How to Spot a Fake Crypto Exchange (Before It's Too Late)

This guide covers how to identify fake exchanges before you deposit, how to verify regulation in under two minutes, and what to do if you've already lost funds. Fake crypto exchanges are not obvious — they have professional interfaces, Trustpilot profiles, and sometimes even working deposit functions. The standard advice — "make sure it's regulated" — fails most people because they don't know how to actually verify a license.

If you're evaluating a new exchange right now, start with Section 3 before you send a single dollar. Jump to Section 3 for the specific domain and license checks.

This guide gives you the specific steps to check regulation, the red flags that appear at each stage of a scam, and what to do if you've already deposited. If you're evaluating a new exchange right now, cross-reference these checks with our guide.

---

Most scam exchange guides treat fake platforms as a single category. They're not. There are two distinct types, and the warning signs are different for each.

Never-legitimate platforms are built from day one to steal funds. There is no real trading infrastructure. Deposits go directly into wallets controlled by the operators. Withdrawal requests are stalled, fee-gated, or simply ignored. BitKRX is the documented example here — it posed as a branch of the Korean Stock Exchange, used that branding to manufacture credibility, and accepted deposits it never intended to return. No trade ever executed. The entire interface was theatre.

Exit scams are harder to catch because they start as real exchanges. They process withdrawals, build genuine user bases, and accumulate trust over time. Then something triggers the collapse — a large inflow event, regulatory pressure, or simply a decision that enough funds have accumulated. MyCryptoWallet, the Australian exchange that collapsed in 2022, had real users with real trading histories. When it shut down, those users had almost no warning and no recourse. The funds were gone. For a curated list of platforms with documented problems, see the exchanges to avoid guide.

This distinction matters for two reasons. First, the red flags are different. A never-legitimate platform will show problems immediately — withdrawal issues from day one, no verifiable history, manufactured reviews. An exit scam can look clean for months or years. Second, if you're already on one, your options differ. Exit scam victims have a paper trail — real transactions, real communications, a real legal entity that existed. That's more actionable than trying to pursue an anonymous operation that was fraudulent from the start.

For a broader view of how to evaluate exchanges before committing funds, the guide to choosing a crypto exchange on Trading365 is worth reading alongside this one.

---

"Check if it's regulated" is advice that sounds helpful and does almost nothing. Most people don't know which database to use, what to search for, or how to confirm a license number is real rather than fabricated. Here's how to actually do it.

The safest way to check regulated exchanges in your country is to go directly to register.fca.org.uk. In one case we reviewed, an exchange displayed a registration number that returned a result in the FCA register — but the legal name attached to that number belonged to an unrelated financial services firm. The license number was real; the claim was not. Search by the exchange's legal entity name — not its brand name. Cross-reference the registration number shown on the exchange's website against what appears in the register. If they don't match, stop.

Critically: search for the exchange name in the FCA's warning list. The FCA maintains a specific list of clone firms — operations that impersonate regulated entities using similar names, logos, and fake license numbers. BitKRX-style operations often copy legitimate registration details from real firms. Finding the name in the register is not enough if the license number doesn't match exactly.

Use EDGAR at efts.sec.gov to search registered entities. Separately, check the SEC's investor alert list — this is updated regularly and includes platforms the SEC has flagged without necessarily pursuing enforcement yet. Any exchange that isn't registered with the SEC — see top exchanges in the USA for platforms that are — is taking on legal exposure that can end in an abrupt shutdown. For European users, the 2026 MiCA deadline has introduced further compliance requirements worth checking before depositing.

The BrokerCheck tool at finra.org lets you search by legal entity name. Note: most crypto-only exchanges do not appear here, and that's not automatically a red flag. But if an exchange claims FINRA registration and you can't find it, that's a direct lie.

CySEC registration is commonly claimed by offshore exchanges — and commonly fabricated. Go to cysec.gov.cy/en-GB/entities and search by the exact license number the exchange provides. When we searched a CySEC number listed on one platform, the registered address in the database was a different city from the one shown on the exchange's own contact page — a mismatch that would be invisible without checking the primary source. Many scam exchanges list a real CySEC license number that belongs to a completely different firm. Verify that the license number, legal name, and registered address all match what the exchange shows on its site.

Check moneysmart.gov.au/scams. ASIC maintains an active warning list, and MyCryptoWallet appeared on it before its final collapse. If an exchange targeting Australian users isn't on ASIC's registered list and is on their warning list, that's definitive.

The rule: if an exchange claims regulation but cannot provide a verifiable license number that checks out in the official database, treat it as unregulated. "We are regulated" with no supporting detail is a marketing claim, not a legal status.

---

Scam exchanges don't show all their red flags at once. They appear at different points — before you sign up, during onboarding, and after you've deposited. Here's what to watch for at each stage.

Domain age: Run the exchange's domain through a WHOIS lookup at whois.domaintools.com or lookup.icann.org. If the domain was registered within the last 12 months and the exchange claims years of operation, something is wrong. Legitimate exchanges have domain histories that match their stated founding dates. We ran one flagged platform through WHOIS during research for this guide — domain registered four months prior, about page claiming three years of operation. That single check took under sixty seconds.

No verifiable legal entity: Every legitimate exchange has a registered company name, a jurisdiction, and a physical address that can be checked against corporate registry databases. If the "About" page lists no legal entity name, or the address doesn't correspond to a real registered business, that's a hard stop.

APK-only mobile access: If an exchange directs you to download its app via an APK file or a third-party app store rather than Google Play or the Apple App Store, don't install it. This bypasses the vetting processes both platforms apply. Financial apps distributed via APK are not subject to any security review.

When an exchange does have an app on Google Play or the App Store, check the publisher name. It must match the exchange's legal entity name exactly — not just the brand. Cross-check the download count: major exchanges have millions of installs. An exchange claiming to be one of the top platforms in the world with 50,000 downloads is misrepresenting itself.

On Android, you can go to Settings → Apps → select the app → App Info to find the certificate details. The signing certificate should match the developer entity. This is a step almost no one takes, which is exactly why cloned apps get away with it.

• Pressure to deposit within a time-limited window ("30% bonus if you fund today") is a psychological manipulation tactic, not a legitimate promotion
• Withdrawal lock mechanics buried in terms — bonuses that require a certain trading volume before withdrawal is unlocked are standard in scam operations. See what safe no-KYC exchanges actually look like for comparison.
• Any platform that makes you refer others before you can access basic trading functionality is structured as a recruitment scheme, not an exchange

This is where never-legitimate platforms reveal themselves. Watch for:

• Deposits credited instantly, withdrawals always "pending" — this is the operating model. Fake exchanges generate deposit addresses they control directly. Your funds move into their wallet the moment you send them. Withdrawals are stalled indefinitely.
• Sudden requirements to pay "withdrawal fees," "verification fees," or "insurance deposits" — if you're unsure whether your platform is legitimate, check the exchanges to avoid list — before your funds can be released. These fees do not exist on any legitimate exchange. They are the second phase of the scam — extracting more money from users who are already in.
• Your account going "under review" immediately after a large deposit. This is timed, not coincidental.

---

The operations that steal the most money are the ones that look the most credible. Here's how they build that credibility and how to see through it.

Trustpilot and similar platforms are heavily gamed by scam exchanges. The patterns to look for: Run the exchange name through Fakespot or ReviewMeta — both tools analyze review authenticity and flag manipulation patterns. One platform we checked had a 4.7-star Trustpilot rating; Fakespot flagged over 80% of the reviews as likely inauthentic, with a cluster posted on the same two days the domain was first indexed.

Admins or community members who DM you first to offer investment advice or "guidance." Legitimate exchange communities don't operate this way. An unsolicited DM directing you toward an exchange is a recruitment move, not community support.

Some fake exchanges are pixel-for-pixel copies of Binance, Coinbase, or Kraken. The interface looks identical because it is — the HTML is scraped and re-hosted. How to verify:

• Check the actual domain in the browser bar, not just the logo. Fake domains often use subtle character substitutions or added words.
• Check the SSL certificate issuer by clicking the padlock in your browser. The certificate should be issued to the exchange's legal entity, not a generic hosting provider.
• Read the footer legal text. Cloned sites often have inconsistencies — wrong company names, outdated copyright years, or legal text that references a different platform.

---

If you're on an exit scam, there is a paper trail — real transactions, a real legal entity, communications that can be submitted to regulators. That doesn't guarantee recovery, but it gives investigators something to work with.

---

Do not deposit more money. Any "fee" required to unlock your withdrawal — a tax, a verification charge, an insurance deposit — is the second phase of the scam. Paying it will not release your funds. It will simply cost you more money.

1. Screenshot everything before doing anything else: account balance, full transaction history, wallet addresses the exchange provided, every communication with support
2. Do not attempt to withdraw to another wallet yet — document the current state of your account first
3. Stop all communication with the exchange's support team — they are part of the operation, not neutral parties

US: - FTC: reportfraud.ftc.gov - FBI Internet Crime Complaint Center: ic3.gov - CFTC: cftc.gov/complaint

UK: - Action Fraud: actionfraud.police.uk - FCA ScamSmart: fca.org.uk/scamsmart

Australia: - ACCC Scamwatch: scamwatch.gov.au - ASIC: asic.gov.au

EU: - Europol Financial Intelligence: report via your national FIU or directly through Europol's online portal

You can also check whether your exchange is already flagged in Trading365's documented list before filing.

Be direct with yourself: crypto transactions are irreversible at the protocol level. If funds have left your wallet and reached an address controlled by the scam operation, the technical reality is that those funds are gone. Reporting to authorities is still worth doing — it contributes to investigations that can lead to enforcement action and potentially asset freezes — but it is not a reliable path to personal recovery.

Any service that contacts you after a scam and charges upfront fees to recover funds is itself a scam — treat any approach as a red flag. We have seen cases where victims of fake exchanges were contacted within days by "recovery specialists" who had clearly obtained their details from the same operation — a second scam layered directly onto the first.

---

The practical outcome of all of this is that exchange selection matters more than most people treat it. Using a well-established exchange with a verifiable regulatory status, a real corporate entity, and years of documented operation eliminates the vast majority of the risk described here.

Trading365 reviews exchanges against specific criteria — not just whether they claim regulation, but whether those claims check out, what their fee structures look like, how withdrawals actually behave, and where they fall short.

If you're starting fresh, Binance and Kraken are the two platforms that pass every check above. For no-KYC options, see the best no-KYC exchanges guide — including a MEXC review if you're evaluating that platform. Or compare all reviewed exchanges to find the right fit for your region.

---

The protection is not skepticism — it's verification. Check the domain age. Verify the license number against the actual regulator's database. Confirm the app publisher matches the legal entity. Look for withdrawal issues before you deposit anything significant.

If you're starting fresh or moving away from a platform you're unsure about: Binance and Kraken pass every check above. Both have verifiable regulatory status, real corporate entities, and documented withdrawal behaviour. Find a legitimate exchange →