Crypto lottery scams: 15 red flags

The common scam types

• Fake winner emails: "You won 5 BTC! Reply with your details."
• Phishing sites that copy a real lottery and ask you to connect and sign something harmful.
• Fake support on social media or chat apps offering "help" and asking for your recovery phrase.
• Advance-fee scams: pay a "tax" or "release fee" to receive a prize.
• Rigged lotteries with no verifiable draw and no payouts.
• Fake celebrity endorsements and giveaway streams.
• Malicious approvals that drain your wallet later.

15 red flags

1. 1You are told you won a lottery you never entered.
2. 2Anyone asks for your seed phrase, private key or wallet password.
3. 3You must pay a fee, tax or "gas" to receive a prize.
4. 4The message creates urgency: "claim in 24 hours or lose it".
5. 5The sender uses a free email address while claiming to be official.
6. 6The website address is slightly different from the real one.
7. 7The site is brand new, with no terms, no contact page or no named operator.
8. 8There is no way to verify a draw.
9. 9Payments go to a personal wallet address with no order number.
10. 10Returns are guaranteed or "risk-free".
11. 11A stranger contacts you first, on social media or in a chat app.
12. 12You are asked to install software or screen-sharing tools.
13. 13The "support agent" asks you to move funds to a "safe wallet".
14. 14Reviews and testimonials look copied and identical.
15. 15A wallet prompt asks for unlimited token approval or an unreadable signature.

How fake winner emails work

Scammers send bulk emails announcing a prize, often with a convincing logo. They want you to reply, which confirms the address is live, and then they ask for personal data, a fee, or your wallet details. A genuine winner email comes only if you bought a ticket, refers to a ticket number you can check on the official site, and never asks for secrets.

Check any claim by typing the real site address yourself and looking up your ticket number on the Track page.

How phishing sites trick you

A cloned site looks identical. When you connect your wallet, it asks you to "verify" or "claim" by signing something. The signature or approval gives the attacker permission to move your tokens. Always read what your wallet shows. If it is unreadable, or mentions permission to spend all of a token, reject it.

Bookmark the real site, and never reach it from ads, messages or search results you did not choose.

If you think you were scammed

1. 1Stop. Do not send more funds, even if told it will release the earlier ones.
2. 2If you shared a seed phrase, move remaining funds to a new wallet created on a clean device immediately.
3. 3Revoke token approvals using a reputable approvals checker.
4. 4Save evidence: messages, addresses, transaction hashes.
5. 5Report it to the platform involved, to your local police and to national fraud reporting services.
6. 6Beware of "recovery" services that contact you offering to get your money back for a fee. They are usually a second scam.

Habits that keep you safe

• Keep long-term holdings in a separate wallet from the one you use for tickets.
• Use a hardware wallet for anything significant.
• Treat unexpected messages with suspicion.
• Read the wallet prompt every time.

Anatomy of a fake winner message

A typical scam email has a subject like "Congratulations: you won 2.5 ETH", a logo copied from a real site, a claim number, and a deadline. The sender address is a free mailbox or a look-alike domain. The body asks you to reply with your name, phone number and wallet, or to click a link to "claim". The link leads to a site that asks you to connect your wallet and sign. The signature gives the attacker permission to move your tokens.

Look for what is missing: a ticket number you actually hold, a link to a draw page you can verify, and a sender on a domain you recognise. The absence of those is the answer.

How to check a link without clicking it

1. 1Hover over the link (or long-press on a phone) to see the real address.
2. 2Read the domain from right to left. The part just before the final ".com" or similar is the real owner.
3. 3Look for swapped letters, extra words and unusual endings.
4. 4Instead of clicking, type the known address yourself.

Where to report scams

• The platform where the scam arrived: email provider, social network or chat app.
• Your local police or national fraud reporting service.
• The real brand being imitated. We want to know if our name is used in a scam: use the contact page.
• Block explorers and wallet providers often accept reports of malicious addresses.

A short script for suspicious messages

1. 1Do not reply, click or call. Replying confirms your address is live.
2. 2Open the real site by typing its address, and look up your ticket number yourself.
3. 3If there is no ticket, there is no win. Delete the message.
4. 4Report it to the platform and to us if it uses our name.
5. 5If you clicked or shared something, act on the recovery steps above.