Q: 1.2 Which scams are most common in the crypto sector?

There are six main families. Impersonation scams — someone pretending to be an exchange’s support team, your bank, a public body or a courier — are by far the fastest-growing category. Investment scams , including those built on a personal relationship (so-called pig butchering ), remain the ones that take the most money. Phishing and wallet drainers aim to get you to hand over credentials or sign approvals that empty a self-custody wallet. AI and deepfake scams use cloned videos and voices. Recovery scams promise to retrieve funds you’ve already lost. Finally there are the techniques that target your identity and your device: SIM swapping , fake apps and browser extensions, job offers with infected files. One useful clarification: these categories are increasingly blurred. The same organisations combine several tactics in a single operation — a text message imitating your bank can lead to a fake agent who convinces you to “secure” your funds in a wallet they control. To protect yourself, recognising the mechanism described in the previous answer matters more than classifying the scam. For an overview, read Phishing, Ponzi schemes and other scams .

Q: 1.7 What is smishing and what about fake messages from banks and public bodies?

Smishing is phishing by text message, and it’s currently one of the most heavily used impersonation channels. The messages imitate organisations you trust out of habit — your bank, a courier holding a parcel, the tax authority, a road toll or fine to pay — and contain a link to a clone site that harvests your data and credentials. They aren’t amateur efforts: kits sold as a service allow hundreds of thousands of messages to be sent per day, impersonating dozens of different brands with perfectly translated clone sites. Two practical defences: no institution or bank asks for data, payments or codes through a link in a text message , and verification should always be done by opening the official app yourself or typing the website address — never by tapping the link you received. Be careful too with messages that appear inside the same conversation thread as legitimate texts you’ve received in the past: the displayed sender can be spoofed.

Q: 1.10 Are there other techniques to watch out for?

Yes, and they target your device more than your wallet. Fake apps and browser extensions , published under the name of well-known wallets or exchanges, capture what you type or replace the address in your clipboard at the moment you paste it. Fake job offers in the crypto sector arrive with a “technical test” or a file to open that installs malware. Fake airdrops and “verifications” to unlock tokens exist to lead you to the malicious signature described in 1.4. SIM swapping , meanwhile, aims to have your mobile operator issue a new SIM with your number, in order to intercept codes sent by text: it’s one of the reasons an authenticator app is preferable to SMS (see answer 3.2). Only download apps and extensions from official stores and from links on the official website.

Question 1

1.1 What do scams generally look like?

Accepted Answer

Almost all of them follow the same pattern, whatever technology they use: the scammer builds credibility (posing as an agent, an adviser, an institution or someone you trust), creates urgency (“your account is about to be blocked”, “the offer expires within the hour”) and isolates you from any second opinion (“don’t tell anyone, this is confidential”). The end goal is always an irreversible action: a bank transfer, a crypto-asset send, an approval signature, a code handed over. If a request has all three ingredients — trust, haste, secrecy — stop: time is always on your side and never on the scammer’s. This technique is called social engineering, explained in the article What is social engineering and how to avoid it.

Question 2

1.2 Which scams are most common in the crypto sector?

Accepted Answer

There are six main families. Impersonation scams — someone pretending to be an exchange’s support team, your bank, a public body or a courier — are by far the fastest-growing category. Investment scams, including those built on a personal relationship (so-called pig butchering), remain the ones that take the most money. Phishing and wallet drainers aim to get you to hand over credentials or sign approvals that empty a self-custody wallet. AI and deepfake scams use cloned videos and voices. Recovery scams promise to retrieve funds you’ve already lost. Finally there are the techniques that target your identity and your device: SIM swapping, fake apps and browser extensions, job offers with infected files.

One useful clarification: these categories are increasingly blurred. The same organisations combine several tactics in a single operation — a text message imitating your bank can lead to a fake agent who convinces you to “secure” your funds in a wallet they control. To protect yourself, recognising the mechanism described in the previous answer matters more than classifying the scam. For an overview, read Phishing, Ponzi schemes and other scams.

Question 3

1.3 What is pig butchering (relationship investment fraud)?

Accepted Answer

This is currently the scheme causing the most serious losses. Contact comes from a stranger — a “wrong number” message on WhatsApp, a match on a dating app, a professional profile on LinkedIn — and for weeks money is never mentioned: a relationship of trust is built, romantic or friendly. Only then does the investment appear, on a platform that looks real, with a dashboard showing growing profits. The first small withdrawals work, to convince you to increase your stake. When you try to withdraw everything, “taxes”, “unlocking fees” or “verifications” appear — and they never end. The signal is unmistakable: no legitimate platform asks for additional payments to release your funds.

It’s worth knowing how it works on the other side: these aren’t lone opportunists but structured organisations operating from purpose-built compounds where the staff are often trafficking victims forced to work. International investigations in 2025 led to indictments and seizures worth billions. That’s why the person messaging you always seems available, patient and credible: it’s their full-time job, with scripts tested on thousands of victims.

Question 4

1.4 What are wallet drainers and malicious signatures?

Accepted Answer

These are the main threat for anyone using a self-custody wallet. The mechanism doesn’t involve stealing a password: you’re asked to connect your wallet and sign a transaction on a site that looks like a legitimate project — an airdrop, an NFT mint, a DeFi platform, a “verification” requested via Discord or X. That signature isn’t a login: it’s an approval that allows the contract to withdraw your crypto-assets, even long afterwards. Practical rules: always read what you’re signing (if the request grants unlimited access to your tokens, refuse), never connect your wallet to sites reached through links in messages or comments, and revoke approvals you no longer use on a regular basis. Crypto-assets held on Young Platform are not exposed to this risk, which concerns self-custody wallets.

Question 5

1.5 What are deepfake and AI-powered scams?

Accepted Answer

AI has made two previously rare techniques cheap. The first is deepfake video: well-known figures — entrepreneurs, journalists, familiar television faces — appearing in a sponsored social media video to announce a “guaranteed” investment platform. The video is fake, and so is the platform. The second is voice cloning: a few seconds of audio are enough to replicate a real person’s voice, then used in calls simulating a relative in trouble or a bank employee.

This isn’t a technical footnote: operations using AI tools take several times more money on average than those that don’t, because they make credible what previously wasn’t. Always verify through a channel other than the one the contact arrived on: call the official number yourself, look for the announcement on the official website of the company mentioned. And remember that a video, however realistic, proves nothing: a genuine investment is never promoted with a promise of guaranteed returns.

Question 6

1.6 What is address poisoning?

Accepted Answer

This scam exploits the habit of copying addresses from your transaction history. The scammer sends you a tiny amount from an address built to resemble one you use often (same first and last characters, different in the middle). When you later copy the address from your history, you risk taking theirs. Defence: check the entire address, not just the beginning and the end, use your saved address book rather than your history, and for significant amounts always send a small test transaction first. The deep dive is in Address poisoning: what it is and how to protect yourself.

Question 7

1.7 What is smishing and what about fake messages from banks and public bodies?

Accepted Answer

Smishing is phishing by text message, and it’s currently one of the most heavily used impersonation channels. The messages imitate organisations you trust out of habit — your bank, a courier holding a parcel, the tax authority, a road toll or fine to pay — and contain a link to a clone site that harvests your data and credentials. They aren’t amateur efforts: kits sold as a service allow hundreds of thousands of messages to be sent per day, impersonating dozens of different brands with perfectly translated clone sites.

Two practical defences: no institution or bank asks for data, payments or codes through a link in a text message, and verification should always be done by opening the official app yourself or typing the website address — never by tapping the link you received. Be careful too with messages that appear inside the same conversation thread as legitimate texts you’ve received in the past: the displayed sender can be spoofed.

Question 8

1.8 What is the fake support scam?

Accepted Answer

The scammer poses as customer support — of an exchange, a wallet, sometimes your bank. It may come from a social profile replying under a public comment of yours, from a Telegram or Discord group where you asked for help, from a number that looks official, or from a paid advert appearing when you search for “support” on a search engine. Then comes the request for your password, a 2FA code, your recovery phrase, or an invitation to install remote-control software “to help you”. None of these requests is legitimate.

These scammers may know your name, your email and even operations you genuinely carried out: such data circulates after breaches of other services and, in documented cases abroad, has been obtained by bribing employees. Knowing something about you proves nothing — verification lies in the channel the contact comes from, not in the information the other party appears to hold.

If you need help, always start from the official app or website: never let whoever answers first be the one to contact you.

Question 9

1.9 What is a recovery scam?

Accepted Answer

This is the second scam that targets people who have already been scammed. Shortly after the loss — often because the victim described what happened in a public group — someone appears claiming to be a “crypto recovery” service, a blockchain investigator, an ethical hacker or a specialist lawyer, promising to bring the funds back in exchange for an upfront payment. The result is a second loss. Nobody can reverse an on-chain transaction: the only routes are reporting to the authorities and notifying the platforms involved, neither of which requires an advance payment.

Question 10

1.10 Are there other techniques to watch out for?

Accepted Answer

Yes, and they target your device more than your wallet. Fake apps and browser extensions, published under the name of well-known wallets or exchanges, capture what you type or replace the address in your clipboard at the moment you paste it. Fake job offers in the crypto sector arrive with a “technical test” or a file to open that installs malware. Fake airdrops and “verifications” to unlock tokens exist to lead you to the malicious signature described in 1.4. SIM swapping, meanwhile, aims to have your mobile operator issue a new SIM with your number, in order to intercept codes sent by text: it’s one of the reasons an authenticator app is preferable to SMS (see answer 3.2). Only download apps and extensions from official stores and from links on the official website.

Question 11

2.1 Would Young Platform message me on Telegram?

Accepted Answer

No, never for support. Young Platform’s official Telegram channel is dedicated solely to company announcements: no member of the team will contact you privately on Telegram. Be wary of anyone presenting themselves as a representative or employee in a chat, even if the profile uses our logo, a similar name and has many followers in the channel.

Question 12

2.2 Would Young Platform call me on the phone?

Accepted Answer

No. Young Platform does not make calls to ask for data, codes or operations on your account. If you receive such a call — even if the number displayed looks local or institutional, because numbers can be spoofed — hang up and contact support through the official channels.

Question 13

2.3 How might scammers contact me?

Accepted Answer

Through any channel: calls, text messages, emails, social media messages, Telegram and Discord groups, comments under posts, sponsored adverts and even paid results in search engines. They often already know some of your details — your name, your email, the fact that you use a particular platform — because these come from lists stolen elsewhere: the fact that they know something about you doesn’t prove they are who they claim to be. The warning sign isn’t the channel but the request: codes, passwords, recovery phrases, software installations, “urgent” transfers to “safe” wallets.

Question 14

2.4 Who can I share my passwords and codes with?

Accepted Answer

Nobody, under any circumstances. Passwords, two-factor authentication codes and the recovery phrase of a self-custody wallet must never be shared with anyone — not with support, not with law enforcement, not with someone offering to help you “secure” your funds. Young Platform staff will never ask for them, and don’t need them to help you.

Question 15

2.5 How do I recognise fake social media profiles?

Accepted Answer

Fake profiles imitate the name and image of official ones with minimal differences: an extra character, an underscore, a different domain in the bio link. Recurring signals: recently created profile, few original posts, automated comments under official posts inviting you to message privately, contact requests in DMs. Always verify starting from the links on the official youngplatform.com website rather than from the social platform’s own search: the channels reachable from there are the only official ones.

Question 16

2.6 How do I recognise and avoid fake websites?

Accepted Answer

Clone sites replicate the original’s design and content, changing only the domain: substituted characters, different extensions, subdomains containing the brand name. Always check the domain in the address bar before entering your credentials, and don’t rely on the padlock: it only certifies that the connection is encrypted, not that the site is genuine. The most effective defence is not to arrive there via a link: bookmark the official site and use the app downloaded from official stores. Watch out too for sponsored search results, a routine distribution channel for clones.

Question 17

3.1 How do I choose and store my passwords?

Accepted Answer

A secure password is long, unique and random: length matters more than complexity, and reuse is the biggest risk — if a password used elsewhere ends up in a breach, it gets tried automatically across dozens of services. Use a password manager to generate and store them, avoid saving them in a shared browser or in text files, and never keep passwords and recovery codes in the same place. For the criteria and the tools, read Security: how to manage your passwords.

Question 18

3.2 How do I protect access with two-factor authentication?

Accepted Answer

Two-factor authentication adds a second element beyond your password and is the most effective protection against unauthorised access. Prefer an authenticator app (or a passkey, where available) over SMS: text message codes are exposed to the SIM swapping described in 1.10. Keep your backup codes somewhere safe and offline. To set it up, follow the guide Set up two-factor authentication with an Authenticator app; if you aren’t receiving verification texts, see I’m not receiving two-factor verification texts. On Young Platform you can also enable DeviceKey, which ties access to your own devices: the procedure is in Setting up DeviceKey.

Question 19

3.3 How do I monitor logins to my account?

Accepted Answer

From your account’s security settings you can check active devices and sessions and review recent logins. If you don’t recognise a device or a location, end the session, change your password and contact support: the full procedure is in the guide What do I do if there’s an unusual login.

Question 20

3.4 How do I protect my DeFi Wallet and recovery phrase?

Accepted Answer

The DeFi Wallet is self-custody: your crypto-assets are controlled solely by your recovery phrase, which must never be photographed, saved to the cloud, typed into a website or shared with anyone — whoever holds it has total and permanent access to the funds. No legitimate “verification”, “migration” or “unlocking” procedure requires you to enter your recovery phrase: that request alone identifies a scam. What’s said in 1.4 about malicious signatures also applies: only connect your wallet to sites you know, and revoke unused approvals regularly.

Question 21

3.5 What other precautions can I take?

Accepted Answer

A few habits dramatically reduce your risk: always send a small test amount before a significant transfer; check the entire destination address, not just the first and last characters; don’t use public Wi-Fi for account operations; keep your operating system, apps and browser updated; install only from official stores; be sceptical on principle of any “guaranteed” return; and don’t publicly share the fact that you hold crypto-assets, or screenshots of your balances — that’s the information targets are selected on.

One further caution concerns crypto ATMs: they’re legitimate, but scammers frequently point victims towards them as a way to “secure” savings or pay a supposed emergency, because they convert cash into crypto-assets instantly and in a way that’s hard to trace. If someone on the phone is guiding you towards one of these machines, it’s a scam — no exceptions. It’s one of the schemes that most often targets older people: if you have relatives who could be targeted, talking to them in advance is the most effective defence.

Question 22

4.1 What do I do if someone calls claiming to be an agent?

Accepted Answer

Hang up. Don’t provide any details, don’t install anything, don’t carry out operations while you’re on the phone — pressure to act “right now, while we’re on the line” is the definitive sign of a scam. If in doubt, contact support through the official channels in the app: no legitimate request gets worse because you hung up to check.

Question 23

4.2 What do I do if I receive a suspicious email or text message?

Accepted Answer

Don’t click on links and don’t open attachments. Check the sender’s full domain and remember it can be spoofed: verification must be done by opening the official app or typing the website address yourself, never through the message. Report the message as phishing in your email client and delete it. If the message mentions Young Platform, forward it to support@youngplatform.com: your reports help us get fraudulent content taken down and warn other users.

Question 24

4.3 What do I do if I notice an unusual login?

Accepted Answer

Act immediately, in this order: change your password, end any active sessions you don’t recognise, check that two-factor authentication is active and hasn’t been altered, verify that your contact details (email and phone number) are still yours, and contact support through the official channels to report what happened.

Question 25

4.4 What do I do if my password has been compromised?

Accepted Answer

Change it immediately on Young Platform and, if you had reused it, on every other service where it was in use — starting with your email account, which is the key to recovering all the others. Then end active sessions and check the status of your two-factor authentication as described in the previous answer.

Question 26

4.5 What do I do if I’ve already sent funds to a scammer?

Accepted Answer

Move fast, but don’t look for shortcuts. Cut off all contact with the scammers and don’t make any further payments, including sums demanded to “unlock” what you’ve already sent. Gather all the evidence: messages, wallet addresses, transaction receipts, names and links of the platforms involved. Report it to the authorities — in Italy through the Polizia Postale’s online police station (commissariatodips.it) or at any police office; elsewhere, through your local police or national cybercrime reporting service — and notify Young Platform support and the support teams of any other platforms involved. If the payment left a bank account or a card, tell your bank straight away. Finally, be wary of anyone who contacts you promising to recover the funds: that’s the scam described in 1.9. Reporting is worthwhile even when the sum seems small or unrecoverable: investigations are built by cross-referencing many reports, and in 2025 cases of exactly this kind led to record crypto-asset seizures.

Question 27

4.6 How can I report a scam using the Young Platform name?

Accepted Answer

Report it to support through the official channels, attaching screenshots, links and any useful references: user reports are one of our main tools for identifying fraudulent profiles and sites and having them taken down. If the scam involves an investment proposal, you can check whether the operator is authorised by consulting the public registers of Consob, the Italian securities regulator, which also publishes orders blocking unauthorised websites; if you’re based elsewhere, check with your national financial regulator.

Question 28

4.7 What does Young Platform do to protect its users?

Accepted Answer

Young Platform is authorised by Consob and Banca d’Italia as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114 (MiCA) and is subject to the related security, organisational and custody obligations.

In practice, this means three things. Identity verification (KYC): every account is verified before it can operate, so the platform isn’t open to anonymous profiles or to accounts created with someone else’s documents. A dedicated AML team, monitoring transactions to spot movements linked to fraud or money laundering and to step in when something doesn’t add up. And a customer care team you can turn to at any time: if you have even the slightest doubt about an operation, write to us before you carry it out — that’s the moment when we can genuinely help, because once crypto-assets have been sent the transaction cannot be reversed. No question is too small: we’d rather field a thousand extra checks than see one more scam.

All the security measures Young Platform has in place are described on our security page.

FAQ: Security

How scams work today