere new. Keep long-term holdings in self-custody rather than on an account that a persuasive phone call can reach, which is the trade-off our exchange versus self-custody guide walks through. And decide now, calmly, that you will never install remote-access software at the request of someone who contacted you — that decision is much harder to make in the middle of a convincing emergency.

If you have already engaged

Act in order of what is still recoverable. If you gave a password or a two-factor code, change the password immediately from a device you trust, revoke active sessions, and re-enrol two-factor from scratch so any device the attacker registered is cut off — then do the same for the email account attached to it, because whoever controls the email can reset everything else. If you installed remote-access software, disconnect the machine from the internet before anything else, uninstall it, and treat every credential entered on that machine as exposed. If you use the same password anywhere else, change it there too.

If funds have already moved, the money is very likely gone, and the most valuable thing you can do next is protect what remains and avoid the follow-up. Move any remaining balances to a wallet whose keys were generated on a clean device and never touched the compromised session. Report it — in the United States through ic3.gov, and to the exchange, which can sometimes freeze funds that have not yet been withdrawn — and keep transaction hashes, addresses, timestamps, and screenshots, since that record is what makes any later action possible. Then expect the second approach. Losses attract recovery scams, and the FBI's own reporting treats these as a distinct and large category; anyone who contacts you offering to retrieve your funds for an upfront fee is running the same play against a person they know has already paid once. Our guide on the first hour after a crypto scam covers that sequence in more detail. Finally, be gentle with yourself about it: these operations are competent, rehearsed, and designed to work on attentive people under time pressure, and treating the loss as evidence of carelessness mostly stops people reporting it.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

• Public Service Announcement I-080124-PSA: FBI Warns of Scammers Impersonating Cryptocurrency ExchangesFBI Internet Crime Complaint Center (IC3)
• Tech/Customer Support and Government ImpersonationFBI Internet Crime Complaint Center (IC3)
• 2025 Internet Crime ReportFBI Internet Crime Complaint Center (IC3)
• What To Know About Cryptocurrency and ScamsFederal Trade Commission

FAQ