A message claiming that your exchange request is “frozen,” “under investigation,” or at risk of cancellation creates pressure to act before checking the facts. That pressure is the main weapon of fake support. The safe route is to separate the exchange operation from the unsolicited contact, reconstruct the original task from information obtained through the official interface, and stop before any irreversible transfer if the details no longer match.
Recognize when “support” has changed the task
Exchange impersonators commonly initiate contact by call, email, messenger, or social media, claim that an account has been compromised, and demand an immediate response. They may provide a link, request login details, ask the user to transfer cryptocurrency to a “secure” address, or offer remote assistance. The FBI advises users not to follow links or contact details supplied in such messages and to reach the exchange independently through its official channel. [1]
A legitimate exchange task has a limited purpose: select an available asset and direction, review the stated conditions, obtain the deposit details from the request itself, send the correct asset through the correct network, and monitor the transaction. The route has changed if a supposed agent asks you to:
- disclose a seed phrase, private key, password, authentication code, or wallet backup;
- install remote-access software or share your screen while the wallet is open;
- send BTC, ETH, or USDT to a separate “verification,” “insurance,” “reserve,” or “safe storage” address;
- connect a wallet to an unfamiliar page or sign a transaction that is unrelated to the exchange request;
- pay an additional recovery fee to release funds;
- keep the conversation secret or continue only through a private messenger.
A recovery phrase is the master credential for a wallet, and anyone who obtains it can control the associated accounts. Ethereum’s security guidance states that legitimate support services do not need a user’s seed phrase or private key. [2]
Operation state map
- State 1: Define the task.
- Transition condition: you can state which asset you hold, which asset you expect to receive, and the wallet that should receive the result.
- Check: write down the intended direction without using information supplied by an unsolicited agent.
- Stop if it does not match: the contact introduces a different asset, an extra transfer, a “temporary” wallet, or an action that was absent from your original plan.
- State 2: Reopen the source data independently.
- Transition condition: you have reached the exchange interface through a previously verified bookmark or another independently obtained official route.
- Check: compare the domain, active session, request identifier, asset, network, recipient details, and current request status. Do not reuse a link, QR code, phone number, or address sent by the alleged support agent.
- Stop if it does not match: the request is missing, the displayed details differ, or the interface asks for credentials or wallet secrets that are not normally required for viewing the request.
- State 3: Verify eligibility and current conditions.
- Transition condition: the intended direction and network are currently available, and you understand the information requested before the order is created.
- Check: review the displayed amount, rate calculation, fees, limits, and compliance requirements. Verification conditions may depend on the transaction direction and the outcome of compliance checks, so they must be clarified before creating the request.
- Stop if it does not match: the interface does not offer the required direction or network, or an agent proposes bypassing a restriction through another person, account, asset, or address.
- State 4: Validate the asset, network, and address.
- Transition condition: the sending wallet supports the exact network specified by the request.
- Check: compare the full destination address, not only its first and last characters. For USDT, verify both the token and its blockchain because USDT exists on multiple protocols; support for one USDT network does not imply support for every other network. [3]
- Stop if it does not match: the wallet labels the network differently, the address changes after copying, the QR code produces another address, or the alleged agent says that network selection is unimportant.
- State 5: Check additional fields and the final amount.
- Transition condition: every field displayed by the official request can be reproduced in the sending wallet.
- Check: if the request provides a Memo, Tag, payment ID, or similar identifier, enter it exactly. Confirm whether the entered amount excludes or includes the wallet’s network fee and make sure the resulting amount corresponds to the request conditions.
- Stop if it does not match: a required identifier cannot be entered, the amount delivered after fees would fall outside the displayed conditions, or support asks you to put a seed phrase, password, or arbitrary instruction into a Memo field.
- State 6: Perform the irreversible-action checkpoint.
- Transition condition: the request was opened independently and the asset, network, full address, additional identifier, amount, and fee have all been checked.
- Check: read the wallet’s final confirmation screen rather than relying on the exchange page or a chat message. If a small test transfer is permitted by the request’s current limits and conditions, it can reduce address-selection risk, although it creates a separate transaction and additional network cost.
- Stop if it does not match: the wallet asks for an unexpected token approval, contract interaction, unlimited spending permission, or recipient address.
- State 7: Submit through the verified route.
- Transition condition: no unresolved discrepancy remains and no third party is directing the wallet operation.
- Check: create or continue the request only within the official interface. At this point, the practical next step is to open the verified exchange page and check the current BTC, ETH or USDT direction.
- Stop if it does not match: the available pair, network, or conditions differ from the planned operation. Availability should be checked at the time of the exchange rather than assumed.
- State 8: Wait for observable confirmation.
- Transition condition: the wallet has produced a transaction hash and broadcast the transaction.
- Check: use the relevant blockchain explorer to confirm the network, sender, recipient, asset, amount, status, and block confirmations. On Ethereum, a broadcast transaction first enters the pending pool and must be included in a validated block before it is considered successful. [4]
- Stop and diagnose: no transaction hash exists, the explorer cannot find it on the selected network, or the on-chain recipient differs from the official request.
- State 9: Confirm the result or enter recovery mode.
- Transition condition: the incoming transaction is visible in the intended wallet and the exchange request shows a compatible completed status.
- Check: verify the received asset and network on-chain, not merely the displayed fiat estimate or token symbol.
- Enter recovery mode if it does not match: preserve the request details, transaction hash, addresses, timestamps, screenshots, and communications. Contact support only through the independently verified interface and do not send another payment to “unlock” the first one.
Why the asset and network must be checked separately
BTC normally refers to the native asset of the Bitcoin network, while ETH is used for transactions and fees on Ethereum. USDT is different because tokens bearing the same name can operate on several blockchains. The destination may therefore look like a valid cryptocurrency address while still being wrong for the network accepted by the exchange request. Tether’s official documentation explicitly lists multiple supported protocols and advises integrations to state which protocols they support. [3]
Do not infer network compatibility from the asset ticker alone. “USDT supported” does not mean that every USDT implementation can be deposited. Likewise, the presence of BTC, ETH, or USDT among the service’s assets does not guarantee that every pair, network, or transaction direction is active. Current availability must be verified before funds are sent.
The address deserves a full comparison because malicious software and address-poisoning tactics can substitute or visually imitate a recipient. Bitcoin.org recommends checking the entire receiving address rather than relying only on a few characters. It also warns that no legitimate support team should request a seed phrase or private key. [5]
Amount, fees, Memo or Tag, and confirmations
The amount shown in the sending wallet may not be identical to the amount arriving at the deposit address. A wallet can add a network fee on top of the transfer or subtract it from the available balance, depending on its design and the chosen “send all” behavior. On Bitcoin, fees are related to transaction data size rather than simply to the monetary value transferred. [6] Ethereum transactions also require a fee and inclusion in a validated block. [4] The relevant figures are the values displayed for the specific request and wallet transaction; no universal fee or confirmation time should be assumed.
A Memo or Tag is relevant only when the official deposit instructions display one. Shared deposit systems may use such a field to associate an incoming transaction with the correct request or account. If it is required, both the address and identifier form one set of payment details. If no Memo or Tag is shown, do not invent one based on a chat message. When the wallet cannot send the required identifier, stop and clarify the supported route before transferring funds.
One confirmation does not have the same operational meaning for every blockchain or service. The explorer shows whether the network has included the transaction, while the exchange decides when its own request has received enough confirmations to proceed. A fake agent’s screenshot or chat message is not a substitute for either source.
Diagnosing a delayed or incorrect transaction
No transaction hash was created
The transfer may not have been signed or broadcast. Check the wallet’s activity log, balance, network connection, and any failed-transaction notice. Do not send again until you establish whether the first attempt exists; otherwise, two valid transactions could be created.
The hash exists but remains pending
Open the hash in the explorer for the network actually selected in the wallet. A pending Ethereum transaction has been broadcast but has not yet been included in a block. [4] Network demand, fee settings, wallet behavior, or a preceding transaction from the same account may affect progress. Use only options offered by the original wallet, and confirm that any replacement operation retains the intended recipient and amount.
The blockchain shows success, but the request has not updated
Compare the asset, network, recipient, amount, Memo or Tag, and confirmation count with the official request. If all details match, provide the transaction hash and request identifier through the verified support channel. A successful on-chain transfer proves that the network processed the stated transaction; it does not by itself prove that the exchange can credit a transfer made through an unsupported network or with missing identification data.
The funds went to the wrong address or network
Stop further transfers and preserve the evidence. Bitcoin payments cannot be reversed by the network; a refund generally depends on the recipient controlling the destination address and choosing to return the funds. [7] Other blockchain transactions also should not be treated as cancellable after confirmation. Recovery may be technically impossible or may depend on the recipient platform’s capabilities and policies, so no return can be promised.
A wallet was connected or a suspicious approval was signed
Disconnecting a website does not necessarily cancel permissions already granted to a smart contract. For Ethereum-based tokens, inspect active token approvals through a reputable explorer or wallet security interface and revoke permissions that are not required. Malicious or excessive approvals can remain usable after the original interaction. [8] If a seed phrase or private key was disclosed, changing an exchange password is not enough; secure the remaining assets in a new wallet whose recovery credentials were never exposed. Ethereum’s scam-response guidance also recommends revoking token approvals, changing related account passwords, enabling two-factor authentication, and documenting transaction hashes, addresses, screenshots, and communications. [9]
What a verified completion looks like
The route is complete when the expected asset is visible at the intended destination on the correct blockchain, the explorer shows the corresponding transaction, and the exchange request reports a consistent final status. A message from support, an emailed receipt, or a balance screenshot alone is insufficient because each can be imitated.
Some uncertainty may remain around processing time, compliance review, network congestion, and whether an incorrectly routed transfer can be recovered. These questions must be handled through the service’s independently verified support channel. If the contact demands another cryptocurrency payment, wallet secret, remote access, or a transfer to a new “recovery” address, the operation has left the original route. Stop: claims that lost cryptocurrency can be recovered for an advance fee are a common second-stage scam, and blockchain transactions cannot simply be reversed by a supposed recovery agent. [9]