Crypto scams: how to spot and report them

Cryptocurrencies have become one of scammers’ favorite tools. In the United States, where detailed public statistics exist, crypto-related losses made up more than half of all losses reported to the FBI in 2025. In Brazil, the Comissão de Valores Mobiliários (CVM, Brazil’s securities regulator) frequently issues warnings about unauthorized offers that use the theme.

This article covers the most common scam patterns, the red flags that recur in official documents, how to check an offer, what Brazilian law says and where to report. If you are still getting to grips with the basics, start with what Bitcoin is.

The size of the problem

The most complete figures come from the United States. They do not describe Brazil, but they show the pattern.

• FBI. The 2025 annual report of the Internet Crime Complaint Center (IC3) recorded 181,565 complaints involving cryptocurrencies and US$ 11.366 billion in losses, up 22% from 2024. Total losses across all complaints were US$ 20.877 billion. The largest category was crypto investment fraud: 61,559 complaints and US$ 7.228 billion (FBI IC3, 2025 annual report).
• FTC. The US Federal Trade Commission received 3 million fraud reports in 2025, with US$ 15.9 billion in reported losses. Investment scams led, with more than US$ 7.9 billion. By payment method, crypto ranked second in losses, behind only bank transfers (FTC, congressional testimony, March 2026). Almost 30% of those who lost money said the scam started on social media, and investment scams accounted for US$ 1.1 billion of losses originating on social media (FTC, April 2026).
• Chainalysis. The blockchain analytics firm estimated in January 2026 that crypto scams received at least US$ 14 billion in 2025, a figure that may exceed US$ 17 billion as new wallets are identified. Impersonation scams, in which the criminal pretends to be a company or an authority, grew more than 1,400% over 2024 (Chainalysis, 2026 Crypto Crime Report). These are the company’s own data and estimates, based on its own methodology.

All these numbers count only what was reported or traced. The editorial team did not find an equivalent consolidated public statistic for Brazil.

The most common patterns

Scams change names, but they repeat a handful of structures. A single scam often combines several of them.

Pyramid schemes and Ponzi schemes

The CVM distinguishes between the two (CVM, irregular offers and activities):

• In a pyramid scheme, the “profits” of earlier participants are paid with money from those who join later, and each participant is encouraged to recruit new ones. The structure is unsustainable and collapses when inflows slow down.
• In a Ponzi scheme, there is no real investment either, but the victim does not need to recruit anyone. They simply put money in and receive “returns” paid with other victims’ money.

In crypto, the story is usually a trading bot, an arbitrage operation or “mining” that would yield a fixed percentage each month. The CVM reports promises of returns of “10%, 20% or even 60% a month” in offers linked to crypto assets and forex (CVM, crypto assets and forex).

Fake exchanges and investment platforms

The website or app imitates a real exchange. The balance grows on screen, but no real trading takes place. A joint warning from the SEC and the CFTC, US regulators, describes sites that promise returns of 20% to 50% with little or no risk and, when the victim asks to withdraw, demand payment of “fees” or “taxes” before releasing the money (SEC and CFTC, warning about fake websites). The CVM issues the same warning: be suspicious of charges to “release a batch” or of taxes to unlock withheld balances.

The relationship scam

Known as pig butchering, it begins with a message apparently sent by mistake, or a contact on social media or a dating app. According to a 2023 alert from FinCEN, the US Treasury’s financial intelligence unit, the scammer builds trust over weeks, sometimes with a profile flaunting wealth, and only then presents a crypto “opportunity”. The victim is steered to a fake platform, sees made-up profits and may even withdraw a small amount, which encourages them to deposit more (FinCEN, FIN-2023-Alert005).

The FBI adds that when the victim tries to cash out, tax and fee charges appear as a final extraction before the scammers vanish (FBI IC3, 2025 annual report). FinCEN and the FBI note that these scams are largely run by criminal organizations in Southeast Asia that use human trafficking victims as forced labor.

Pump and dump

In this scheme, a group buys a thinly traded coin, runs coordinated promotion on social media and messaging groups, sometimes with fake news about a famous investor, and sells at the peak. Those who bought because of the hype are left with a coin that plunges. According to the CFTC, the whole cycle can last just a few minutes (CFTC, pump and dump warning). The agency points out that there is “no such thing” as an investment strategy with a guaranteed return.

Fake support and impersonation

The scammer poses as customer service for an exchange, a bank or a government agency. They say your account has been hacked and ask you to move your coins to a “safe” wallet, share access codes or install remote access software. In 2025, the FBI recorded 17,355 complaints of crypto-related tech support or customer service scams, with about US$ 1.23 billion in losses, the second-largest loss among categories involving crypto. Chainalysis, for its part, reports that impersonation scams, which include fake exchange support agents, grew more than 1,400% in the year.

The recovery scam

The first scam is followed by a second. Supposed law firms, tracing companies or even fake public officials promise to recover the lost money in exchange for an upfront payment. The FBI received 10,516 complaints of this kind in 2025, with about US$ 1.4 billion in losses, and issued warnings about scammers impersonating the IC3 itself.

Red flags that keep recurring

Cross-checking warnings from the CVM, the SEC, the CFTC and FinCEN, a few signs appear in almost all of them:

1. High, fixed or guaranteed returns. No legitimate crypto investment guarantees a return; prices swing widely and can fall to almost zero.
2. Pressure to decide quickly. Short deadlines, limited spots, “today only”.
3. Contact you did not ask for. A message from a stranger, a social media profile, a “mentoring” group on a messaging app.
4. Gains tied to bringing in new people. A sign of a pyramid scheme.
5. Withdrawals blocked or conditioned on a fee. Any charge to release your own money is a strong sign of fraud.
6. Requests for a password, recovery phrase, verification code or remote access. Legitimate support does not ask for these.
7. Transfers to an individual’s account or a wallet chosen by the “advisor”. The CVM advises against transferring money to accounts of employees or advisors.
8. A company without authorization from the competent authorities.

How to check before transferring

No check eliminates the risk, but some filter out a good share of frauds:

• Check with the CVM. The CVM’s general registry shows who is allowed to operate in the securities market. The regulator warns that checking the registration alone is not enough: make sure the contacts who spoke to you match those in the registry and confirm through the company’s official channels (CVM, irregular offers and activities).
• Look for warnings. The CVM publishes declaratory acts, known as stop orders, which order irregular offers to be suspended under penalty of a daily fine. There were 37 in 2025, compared with 13 in 2024 (CVM, April 2026). In November 2025, for example, a single act covered 24 unauthorized digital platforms, including offers made through social media (CVM, November 2025). The CVM’s warnings page also points to I-SCAN, the database of the international organization of securities regulators (IOSCO) with warnings from several countries (CVM, warnings to citizens).
• Use ContraGolpe. The tool launched in 2024 by the CVM with the Associação Brasileira de Criptoeconomia (ABcripto, the Brazilian crypto economy association) asks questions about the offer and returns guidance. According to the association itself, it does not guarantee the safety of the investment or replace your own research (CVM, October 2024).
• Check the exchange’s status with the Central Bank. Since 2023, the Banco Central do Brasil has been the regulator of virtual asset service providers, such as crypto exchanges and custodians (Decree 11,563/2023). Authorization rules published in November 2025 took effect on February 2, 2026 (Central Bank, November 2025), and companies already operating had until October 2026 to apply for authorization (Central Bank, Vote 107/2026). In the editorial team’s assessment, since this process is under way, having applied for authorization does not mean having been approved; check the company’s status directly on the Central Bank’s website.

A word of caution: authorization to operate is not a guarantee of returns. A regulated exchange can list coins that lose almost all their value.

What Brazilian law says

The references below apply to Brazil and were checked on October 8, 2026, on the website of the Presidency (Planalto). How each case is classified is up to the police, the Public Prosecutor’s Office and the courts.

• Fraud involving virtual assets (art. 171-A of the Penal Code). Added by Law 14,478/2022, it punishes anyone who organizes, manages, offers or distributes portfolios, or intermediates transactions with virtual assets, securities or financial assets, to obtain an unlawful advantage by inducing or keeping someone in error. The penalty is 4 to 8 years in prison and a fine (Penal Code, consolidated text). The law was published on December 22, 2022, and took effect 180 days later, in June 2023 (Law 14,478/2022).
• Money laundering. The same law amended Law 9,613/1998 to increase the penalty for laundering by one to two thirds when the crime is committed through a virtual asset, and added virtual asset service providers to the entities required to maintain anti-money laundering controls.
• Consumer protection. Law 14,478 establishes that the Consumer Protection Code applies, where relevant, to transactions in the virtual asset market.
• Pyramid schemes. Law 1,521/1951 treats as a crime against the popular economy obtaining unlawful gains at the expense of an indeterminate number of people through fraudulent processes such as “snowballs” and “chains”, punishable by 6 months to 2 years of detention and a fine (Law 1,521/1951).

Where to report in Brazil

If you have fallen for a scam or received a suspicious offer, act quickly and keep evidence: conversations, receipts, wallet addresses, profile names, websites and phone numbers.

• Your exchange or bank, immediately. If the transfer came from a regulated platform, notify it right away. Blockchain transfers generally cannot be reversed, but the platform may freeze accounts or pass information to the authorities.
• Civil Police. This is the standard route for filing a police report (boletim de ocorrência) for fraud.
• Federal Police. The Comunica PF channel receives reports of crimes under federal jurisdiction, such as those with interstate or international reach. The Federal Police itself warns that most reports it receives are not within its remit and, in those cases, advises going to the Civil Police. Anonymous reports are accepted but move more slowly (Federal Police, reporting crimes).
• CVM. For unauthorized investment offers, use the CVM’s Citizen Service (SAC), providing details of the offer and the identity of those involved. If in doubt, the CVM’s call center answers at 0800-025-9666 on business days.
• Public Prosecutor’s Office. According to the CVM, pyramid schemes are not within its jurisdiction and should be reported to the police and the Public Prosecutor’s Office (Ministério Público).

After reporting, be wary of anyone who shows up promising to recover the money for a fee. That is the recovery scam.

Key takeaways

• Crypto scams repeat a handful of structures: pyramid and Ponzi schemes, fake platforms, relationship scams, pump and dump, fake support and fake recovery.
• Guaranteed returns, urgency, unsolicited contact and fees to release withdrawals are the most consistent red flags in official warnings.
• Before transferring, check with the CVM and the Central Bank, look for warnings and confirm contacts through official channels.
• Fraud involving virtual assets has been a specific crime in Brazil’s Penal Code since 2023, punishable by 4 to 8 years in prison and a fine.
• Report to the Civil Police, to the Federal Police for federal cases, to the CVM and to the Public Prosecutor’s Office, and treat any paid “recovery” offer as a new scam.