How to spot online scams

Learn how to safeguard your digital assets against online threats, scams, malware, and clipboard interception.

1. Summary of General Red Flags

Identify active threats quickly by keeping an eye out for these universal indicators of a scam attempt:

• Unsolicited pitches regarding highly profitable crypto opportunities from people online.
• Callers warning of severe system defects who want remote access to look into your device.
• Sender domains that don't match exactly. Check for @gmail.com instead of @bitpanda.com or @bitpanda.zendesk.com.
• Grammar mistakes, suspicious download attachments, or messages trying to force urgent action.

2. SMS Scams (Smishing)

Smishing occurs when attackers send deceptive text messages to trick you into downloading malware, clicking risky links, or sharing sensitive account details (like passwords or 2FA codes).

Why it's tricky: Fraudsters use "sender ID spoofing" to force fake messages into the exact same SMS conversation thread as legitimate Bitpanda notifications.

Protect yourself with these rules:

• Verify the Sender: Bitpanda will never call you out of the blue, accept incoming telephone support calls, or ask for help via phone.
• Don't Click Links: Never open unexpected links. Official links will always run directly on bitpanda.com (e.g., support.bitpanda.com). Avoid shortened URLs.
• Keep Data Private: Never share passwords, SMS codes, or 2FA tokens. No Bitpanda employee will ever ask for them.
• Ignore the Urgency: Scammers want you to panic and act fast. Slow down and check the details calmly.
• Report It: Forward suspicious text messages to your cellular network provider and block the sender.

If you have accidentally exposed your login credentials: Freeze your account immediately and contact support.

3. Support Scams & Fake Employees

The Trap: Someone calls pretending to work for Bitpanda, asking to connect to your computer, or demanding a crypto fee to authorize a deposit. They may also email you fake login forms.

Crucial Facts:

• Bitpanda only calls you if explicitly scheduled and confirmed via email beforehand. We never demand payments, keys, or device access.
• Official support chat options and verified WhatsApp channels are accessible directly In-App.
• Bitpanda does NOT employ account managers, brokers, tax advisors, mentors, or miners to invest on your behalf.

Phishers create identical clones of websites to steal data. When visiting Bitpanda, always look at your browser address bar to verify the security certificates:

4. Social Media & Giveaway Frauds

The Trap: Scammers make fake copies of our corporate profiles on platforms like X (Twitter) or Telegram. They post alluring schemes in the comment sections, such as: "Send 1 ETH, get 5 ETH back instantly!"

Always check for verification marks: Look for the grey badge on Facebook or the official verification mark on X (Twitter).

In our official Telegram groups, legitimate Bitpanda employees feature a distinct grey "admin" tag right next to their names.

5. Verified Telegram Staff List

Below are the specific handles of official team members and group managers authorized to assist our community:

6. Understanding Clipboard Hijacking (Pastejacking)

Clipboard hijacking, also known as pastejacking or copy-paste malware, is a type of malicious software that targets your device's clipboard (the temporary storage used when you press Ctrl+C and Ctrl+V). Because the infection lives directly on your operating system, it affects everything you do regardless of the specific application or web platform in use.

• Malicious Website Code: Attackers embed harmful JavaScript strings into a compromised or fake web page.
• Real-Time Manipulation: The moment you copy text data from a website, an active background script replaces your selection with the attacker's details.
• Unintended Execution: If you copy malicious text elements and paste them into a command terminal interface, the malware can instantly run commands and completely compromise your system.

The Bottom Line: Once this bad code runs on your hardware, attackers can force you to paste their information, intercept sensitive text data you copy, or gain full remote administrative access to your computer.

Crypto transactions are permanent, making asset investors a primary target for pastejacking schemes. An active system infection exposes you to the following risks:

• Redirected Funds: When you copy a deposit or withdrawal destination hash, the malware replaces it with the thief's wallet address. If you don't notice the variation, you will send your funds directly to the attacker.
• Network Manipulation: The malware can alter selected target blockchain networks, causing validation transactions to fail or become permanently lost.
• Data Theft: Attackers can continuously log everything you copy, including passwords, private cryptographic keys, emails, and personal identifying details.

• Double-Check Every Address: Never rely blindly on copy-paste. Visually verify the entire pasted address against the intended destination before confirming any transaction. Even a single different character can result in lost funds.
• Use an Address Book: If you have already verified an address, you can save it and use it without having to copy-paste it.
• Keep Antivirus Software Updated: Ensure your local security defenses are active and updated. Run a comprehensive full system threat scan immediately if you spot unusual behavior.
• Be Smart with Software & Terminals: Avoid downloading executable assets from unverified software portals, and never paste unfamiliar script instructions into local device terminals.
• Reach Out for Help: If you observe any suspicious anomalies during an ongoing transaction, pause immediately and contact Bitpanda Support via Livechat.

7. Understanding Pig Butchering Scams

Pig butchering is a fraud scam that combines elements of romance schemes, social engineering, and fraudulent investment platforms. The name comes from the practice of "fattening up" a victim by building deep emotional trust over weeks or months before finally "butchering" them for their entire life savings. Because this relies heavily on manipulation rather than direct technical attacks, it can happen across any digital device or environment you use.

• The "Wrong Number" Hook: Scammers reach out unexpectedly via WhatsApp, SMS, or dating apps, pretending they texted a wrong number or seeking casual, innocent conversation.
• Building Emotional Rapport: Over days or weeks, they avoid mentioning money. They establish an intense, friendly, or romantic connection, sharing fake details about their wealthy lifestyle.
• The Subtle Pitch: The scammer casually mentions making easy, massive profits through crypto trading or a "special insider loop," eventually offering to teach you how to do it.

The Bottom Line: This is a  manipulative trap. The entire relationship is completely fictional, engineered solely to lower your guard and convince you to hand over your capital.

Because crypto transactions cannot be reversed, pig butchering syndicates rely on reputable exchanges like Bitpanda as the gateway to extract your cash. They subject you to the following specific risks:

• Rigged Trading Platforms: The scammer directs you to buy crypto on Bitpanda and withdraw it to an external web wallet or a clone trading platform controlled completely by the syndicate.
• Fabricated Payout Gains: The fraudulent platform will show fake upward charts, making you believe your balance is multiplying. They may even allow you to withdraw a small amount early on to convince you to deposit much larger sums.
• Extortion Fees: When you attempt to withdraw your "profits," the platform freezes your funds, demanding you pay sudden fake "taxes," "security bonds," or "regulatory fees" out of pocket to unlock them.

• Keep Investments Individual: Never mix financial decisions with online relationships. If an online friend, romantic interest, or stranger tries to guide your financial investments, always think about it.
• Examine the Destination URL: Only trade on officially recognized and heavily regulated financial institutions. Research third-party platforms thoroughly via scam-detection forums and public/state regulatory blocklists.
• Never Pay to Withdraw: No legitimate crypto exchange or financial institution will ever ask you to deposit extra money just to clear or pay taxes on an existing withdrawal.
• Refuse Screen Sharing: Do not install any remote access tools or unverified custom applications recommended by someone online under the guise of helping you configure investment setups.

8. Common Scam Types Covered

Hover or tap on the cards below to see the red flags and tips for each type of scam.

Note on Merchant Purchases: Be careful with online storefronts forcing checkout payments exclusively in Bitcoin or through unfamiliar settlement links. Check platform ratings on Google and Trustpilot before checking out.

Check public registries tracking active reported financial scams:

• Germany: BaFin Unauthorised Businesses
• Austria: FMA Investor Warnings
• Switzerland: FINMA Warning List
• United Kingdom: FCA Unauthorised Firms
• Spain: CNMV Portal
• Belgium: FSMA Warnings

9. Practical Safeguard Habits

• Research names and corporate identities through reliable, public search channels.
• Never allow remote desktop access software tools like AnyDesk or TeamViewer.
• Never share passwords, credentials, or private banking details.
• Avoid forming snap financial judgments under pressure.
• Set up an Anti-Phishing Code inside your Bitpanda account menu so you can easily distinguish real emails from fakes.