AI Is Making Crypto Scams Harder to Spot: Key Warning Signs

Crypto fraud increasingly depends on making a false contact feel familiar and urgent. Generative AI can help scammers write fluent messages, imitate a known voice or manipulate video, while personal details drawn from public profiles or past messages can make a pitch sound tailored. For users, the practical consequence is that polished language and a recognizable face are weak evidence of who is actually contacting them.

BITmarkets has published a guide to recognizing crypto scams and responding to suspicious contact. The material focuses on impersonation, requests for access credentials and attempts to persuade users to move funds. Its central safety principle is to verify a request through a separate, trusted route instead of relying on the contact that made the request.

What the reported figures show

Chainalysis's 2026 Crypto Crime Report estimates that addresses linked to crypto scams received at least USD 14 billion during 2025. The firm expects the figure to exceed USD 17 billion as it identifies additional illicit addresses. It also reports that impersonation scams grew by more than 1,400% compared with 2024.

The report offers another measure of how AI may affect scam operations. Operations with demonstrable on-chain links to AI vendors extracted an average of USD 3.2 million per operation, compared with USD 719,000 for operations without those links. That is about 4.5 times as much revenue per operation in the reported comparison.

Those figures have limits. The comparison covers operations with demonstrable links to AI vendors; it does not measure every scam that may have used AI. The reported difference also does not, by itself, establish that AI caused the higher revenue. It does point to a concern for users and platforms: tools that help produce messages or manage conversations may let a scam operation approach more people with more tailored contact.

Why familiar support messages can mislead

A fraudulent message may claim an account is compromised or a withdrawal needs attention. The sender might use a target’s name, mention real account details, or write naturally in the target’s language. Such details can come from data breaches, public social media profiles or earlier exchanges. Their accuracy can make an approach feel credible, but it does not verify the sender.

Voice and video add another layer of uncertainty. A familiar voice on a call, or a face that resembles someone the user knows, can be cloned or manipulated. That makes a call harder to authenticate by appearance or sound alone. Automated messaging can also allow a single operation to sustain many individualized conversations at once, broadening its reach.

Here’s the thing: a convincing interaction still needs an independently verified channel. If a contact claims to represent a platform, bank or person you know, end that exchange and find a way to reach the organization or person using details you already trust. Don’t use links, phone numbers or accounts supplied in the suspicious message to check whether it is genuine.

Requests that warrant a pause

BITmarkets’ checklist highlights several requests that should prompt users to stop and verify before acting. A single warning sign does not prove that a message is fraudulent, but it can justify treating the request as suspicious:

• Unsolicited contact: Someone reaches out about a problem you did not report, such as an account issue or a pending withdrawal.
• Passwords and authentication codes: The sender asks for a password, two-factor authentication code, SMS code, seed phrase or private key. These details can give someone access to an account or wallet.
• A “safe” or recovery wallet: You are told to transfer assets to a secure, verification or recovery wallet. The guide identifies this as a common impersonation tactic.
• Payment to release funds: A fee, tax or deposit is demanded before an account can be unlocked, a withdrawal released or previously lost funds recovered.
• Pressure to act immediately: A short deadline is attached to a claimed threat of loss, account closure or legal action.

Urgency can narrow the time a person has to check a claim or ask someone else to review it. Requests involving credentials or transfers deserve particular caution because a mistaken disclosure or transaction can have consequences that are difficult to reverse. A request that sounds plausible still merits a check through a separate channel.

Preparation and response

The full Crypto Scam Safety Guide includes steps for suspicious contact, guidance for users who have already shared information or sent funds, and suggestions for protecting an account before an incident. The article also advises users to check web addresses and use verified ways of contacting a service when in doubt.

For anyone who thinks they have disclosed credentials or transferred assets, the useful next step is to follow the response guidance in the provider’s established support channel as soon as possible. Keep records of the message and relevant transaction details; they may help when explaining what happened. Avoid paying a new fee to someone who promises to recover funds, since the source specifically flags advance payments for recovery as a warning sign.

BITmarkets describes itself as a cryptocurrency exchange offering 24/7 support and trading in more than 200 cryptocurrencies, along with market updates and educational materials. The company says 99.9% of client funds are held in cold storage. Those are company-provided descriptions and should be considered separately from the report’s figures on scam activity. The company’s general site is at www.bitmarkets.com, and its listing is on CoinMarketCap.

BITmarkets warns users to check for impersonating websites, messages and social accounts using its name or logo. It says it will not request sensitive information through unsolicited messages and directs users with doubts to its support desk. In practice, the broader lesson applies across crypto services: familiar branding, personal details and a persuasive voice can all be copied. The channel and the requested action deserve independent scrutiny before a user shares access information or moves assets.