How to Spot a Fake Crypto Exchange Website Before You Log In
Check the domain letter by letter against a bookmark or the exchange's official app, skip sponsored search results, and look for your anti-phishing code in emails. A real exchange never asks for your seed phrase. If you already entered a password, change it from the real site immediately and reset 2FA.
A fake exchange website does not need to be clever. It only needs you to type your login, 2FA code or seed phrase once. Clone sites copy the real logo, layout and even the support chat, and many of them are pushed to the top of search results through paid ads.
The good news is that a few checks, done every time, stop almost all of them. This guide is about websites and apps. If the contact came through a group chat, read our separate guide on how to verify an official exchange Telegram.
Quick checklist
Run through this before you log in or connect a wallet:
| Check | Safe sign | Red flag |
|---|---|---|
| How you arrived | Your own bookmark or the official app | A search ad, a DM, or a link in an email |
| Domain spelling | Matches your bookmark exactly | Extra letters, swapped letters, odd endings |
| Login prompt | Asks for email, password, 2FA | Asks for a seed phrase or private key |
| Emails | Contain your anti-phishing code | Missing code, urgent tone, “verify now” |
| Offers | Normal promotions on the real site | Bonuses that require a deposit to “unlock” a withdrawal |
If any red flag appears, close the tab and open the exchange from a bookmark instead.
Look-alike domains and sponsored search ads
Look-alike domains are the core trick. Common patterns include an added word such as “login” or “support”, a swapped letter that is hard to notice at a glance, a different ending after the dot, or characters from another alphabet that look identical to Latin letters.
Paid search ads make this worse because they appear above the real result and can show a convincing brand name. A safer habit is simple: never log in to an exchange through a search engine. Create a bookmark once from a source you trust, such as the official app’s settings or the exchange’s verification page, and use only that bookmark.
The padlock icon in the browser bar only means the connection is encrypted. Scam sites can and do have valid certificates, so a padlock tells you nothing about who owns the site.
Fake apps and wallet-connect pop-ups
Clone sites are often paired with fake apps. Download exchange apps only through the link on the official website or by checking the developer name in the app store carefully. Be cautious with any app sent to you as a file or through a link in chat.
On the decentralized side, fake sites often show a “connect wallet” button and then ask you to sign a transaction that grants unlimited spending approval. Read what your wallet is asking you to sign. If you do not understand it, reject it. Keeping most of your funds in a separate wallet that never connects to websites limits the damage; our guide to hot wallets vs cold wallets explains how to split funds that way.
No legitimate exchange login page asks for your recovery phrase. If you are unsure what that phrase is or why it matters, read what a seed phrase is and how to store it safely.
What to do if you already entered your password or seed phrase
Speed matters more than anything else here. Work through these in order:
- Password entered: open the real exchange from a bookmark or the app, change the password, and log out all other sessions.
- 2FA code entered: reset two-factor authentication from the real account and review recent logins and API keys. Delete any API key you did not create.
- Withdrawal settings: check whether a new withdrawal address was added. Turning on a withdrawal address whitelist helps stop this in future.
- Seed phrase entered: treat that wallet as lost. Create a new wallet on a clean device and move whatever remains immediately.
- Contact support through the official site only, and keep screenshots of the fake page and its address.
Be very careful after the fact. People who report a loss in public are often contacted by fake “recovery services” that charge an upfront fee and return nothing.
Reporting and official resources
Report the fake site to the real exchange so it can request a takedown. In the United States, online fraud can be reported to the FBI’s Internet Crime Complaint Center (IC3). Other countries have their own cybercrime or consumer protection agencies, and your local police can tell you which one applies.
Building habits that last
Security checks only work if they become routine. Use a password manager, which will refuse to fill your credentials on a domain that does not match. Set an anti-phishing code on every exchange account that supports it. And treat urgency as a warning sign: a message saying your account will be frozen unless you act within minutes is designed to stop you from checking the address bar.
themexc.com is an independent site, not affiliated with any exchange. This article is general information, not financial or legal advice. Rules and fees change; check each platform’s official help page before acting.
Frequently asked questions
Is the first search result for an exchange always safe?
No. Scammers buy search ads that appear above the real site and use look-alike domains. Use a saved bookmark or the official app instead of clicking an ad, especially when you are about to log in or deposit.
How do I confirm an exchange's official domain?
Compare it against a source you already trust: the official app, a bookmark you created earlier, or the exchange's own verification page. Many large exchanges offer an official verification tool where you can paste a URL, email or social account to check it.
What is an anti-phishing code?
It is a word or phrase you set in your exchange account settings. The exchange then includes it in genuine emails. An email that claims to come from the exchange but lacks your code should be treated as fake.
What should I do if I typed my seed phrase into a website?
Assume the wallet is compromised. From a clean device, create a brand new wallet with a new seed phrase and move any remaining funds to it right away. The old phrase cannot be made safe again.
Will an exchange ever message me first on Telegram or WhatsApp?
Treat any unsolicited direct message about your account as suspicious. Support agents should not ask for passwords, 2FA codes or seed phrases, and links in such messages often lead to clone sites.
Where can I report a fake exchange website?
Report it to the real exchange's support team so they can request a takedown, and to your national cybercrime or consumer protection body. In the United States, that is the FBI's Internet Crime Complaint Center.