How to tell a real exchange site or app from a fake one

Most beginner losses do not start with a bad sell button. They start with a copied website. The page uses the same logo and colors, and an address that is only one character off. Use this before you open any exchange sign-up page.

1. Why a fake site feels legitimate

The attacker does not need to break into the exchange. They publish a lookalike page and buy an ad so it sits above the real result. You type the exchange name, click the first row, and send your email and password to someone else. Some pages also ask for an ID photo “to speed up verification”.

• You arrived from an ad, not from a bookmark or an address you typed.
• The domain is almost right: an extra word, a hyphen, or a different ending.
• There is urgency: “account locks in 15 minutes”, “claim the bonus now”.

2. Check the domain before you type anything

1. Close the page. Do not fill the form, including “just the email”.
2. Open a new tab and type the domain you already saved, character by character.
3. Compare the full spelling, including the ending. exchange.com and exchange-login.com are different sites.
4. Treat the padlock as a minimum, not proof. Criminals can buy HTTPS too. The lock does not mean the site belongs to the exchange.
5. When you are sure, bookmark the official home page. Later visits start from the bookmark, not from search.

3. Search ads

Paid results often sit above organic results and use titles such as “Official login”. Skip the ad block. If you already wrote down the official domain from the real app or from a previous visit you typed yourself, you do not need to search at all.

If an ad lands on a domain that is not exactly the one inside the official app, treat it as a different site and close it.

4. Apps: the name is not enough

• Install from the system store, not from an APK someone sent you.
• Read the developer name. Copies often reuse the exchange name with a new or unrelated publisher.
• Be careful with very few downloads, a burst of brand-new reviews, or permissions that do not fit (ongoing SMS access, contacts, installing other apps).
• After install, compare the help-menu domain with the domain you bookmarked. If they differ, delete the app.

5. Messages a real exchange does not send

• An OTP, authenticator code, or password “so security can cancel it”.
• An ID photo sent to a personal Telegram or WhatsApp chat.
• A remote-desktop app so an agent can “finish KYC for you”.
• A transfer to a personal bank account “so the balance arrives faster”.
• A short link that hides the full domain.

Normal official contact is an email from the company domain, a notification inside the app you installed, or a ticket you opened yourself from the help menu after logging in through your bookmark. If a stranger contacts you first and asks for a secret, stop.

6. If you already sent data

1. On another device, open the real site from a bookmark or by typing it. Do not reuse the old link.
2. Change the password and sign out other sessions if that control exists.
3. Pause withdrawals if you think another session is still alive. Turn them back on only after 2FA is under your control.
4. If an ID image went to a fake site, write down the date. You cannot pull the image back. Refuse later verification requests you did not start, and watch accounts in your name.
5. Report the fake domain to the ad platform you clicked, and keep a screenshot of the address.

7. Sixty-second check before you sign up

• The domain matches the official app or your bookmark exactly.
• You did not arrive from an ad or a chat link.
• Nobody is asking for an OTP outside the app.
• The app publisher matches, and is not an anonymous account.
• You can explain, in one sentence, how you reached this page.

Other basics: fake sites · rejected KYC · 2FA and withdrawals · missing deposits · comparing exchanges.