Fake Apps and Fake Websites: How to Stay Safe

Scammers know that the fastest way to steal crypto is to look exactly like a service you already trust. So they build fake apps and fake websites that copy a real exchange or wallet down to the logo and colours. You think you are logging in as usual — but you are handing your details straight to a thief.

The good news: these fakes almost always give themselves away if you know where to look. This guide explains why they exist, the main types you will meet, how to spot them, and the simple habits that keep you on the real thing. It is written in plain English for beginners.

Fake apps and sites are one branch of a bigger family. For the full picture, see our overview of common crypto scams.

Fake apps and websites exist for one reason: money. Their whole job is to capture something valuable from you before you notice. Usually that means one of three things.

• Your login details. A fake exchange page copies the real login screen. When you type your email and password, the scammer records them and signs in to the real account to drain it.
• Your seed phrase. A fake wallet app or "wallet connect" page asks you to enter or "restore" your seed phrase — the master key to your crypto. Hand it over and every coin is gone in seconds.
• A direct deposit. Some fakes skip the passwords and simply show a wallet address, promising to double your coins or unlock a bonus. Anything you send goes straight to the scammer.

A seed phrase is the list of 12 or 24 words that can restore a crypto wallet. Whoever has it controls the funds. That is why so many fakes are built around getting you to type it. Learn more in our guide to what a seed phrase is.

Fakes come in a few standard shapes. Once you can name them, they are much easier to catch.

• Look-alike websites (typosquats). The page looks identical to the real one, but the web address is slightly off — a swapped letter, an extra word, or a different ending (for example .co instead of .com).
• Fake mobile apps in app stores. Scammers upload apps that copy a real wallet or exchange name and logo. They can slip past checks for a while before being removed, so a listing being in the store is not proof it is genuine.
• Fake browser extensions. A copycat wallet extension sits in your browser and quietly captures your seed phrase or swaps a copied wallet address for the scammer's when you paste it.
• Fake ads in search results. Paid ads can appear above the real website. The ad shows the correct brand name but links to a fake page underneath.
• Cloned support pages. Fake "help" or "live chat" pages pretend to be customer support, then ask for your login, seed phrase, or remote access to "fix" a problem you never had.

Many of these arrive through a message or email designed to make you click. That overlap with crypto phishing is why the two topics go hand in hand.

You rarely need technical skills to catch a fake. A short checklist stops most of them:

• Check the exact web address, spelling and all. Read it slowly, character by character. Watch for swapped letters (rn for m), extra words, and unusual endings. When in doubt, do not log in.
• Be suspicious of "too good" offers and ads. Free coins, doubled deposits, guaranteed returns, or "limited time" bonuses are bait. No legitimate service gives away money to log in.
• Check the app's developer, reviews, and download count. The real app comes from the official company, usually has a long history and many downloads. A brand-new listing, a slightly wrong developer name, or a handful of copied reviews are red flags.
• Beware links in DMs, emails, and group chats. A link someone sends you — even a "helpful" one — is the classic delivery method. Treat every unexpected link as untrusted until you verify it yourself.

Spotting fakes is defence. Verifying the real thing is offence — a few habits mean you almost never have to guess.

• Type the address yourself, or use a saved bookmark. Once you confirm the correct official address, bookmark it and use that bookmark every time. This skips search ads and copied links entirely.
• Download apps only from official links. Follow the download button on the company's real website to its app-store listing, rather than searching the store and guessing which result is genuine.
• Check the app publisher. Confirm the developer or publisher name on the store listing matches the official company, not a look-alike with an extra letter or word.
• Verify before connecting a wallet. Before you connect a wallet or approve anything, double-check the address in the bar and be sure you reached the page yourself. Connecting to a fake site is how many approvals get stolen.

Because fakes and phishing are so closely linked, it helps to know the warning signs of both. See how to spot crypto phishing for the message-based tricks that lead people to fake pages. When you are choosing where to trade, our guide on how to verify an exchange is legit covers deeper checks.

If you think you entered details into a fake app or site, act quickly and calmly. Speed limits the damage. Work through these steps in order:

• Disconnect and close it. Stop what you are doing, close the app or page, and delete a fake app or browser extension right away.
• Change your passwords. From a device you trust, change the password on the affected account and any account that shared it. Turn on two-factor authentication (2FA) if it is not already on.
• Move your funds if your keys are exposed. If you may have typed a seed phrase or private key, treat that wallet as compromised. Create a new wallet and move any remaining crypto to it immediately.
• Revoke approvals. If you connected a wallet or approved a transaction, revoke the site's token approvals using a reputable revoke tool so it can no longer move your coins.
• Report it. Report the fake to the real company and, where relevant, to the app store and your local fraud authority. This can help stop others being caught.

For a full recovery plan and the reporting channels to use, follow our guide on what to do if you are scammed in crypto.

Helpful tips

• Bookmark the real sites you use and open them only from those bookmarks.
• Slow down. Urgency ("act now," "account at risk") is a pressure tactic. Real services can wait a minute while you check.
• Keep a small "test" transfer habit when using any wallet or site for the first time, so a mistake costs little.
• Keep your seed phrase offline and never type it into a screen you reached from a link.

Common mistakes to avoid

• Clicking the top search result without reading the address — it may be a paid ad for a fake.
• Assuming an app is safe because it is in the store. Fakes slip through and get removed later.
• Trusting a padlock icon alone. A fake site can have the padlock too; it only means the connection is encrypted, not that the site is honest.
• Entering your seed phrase to "verify," "sync," or "unlock" anything. That request is always a scam.

How can I tell if a crypto app is fake?

Check the developer or publisher name against the official company, look at the download count and review history, and download only through the link on the company's real website. A brand-new listing, a slightly wrong developer name, or requests for your seed phrase are strong warning signs.

Are fake apps really in app stores?

Yes. Scammers do get copycat apps into official stores, where they can stay until they are reported and removed. Being listed in a store is not proof an app is genuine, so always confirm the publisher and reach it through the official site.

What if I downloaded a fake wallet?

Delete it at once. If you entered or restored a seed phrase in it, treat that wallet as compromised: create a brand-new wallet and move any remaining funds there immediately, then change related passwords and turn on 2FA.

How do I find the official website?

Type the address yourself if you know it, or find it through a trusted source, then save it as a bookmark and use that bookmark from then on. Avoid clicking links in ads, emails, or chats, since these are the usual routes to fake pages.

Can a fake site steal my crypto?

Yes. A fake site can capture your login, trick you into typing your seed phrase, get you to approve a malicious transaction, or show a deposit address that sends funds straight to the scammer. That is why verifying the site before you act matters so much.

Fake apps and fake websites work by looking exactly like a service you trust, so they can capture your login, your seed phrase, or a deposit. They give themselves away through slightly wrong web addresses, copycat app listings, fake extensions, and paid ads. Read the address carefully, download only from official links, never type your seed phrase into anything you reached from a link, and verify before you connect a wallet.

Next step: the same scammers usually reach you by message first. Learn the warning signs in our guide on how to spot crypto phishing.

• US Federal Trade Commission — Reports show scammers cashing in on crypto craze
• FBI Internet Crime Complaint Center — Warning on fraudulent crypto apps