Day 6: Scams and how to avoid them
Most losses are not market crashes but scams. Today: the patterns that keep catching people in India. About 5 minutes.
1. Pig butchering scam
A pig butchering scam is a long-con investment fraud in which scammers build a relationship with a victim over weeks or months, then persuade them to invest in crypto through a fake platform. The name comes from the Chinese phrase "sha zhu pan", likening the process to fattening a pig before slaughter. It often starts with a "wrong number" message, a dating-app match or a friendly contact on WhatsApp, Telegram or LinkedIn. The scammer eventually mentions their success trading crypto and guides the victim to an app or website that shows impressive fake profits. Small early withdrawals may be allowed to build trust. When the victim invests larger sums, withdrawals are blocked with demands for "taxes" or "fees", and the money is gone. Warning signs include strangers steering conversations to investments, guaranteed returns, unfamiliar trading apps and requests to send crypto to a personal wallet. Legitimate exchanges do not need you to pay fees upfront to withdraw.
In India: Indian investors are heavily targeted by task-based and investment-group scams on WhatsApp and Telegram. Use only exchanges registered with FIU-IND. Report fraud on cybercrime.gov.in or call 1930.
More on Pig butchering scam →2. Phishing and wallet drainers
Phishing tricks you into giving away credentials or approving malicious actions by pretending to be a trusted service. In crypto it often involves fake exchange login pages, look-alike wallet apps, fake support agents on Telegram or X, sponsored search ads for counterfeit sites and emails about "suspicious activity". "Wallet drainers" are malicious websites that ask you to connect your wallet and sign a transaction or message. The signature can grant unlimited permission to move your tokens. Once signed, funds can be taken in seconds, and blockchain transactions cannot be reversed. Protect yourself: type addresses yourself or use bookmarks, never share your seed phrase, read what you sign, revoke unused token approvals, use a hardware wallet for savings, and treat any urgent or too-good-to-be-true message as a scam.
In India: Report crypto fraud in India at cybercrime.gov.in or by calling the 1930 helpline as quickly as possible.
More on Phishing and wallet drainers →3. Rug pull
A rug pull is a scam in which the creators of a crypto project abandon it and take investors' money, metaphorically pulling the rug out from under them. Common forms include draining a token's liquidity pool on a decentralised exchange, minting and dumping a huge hidden supply, and writing token contracts that let buyers buy but not sell (a "honeypot"). A well-known example is the "Squid Game" token in November 2021, which soared on hype and then collapsed to nearly zero within minutes as its creators cashed out, while holders had been unable to sell. Warning signs include anonymous teams, unlocked or creator-controlled liquidity, a large share of supply in a few wallets, unaudited or unverified contracts, aggressive promotion and promises of guaranteed returns. If you cannot explain why a token should be worth anything, treat it as high risk.
More on Rug pull →4. Ponzi scheme (crypto)
A Ponzi scheme pays existing investors with money from new investors rather than from real profits. It needs a constant flow of new money and collapses when recruitment slows or too many people try to withdraw. The name comes from Charles Ponzi, who ran such a scheme in the US in the 1920s. Crypto has been a fertile ground for Ponzi and pyramid schemes because many people do not understand the technology. Common signs include guaranteed daily or monthly returns, vague claims about trading bots, arbitrage or mining, rewards for recruiting others, pressure to reinvest, and difficulties withdrawing. Well-known examples include BitConnect, which collapsed in January 2018, and OneCoin, which turned out to have no real blockchain at all. A genuine crypto investment cannot promise fixed returns, because prices are volatile. If a scheme pays more for bringing in friends than for any underlying activity, treat it as a scam, however professional the website or events appear.
In India: Indian police and the Enforcement Directorate have pursued several large crypto Ponzi cases, including the GainBitcoin scheme. Unregulated deposit schemes are illegal under the Banning of Unregulated Deposit Schemes Act, 2019. Report fraud on cybercrime.gov.in or call 1930.
More on Ponzi scheme (crypto) →5. Two-factor authentication (2FA)
Two-factor authentication (2FA) adds a second check when you log in or withdraw, on top of your password. Even if someone steals your password, they also need the second factor. The options are not equally strong. SMS codes are the weakest, because attackers can hijack your phone number through a SIM swap. Authenticator apps such as Google Authenticator, Microsoft Authenticator or Authy generate time-based codes on your phone and are much safer. Hardware security keys and passkeys using the FIDO2 standard, such as YubiKey, are the strongest because they resist phishing websites. On crypto exchanges, turn on 2FA for logins and withdrawals, use an authenticator app or security key rather than SMS where possible, and enable a withdrawal address allowlist if offered. Save the backup codes offline, since losing your phone without them can lock you out. Never share a 2FA code with anyone, including people claiming to be from support.
More on Two-factor authentication (2FA) →
Do this today
Read: is crypto legal in India? →What is allowed, what is taxed and who regulates what.
← Day 5Day 7: A sensible plan: DCA and position size →
General information, not financial advice.