Fake support
Lesson 11 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
A text about North Korean hackers
In February 2025 people got texts that looked like they came from Binance: “a login attempt linked to Lazarus”. Lazarus is a real North Korean hacking group that was all over the news, so the fear worked. Then the “security team” talked victims into moving funds to a new wallet. The scammers already knew that wallet’s seed phrase. Binance itself had not been hacked and did not send those texts.
Four “nevers”
Remember this list and nine out of ten “support” calls become safe. A real exchange or bank employee will never ask for a code from a text, your seed phrase or your password. Never ask you to install AnyDesk or any other remote access app. And never tell you to move money “to a protected account”. Hear any one of these and the call is over, whoever is calling.
Don’t argue, verify
A scammer is good at answering questions, so trying to work out who they are over the phone is pointless. It’s easier to hang up and open the exchange app yourself. Binance has an official tool, Binance Verify: paste a phone number, link, email or Telegram handle and see whether it’s official. Many exchanges have similar checks. And contact support only from inside the app.
A password for the exchange’s emails
Many exchanges have an anti-phishing code in their security settings. You pick a word, say KOTIK-77, and the exchange puts it in every email it sends you. A scammer doesn’t know your word. So the rule is simple: an email “from the exchange” without your code is a fake, even if the sender address looks right. Set it up today; it takes two minutes.
After the Binance hack, double it
Big news is a gift for scammers: everyone is anxious and expecting emails from the exchange. Right now, expect messages about “compensation” that requires connecting your wallet. About an “affected account” you must empty urgently. About “official support” bots and giveaways to celebrate withdrawals reopening. Binance said it is covering the losses itself, from its SAFU fund and company money. So nothing is needed from you. Read compensation news only in the app and on the official site.
A call in a loved one’s voice
AI needs only a short clip from social media to fake a voice. The scheme is old, it just got more convincing: “it’s me, I’m in trouble, send money now and don’t tell anyone”. Agree on a code word with your family that never appears in your chats. If a call feels off, hang up and call back the saved number yourself.
Check yourself
- The “exchange security team” calls: your account is under attack and you must move funds to a protected wallet. What is this?
Correct answer: A scam: an exchange never asks you to move money. Moving funds “to a safe wallet” is the main sign of a scam. Hang up and open the app yourself. - How do you quickly tell a real exchange email from a fake?
Correct answer: Check for your anti-phishing code in the email. Only you and the exchange know the code; a scammer can’t add it. - Dan’s mom gets a call in his voice: “Mom, I’m in trouble, send money now”. What should she do?
Correct answer: Hang up and call Dan back on his own number. Calling the saved number breaks the scheme: the scammer can’t answer on Dan’s phone.
← Phishing: how not to take the bait Fake jobs and test tasks →