Wallets & Security · Regulation · Research Index
Top 20 Crypto Scams Targeting UK Residents in 2026
Published 6 April 2026
Interest in cryptocurrencies and digital assets has grown substantially in recent years, and unfortunately so have the scams. UK law-enforcement and regulatory agencies report that men aged 25–44 are the most common victims, and that 66% of investment-fraud reports recorded in 2024 involved cryptocurrency. The Metropolitan Police and the Financial Conduct Authority emphasise that most crypto activities remain outside the scope of UK financial regulation, which means victims will have no access to the Financial Services Compensation Scheme and no recourse to the Financial Ombudsman Service. This guide covers the twenty most common scams affecting UK residents, drawing on official information from the FCA, National Crime Agency, National Cyber Security Centre, Action Fraud and Metropolitan Police.
The most common crypto scams targeting UK citizens in 2026 include fake investment platforms, Ponzi schemes, pump-and-dump operations, romance fraud, impersonation and clone-firm scams, phishing attacks, fake wallet applications, rug-pulls and recovery-fraud operations. These scams share common tactics: urgency, secrecy, social engineering and promises of guaranteed returns. Most pressure victims to move conversations to encrypted messaging apps and away from traceable communication channels.
- UK crypto investments carry no FSCS protection and no ombudsman access
- 66% of UK investment-fraud reports in 2024 involved cryptocurrency
- Men aged 25–44 are the most frequently targeted demographic
- Sources: FCA, NCA, NCSC, Action Fraud, Metropolitan Police
Scams 1–4 · Investment fraud
Fake platforms, Ponzi schemes, market manipulation and pump-and-dump operations
1. Fake crypto-investment platforms
Scammers build professional-looking websites and make contact through social media, cold calls or unsolicited messages. They promise consistent, high returns and often display fabricated account screenshots to demonstrate imaginary profits. Once funds are sent, the platform either restricts account access or demands further fees before any withdrawal can proceed. Victims typically discover the fraud when attempting to retrieve their money.
The FCA stresses that even when a firm appears on its register, crypto investments typically sit outside the regulatory perimeter and carry none of the consumer protections that apply to regulated financial products. Always check both the FCA Register and the FCA Warning List before sending funds to any platform. The UK's crypto regulatory framework is progressively tightening, but the majority of investment platforms operating today remain unregulated.
Red flags: unsolicited contact, guaranteed or unusually high returns, pressure to act quickly, requests to keep the investment confidential, instructions to move conversation to WhatsApp or Telegram.
Protect yourself: treat every unsolicited investment approach with scepticism; check the FCA Register and Warning List; never invest based solely on social media recommendations.
2. Ponzi schemes
Ponzi operators use incoming funds from new investors to pay returns to earlier participants, creating a convincing illusion of profitability. The structure depends entirely on a constant flow of new money; when recruitment slows, the scheme collapses and operators disappear. Crypto Ponzi schemes are attractive to fraudsters because tokens are harder to trace and cross-border recovery is difficult.
Red flags: low-risk, high-reward marketing; constant pressure to recruit friends and family; a lack of verifiable business information; secretive or unnecessarily complex strategies.
Protect yourself: research the company through Companies House and the FCA; be wary of any scheme where returns depend on recruiting new participants rather than genuine investment activity.
3. Insider dealing and market manipulation
Coordinated groups manipulate prices by orchestrating trades or circulating false information across social media. Tactics include wash trading — repeatedly buying and selling between controlled wallets to create artificial volume — and coordinated price swings that are timed to catch retail investors off-guard. Ordinary holders are typically left holding assets that collapse in value once the manipulation ends.
Red flags: unexplained spikes in trading volume; social-media hype unsupported by credible news; invitations to join exclusive trading groups or signals channels.
Protect yourself: research an asset's history independently; verify information across multiple sources before acting; report suspected manipulation to Action Fraud.
4. Pump-and-dump schemes
Fraudsters acquire a low-value token quietly, then use influencers, AI-generated celebrity endorsements and coordinated messaging across private group chats to generate hype. Once the price rises sufficiently, they sell their holdings, causing the price to collapse. Investors who bought during the hype phase are left with near-worthless assets. The FCA's enforcement action against HTX demonstrated how seriously UK regulators are beginning to treat coordinated crypto promotion without proper authorisation.
Red flags: group chats pushing hot tips; rapid price rises unrelated to genuine news; claims of guaranteed returns within specific timeframes.
Protect yourself: research token distribution and who controls liquidity; treat social-media price hype with caution; verify whether smart contracts have been independently audited.
Scams 5–8 · Social engineering
Rug-pulls, romance fraud, long-con investment fraud and impersonation
5. Rug-pulls — DeFi and NFT exit scams
Developers build apparent momentum around a new token or NFT project — through Discord communities, Telegram channels and influencer promotion — then suddenly withdraw all liquidity from the project and disappear. The asset's value collapses to zero immediately. Victims are left holding tokens or NFTs that cannot be sold because there is no liquidity remaining.
Understanding how to verify a wallet or project before interacting with it is covered in more detail in the Wallets Part 4 guide on red flags and scam prevention. For DeFi projects specifically, audited smart contracts and time-locked liquidity are the minimum reasonable baseline before committing funds.
Red flags: anonymous or unverifiable developers; no independent smart contract audit; unrealistic roadmap promises; heavy Telegram or Discord promotion.
Protect yourself: research the team's prior projects; confirm liquidity is locked via a time-locked contract; never commit significant funds without an independent audit.
6. Romance fraud — pig-butchering
A scammer builds a romantic or friendship relationship online over weeks or months, establishing trust before introducing investment opportunities. Small initial returns are sometimes provided to build confidence. Eventually the scammer disappears with the victim's savings — and may later reappear posing as a recovery service. The NCSC and Metropolitan Police have both flagged pig-butchering as a growing threat to UK residents.
Red flags: online contacts who quickly express strong feelings; requests to keep the relationship or investment confidential; pressure to move conversations to encrypted apps; wrong-number texts that evolve into friendship and then investment discussions.
Protect yourself: never send money to someone you have not met in person; perform reverse-image searches on profile photos; ask a trusted person to review the situation before acting.
7. Long-con investment fraud
Closely related to pig-butchering, long-con fraud involves extended trust-building before the investment pitch is made. The scammer may present as a financial expert, a successful trader or a chance acquaintance. After victims commit funds and eventually discover the fraud, some are re-targeted by the same operators posing as a separate recovery agency.
Red flags: unsolicited messages on social media or via unknown texts; self-proclaimed experts offering free guidance; high pressure to increase investment after small early returns.
Protect yourself: never invest based on relationships formed online with people you have not verified independently; check known fraudulent websites on ScamAdviser before proceeding.
8. Impersonation fraud and clone firms
Scammers impersonate police officers, bank security teams, FCA representatives or the support staff of legitimate exchanges. Clone-firm scams are particularly dangerous: fraudsters use the name and FCA registration number of a genuine authorised firm but supply different contact details, directing victims to send money to the fraudster's accounts instead.
The FCA's enforcement activities against unauthorised firms highlight how active UK regulators are in this space, but clone firms are specifically designed to bypass the register check by referencing real registration numbers. Always verify contact details directly on the FCA Register rather than using any details provided in an unsolicited message.
Red flags: unsolicited calls claiming your crypto account is compromised; requests to move funds to a safe wallet; requests for your seed phrase or remote access to your device.
Protect yourself: end unsolicited calls; ring back using a number obtained directly from the FCA Register; never share seed phrases under any circumstances.
Scams 9–13 · Digital threats
Sextortion, ICO fraud, fake wallets, digital theft and cryptojacking
9. Sextortion and blackmail
Criminals threaten to distribute private images or videos unless a ransom is paid, typically demanded in cryptocurrency to make the payment harder to trace. Some extortion emails include a password taken from a data breach to add a veneer of credibility and increase the victim's sense of exposure. The cryptocurrency payment demand is a consistent marker of this type of fraud.
Red flags: unsolicited messages claiming to hold compromising content; demands for crypto payment; emails containing a known password from a previous data breach.
Protect yourself: do not pay; save evidence and report to the police; check if your credentials have been exposed via haveibeenpwned.com; use strong, unique passwords and enable two-factor authentication across all accounts.
10. ICO and token-sale fraud
Fraudulent projects run token sales or Initial Coin Offerings with no functioning product behind them. White papers may be plagiarised, partnerships fabricated and celebrity endorsements either false or paid without the endorser understanding the product. After raising funds the developers vanish, or the project transitions into a pump-and-dump or rug-pull. The lack of UK regulatory coverage for most token sales means victims have minimal recourse.
Red flags: no working product or prototype; plagiarised white paper; unrealistic return claims; heavy reliance on celebrity or influencer promotion.
Protect yourself: read the white paper independently; verify team credentials; consult a regulated financial adviser before committing meaningful funds to any token sale.
11. Fake wallet applications
Counterfeit wallet apps are built to look identical to legitimate products. When users enter their seed phrase or transfer funds, the app redirects assets directly to the fraudster. Some fake apps have appeared in legitimate app stores and been promoted by paid influencers on social media.
Understanding what a legitimate hardware or software wallet looks like — and how to verify it before use — is covered in the Wallets Part 1 guide on self-custody and Ledger vs Trezor, and in the Wallets Part 3 guide on hot wallets for UK traders. The principle applies to all wallet software: always download from the manufacturer's official website, never from a search engine result or a link in an unsolicited message.
Red flags: misspellings in app names or URLs; limited reviews or implausibly positive ratings; no verifiable developer identity.
Protect yourself: bookmark official wallet websites rather than searching for them; verify the developer identity before installing; download only from official sources.
12. Digital asset theft and fake giveaways
Fraudsters hack wallets or engineer situations in which victims reveal private keys or seed phrases. Fake giveaways — often posing as exchange promotions or celebrity-endorsed events — require participants to send a small amount of crypto first, with promises of a larger return. The promised return never arrives. Exchange hacks and compromised DeFi platforms also result in direct asset losses that are typically unrecoverable.
Red flags: any giveaway requiring an upfront payment; unsolicited links to promotional events; unknown games or platforms promising outsized rewards.
Protect yourself: store seed phrases offline and never photograph or type them into any online service; split significant holdings across multiple wallets; keep devices and software updated.
13. Cryptojacking — unauthorised mining
Malware covertly recruits a victim's computer, phone or server to mine cryptocurrency on the attacker's behalf. The victim experiences degraded device performance, overheating and higher electricity consumption without understanding the cause. Cryptojacking malware is typically delivered through phishing emails or compromised websites.
Red flags: sudden slowdown in device performance; persistent overheating; abnormally high CPU usage or unusual electricity bills.
Protect yourself: monitor device resource usage; use up-to-date antivirus software; consider disabling JavaScript on unknown sites; run regular malware scans.
Scams 14–17 · Deception and infrastructure
Phishing, spoofing, malware, ransomware and money-mule recruitment
14. Phishing, smishing and quishing — QR code fraud
Fraudsters send emails, SMS messages or QR codes that link to convincing replicas of legitimate websites — exchanges, banks, delivery services — designed to capture login credentials or seed phrases. The messages typically impersonate trusted brands and create a sense of urgency to prevent the recipient from pausing to verify the source.
If you use Coinbase or Kraken, be aware that both platforms' legitimate communication patterns are covered in the Coinbase and Kraken UK reference guide — knowing what genuine exchange communications look like makes fraudulent ones easier to identify.
Red flags: generic greetings; poor spelling or grammar; unsolicited requests for sensitive information; email addresses or phone numbers that differ slightly from the genuine organisation's.
Protect yourself: do not click links in unsolicited messages; forward phishing emails to [email protected]; forward spam texts to 7726.
15. Spoofing and typosquatting
Criminals register domain names that closely resemble legitimate exchange or wallet websites — sometimes differing by a single character or using a different top-level domain. Caller-ID spoofing allows fraudsters to appear to be calling from a bank or exchange's genuine number. Both techniques rely on victims not scrutinising the details closely enough.
Red flags: slight variations in website addresses; unexpected messages urging immediate action; links in emails or texts that should be navigated to directly instead.
Protect yourself: type URLs manually or use bookmarks; hover over links to check the real destination before clicking; verify account details exclusively through official channels.
16. Malware and ransomware
Malicious software delivered through phishing emails, infected attachments or compromised websites can steal seed phrases directly from device storage or lock files and demand crypto payment for their release. Ransomware in particular has become a significant threat to both individuals and businesses, with cryptocurrency payments preferred by operators because they are difficult to reverse and harder to trace.
Red flags: suspicious email attachments; unexpected software installation prompts; sudden file encryption or ransom demands.
Protect yourself: install antivirus software and keep it updated; back up data regularly to offline storage; never open attachments from unknown sources; restrict external devices on sensitive systems.
17. Financial exploitation and money-mule schemes
Criminals recruit people — often students, job-seekers or those in financial difficulty — to move money through bank or cryptocurrency accounts. The recruiter frames it as a simple paid task; the reality is that the participant is laundering illicit funds and can face prosecution as a result, regardless of whether they understood the full nature of what was happening.
The HMRC's CARF reporting requirements mean that exchange transaction data is now reported directly to tax authorities, making crypto money-mule activity increasingly visible to investigators.
Red flags: job offers requiring you to receive and forward money or crypto; requests to open accounts on behalf of a third party; poor spelling and grammar in job postings.
Protect yourself: never share bank or wallet details with people you have not verified; decline any role that involves moving money on behalf of someone else.
Scams 18–20 · Infrastructure and aftershock
Crypto ATM fraud, NFT scams and recovery fraud targeting previous victims
18. Money laundering via crypto ATMs
Fraudsters instruct victims to withdraw cash and deposit it through Bitcoin ATMs — often under the cover of a fake job arrangement, a purchase or a supposed debt. Once the funds are deposited to the scammer's wallet address, the transaction is irreversible. The FCA maintains a register of permitted crypto ATM operators; any machine not registered with the FCA is operating unlawfully in the UK.
Red flags: any instruction to use a crypto ATM to pay for services, settle a debt or fulfil a job; kiosks not registered with the FCA.
Protect yourself: verify ATM registration with the FCA before use; treat any instruction to pay via crypto ATM from an unknown party as a scam.
19. NFT fraud and airdrop or giveaway scams
Fraudsters sell duplicate NFTs or create fake marketplace websites that closely replicate legitimate platforms. Prices are artificially inflated via wash trading — coordinated purchases between accounts controlled by the same operator — before a sell-off collapses the price. Separately, giveaway scams distribute links to airdrops that require connecting a wallet; once connected, the fraudulent contract drains available assets from the wallet.
Red flags: unverified sellers; URLs with spelling errors; sudden unexplained price surges; low transaction counts suggesting limited genuine activity.
Protect yourself: examine an NFT's full transaction history before purchasing; verify the marketplace's SSL certificate; never connect a wallet to an unverified site to claim a supposed airdrop.
20. Recovery scams and fake regulators
After a victim has lost money to a crypto scam, a second wave of fraud often follows. Operators posing as recovery agencies — and sometimes impersonating the FCA itself — contact victims and promise to retrieve lost funds for an upfront fee. Some claim the victim must pay taxes or administrative charges before funds can be released. The FCA will never contact individuals to request payment or banking details.
If you have experienced fraud, report it through the official channels — Action Fraud at 0300 123 2040 or via actionfraud.police.uk. In Scotland, report to Police Scotland on 101.
Red flags: unsolicited offers to recover lost funds; upfront fee requests; claims from supposed FCA or police representatives that money is required to release assets; communication via personal email or WhatsApp.
Protect yourself: ignore all unsolicited recovery offers; the FCA will never ask for payment; report any approach to Action Fraud immediately.
UK-specific guidance · Stop · Check · Report
What to do if you suspect a scam — and how to protect yourself going forward
The Police Service of Northern Ireland advises following three steps when in any doubt about a financial approach: stop before sending money, check the credentials of anyone offering an investment independently, and report suspected scams. This applies equally to cold calls, social media messages, dating app contacts and texts from unknown numbers.
Several tools are specifically available to UK residents. The FCA's Warning List at fca.org.uk/scamsmart is updated regularly and allows you to check whether a firm has already been flagged. Action Fraud at 0300 123 2040 is the central reporting point for financial crime in England, Wales and Northern Ireland. The NCSC at ncsc.gov.uk provides technical guidance on digital security. For users of Coinbase or Kraken, legitimate support channels and account security advice are covered in the Coinbase and Kraken UK reference guide.
On the wallet security side, the most practical protections are to store seed phrases offline, to purchase hardware wallets only from the manufacturer directly, and to verify any wallet application before installing it. The full four-part wallet series covers this in depth: Part 1 covers self-custody and Ledger vs Trezor, Part 2 covers alternative hardware wallets, Part 3 covers hot wallets for UK traders, and Part 4 covers red flags and the Stop Verify Confirm framework.
Banking-related friction — including why some UK banks block transfers to exchanges — is covered separately in the UK banks and crypto transfers guide. For the regulatory backdrop to all of this, including what FCA registration and EMI authorisation actually mean for exchanges, see the UK crypto regulatory framework explained and the Kraken EMI licence overview.
- Stop: do not act under pressure — criminals manufacture urgency deliberately to prevent you thinking clearly.
- Check: verify independently using the FCA Register, FCA Warning List and Action Fraud's ScamSmart tool.
- Report: Action Fraud 0300 123 2040 (England, Wales, Northern Ireland) · Police Scotland 101 · NCSC: [email protected] for phishing emails · 7726 for spam texts.
- Secure: use strong, unique passwords; enable multi-factor authentication on all accounts; store seed phrases offline; keep all devices updated.
Sources and disclaimer
UK-specific guidance — educational content only
This article is intended as an educational resource for UK residents and draws on publicly available information from official UK sources. It is not financial advice, legal advice or a recommendation to take any specific action. The scam descriptions and protective guidance in this article are based on information published by:
- Financial Conduct Authority (FCA) — fca.org.uk · ScamSmart · FCA Warning List
- National Crime Agency (NCA) — nationalcrimeagency.gov.uk
- National Cyber Security Centre (NCSC) — ncsc.gov.uk
- Action Fraud — actionfraud.police.uk · 0300 123 2040
- Metropolitan Police — met.police.uk
- Police Service of Northern Ireland (PSNI) — psni.police.uk
This content relates specifically to the United Kingdom regulatory environment. References to FCA registration, FSCS protection, the Financial Ombudsman Service and UK reporting channels apply to UK residents. If you are based outside the UK, consult your own jurisdiction's regulatory guidance.
No financial advice: nothing on this page constitutes financial, investment or legal advice. NoctisCrypto is an information service. Always conduct your own research and consult a regulated financial adviser before making any investment decision. Crypto assets are largely unregulated in the UK. Your capital is at risk.
About the author
Matt Oakley is the founder of NoctisCrypto, a UK-focused crypto market intelligence platform providing neutral, factual coverage of the UK cryptocurrency landscape. Matt's work covers UK regulation, exchange analysis, wallet security and market data — with a particular focus on clarity, accuracy and independence. NoctisCrypto does not accept payment for editorial coverage and does not provide financial advice.
Continue reading
Wallet security and UK regulation
For a practical guide to securing your own crypto holdings and understanding the UK regulatory environment these scams operate within, the wallet series and regulation guides provide the relevant factual context.