How to Spot a Crypto Scam in 2026: A UK Guide to Staying Safe

UK losses to crypto fraud are not a fringe concern. Action Fraud recorded over £329 million in crypto-related losses from UK victims in 2024 alone. The real figure is higher — most people never report it. The scams are getting more sophisticated, more targeted, and harder to spot than they were even two years ago. This guide covers exactly what the most common crypto scams look like in 2026, the red flags that reveal them, and what to do if you have already been caught out.

How Big Is the Problem?

Crypto fraud has grown sharply alongside mainstream adoption of digital assets. When I spoke to an investigator at a UK fraud recovery firm last year, they told me something that stuck: the average victim of a sophisticated crypto scam loses £32,000 before they realise what has happened. Not £500. Not £2,000. Thirty-two thousand pounds, often built up over weeks or months of what felt like a genuine investment relationship.

The FCA’s 2025 consumer research found that 14% of UK adults held some form of cryptocurrency — up from 10% in 2022. More people holding crypto means more targets. The scammers follow the money, and right now, a lot of UK money is moving into digital assets for the first time. First-time investors who do not yet understand how crypto wallets, transactions, and platforms actually work are particularly at risk.

The National Cyber Security Centre (NCSC) has flagged crypto investment fraud as one of the top five cybercrime categories affecting UK consumers. The FCA has added over 1,400 crypto firms to its warning list since 2020. Despite this, thousands of UK residents are defrauded every month.

The Most Common Crypto Scams Right Now

The scam landscape shifts constantly as fraudsters adapt to platform crackdowns and public awareness. These are the most active types targeting UK investors in 2026.

Pig butchering scams are the most devastating category. The name comes from the idea of fattening a pig before slaughter. A scammer — often based in Southeast Asia in organised fraud compounds — contacts you via text, WhatsApp, LinkedIn, or Instagram, appearing to have messaged you by accident. They build a relationship over weeks or months. They are warm, intelligent, patient. Eventually they mention their incredibly profitable crypto investment strategy. You invest a small amount. It appears to grow dramatically. You invest more. Then more. When you try to withdraw, there are fees to pay, taxes to clear, compliance forms to file — always one more barrier before you can access your money. Eventually the platform disappears and so does your contact.

Fake investment platforms are professional-looking websites and apps that mimic legitimate exchanges. They show you real-time price feeds and impressive-looking portfolio dashboards. Your balance grows. The problem is that the money never leaves the scammers’ control. Withdrawals are impossible or blocked by fabricated compliance requirements. The domain is typically six months old, registered offshore, with no FCA authorisation. Always check the FCA register before depositing anything on an unfamiliar platform.

Rug pulls happen in decentralised finance. A new token launches with a flashy website, heavy social media promotion, and promises of revolutionary technology. Investors pour money in. The founders — anonymous or using stolen identities — drain the liquidity pool and disappear. The token price collapses to zero in minutes. UK investors lost an estimated £240 million to DeFi rug pulls in 2024, according to on-chain analytics firm Elliptic.

Pump and dump schemes involve coordinated groups artificially inflating the price of a low-value token through coordinated buying and promotion, then selling at the peak and leaving everyone else holding rapidly depreciating tokens. Telegram groups promising “next 100x gem” signals are almost universally pump and dump operations. The promoters get in early and exit before publicly signalling the token.

Phishing attacks target existing crypto holders. A convincing fake email from “Coinbase Support” or “MetaMask Security” warns you of a security issue with your account and asks you to click a link and enter your seed phrase or private key. Hand over your seed phrase and your entire wallet can be emptied in seconds. No legitimate platform will ever ask for your seed phrase under any circumstances.

Recovery scams target people who have already been defrauded. Fraudsters posing as recovery specialists or blockchain investigators contact victims — sometimes within days of a scam completing — and claim they can trace and retrieve your stolen crypto for an upfront fee. They cannot. They take the fee and disappear. Victims get scammed twice.

Seven Red Flags That Signal a Scam

These warning signs appear in the vast majority of crypto fraud cases. Any single one of them should prompt serious caution. More than one means stop entirely.

1. Guaranteed returns. Crypto is volatile by nature. Anyone promising guaranteed profits — “earn 3% daily”, “minimum 20% monthly returns” — is either deluded or lying. Legitimate investments never guarantee returns. Full stop.

2. Pressure to act immediately. “This offer expires in 24 hours” or “the price is about to spike, you need to move now” are classic manipulation tactics designed to prevent you from thinking clearly or checking independently. Real investment opportunities do not vanish overnight.

3. No FCA registration. Any business offering investment products or financial services to UK consumers must be authorised by the FCA. Check the FCA register at register.fca.org.uk before depositing anything. If the platform is not there, it is operating illegally.

4. Withdrawals are always blocked. If you cannot withdraw your money — for any reason, including “tax compliance”, “security verification”, “fee payment”, or “account upgrade” — the platform is a scam. Legitimate platforms process withdrawals without inventing barriers.

5. Anonymous or unverifiable team. Legitimate crypto projects have named, identifiable founders with verifiable professional histories. If the team behind a project is anonymous, uses stock photos for headshots, or has LinkedIn profiles created within the past few months, treat it as a major warning sign.

6. Unsolicited contact about investment opportunities. Nobody randomly messages strangers on WhatsApp to share a profitable investment strategy out of the goodness of their heart. Unexpected contact about any investment opportunity — especially from someone who “messaged the wrong number” — is almost always the opening move of a pig butchering scam.

7. Celebrity endorsement that seems off. Deepfake videos of Elon Musk, Martin Lewis, or Richard Branson supposedly endorsing a crypto platform have flooded social media since 2023. If a famous person is promoting a crypto investment opportunity in a video online, verify it through their official channels before treating it as genuine. The odds are extremely high that it is a fabricated endorsement.

How to Verify a Crypto Project Before Investing

Legitimate crypto projects leave a verifiable trail. Scams either leave no trail at all, or one that falls apart under scrutiny. Here is how to check before committing any money.

Check the FCA register at register.fca.org.uk. If the platform offers investment services and is not listed, it is breaking UK law and your money has no protection. Also check the FCA warning list, which lists known unauthorised firms and clones of legitimate businesses.

Research the team. Search their names on LinkedIn. Look for GitHub contributions if it is a technical project. Check whether they have spoken at industry events. Founders of legitimate projects tend to have visible, verifiable professional histories.

For DeFi tokens and protocols specifically, check whether the smart contract has been independently audited by a reputable security firm such as Trail of Bits, ConsenSys Diligence, or Certik. Find the audit report and read the findings. A missing audit is a serious red flag for any new DeFi protocol.

Look at the token distribution. If the founding team controls more than 30-40% of total token supply, they have the ability to crash the price by selling at any point. Check token vesting schedules — if founders can sell immediately after launch, they have every incentive to pump and dump.

Check how long the domain has been registered using a WHOIS lookup tool. Most scam platforms register their domains within the past 6-12 months. Check whether the company is registered at Companies House if it claims to be UK-based.

What to Do If You’ve Been Scammed in the UK

If you realise you have been defrauded, act quickly. Stop all payments immediately. Do not pay any further fees, taxes, or compliance charges — these are part of the scam.

Report to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040. This is the UK’s national fraud reporting centre. Your report contributes to intelligence that helps investigators identify and disrupt fraud networks.

Report to the FCA via their ScamSmart service at fca.org.uk/scamsmart. If the fraudsters were posing as FCA-regulated firms, the FCA wants to know immediately so they can add warnings and assist with investigations.

Contact your bank without delay. If you transferred money from a UK bank account, report it as fraud immediately. Banks have obligations under the APP fraud reimbursement scheme introduced in 2024 to consider reimbursing victims of authorised push payment fraud in many circumstances. The earlier you report, the better your chances of any recovery through this route.

Do not engage recovery scammers. After being defrauded, you may be contacted by people claiming to specialise in recovering stolen crypto. They cannot recover your funds. They will take a fee and vanish. Legitimate blockchain analytics firms do exist, but they work with law enforcement rather than charging upfront fees to victims directly.

The FCA’s Crypto Warning List

The FCA maintains a public list of firms operating without authorisation that it has identified as targeting UK consumers. By mid-2026, over 1,400 crypto-related entities appeared on this list — more than any other financial product category. The list is not exhaustive. Scam platforms launch and disappear constantly, and the FCA can only list firms it has already identified.

Before using any crypto platform you have not independently verified, check fca.org.uk/scamsmart and search the firm’s name. Also check whether the firm is listed as authorised on the main FCA register. Being absent from the warning list does not mean a platform is legitimate — it may simply not have been flagged yet.

The FCA also runs a dedicated ScamSmart campaign with resources specifically for crypto investors. Their five questions — Is it regulated? Did they contact you out of the blue? Is it too good to be true? Are they pressuring you? Are they registered in the UK? — are a useful starting checklist.

What This Means for UK Investors

Crypto scams are well-funded, professionally organised, and increasingly sophisticated. The days of obvious misspellings and laughably fake websites are largely over. Modern fraud operations run polished platforms, generate convincing trading data, and employ social engineers who can maintain a convincing relationship for months before making their move.

The defences are not complicated. Use only FCA-registered or major internationally regulated exchanges. Never share your seed phrase with anyone. Verify every investment opportunity independently before committing funds. If you are feeling pressured or rushed, take that as a signal to slow down completely and check everything.

The UK has some of the strongest fraud reporting infrastructure in the world. Use it. If something feels wrong, it almost certainly is.

This article is for educational purposes only and does not constitute financial advice. Cryptocurrency investments involve significant risk. Always do your own research.