MSTR Cat

Crypto Law/Level IV · Holders' traps/4.2 Scams the law sees/Lesson 2

Fake exchanges and fake apps

How fake trading platforms and lookalike apps work, why a register entry or an app-store listing proves little, and how to check a platform at the source.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Free checks before any deposit: find the firm yourself on the regulator’s register (FINRA BrokerCheck, FinCEN MSB search, UK FCA Firm Checker and Warning List, ESMA MiCA register); FinCEN says a listing is not an endorsement.
  2. Type the platform’s address and check the app publisher letter by letter instead of using links, ads or beta-test apps, which the FBI linked to fake exchanges (I-081423-PSA, 14 August 2023).
  3. If withdrawals are blocked pending a ‘fee’ or ‘tax’, pay nothing; report free at ic3.gov with deposit addresses and transaction IDs, and expect follow-up recovery offers to be a second scam.
  4. A for-profit loss to a fake platform may be deductible as a theft loss under §165(c)(2) on Form 4684 (IRS CCA 202511015); timing depends on there being no reasonable prospect of recovery.

MaterialsFinCEN’s MSB Registrant Search page, including its warning that a listing is not an endorsementFBI public service announcement I-081423-PSA (14 August 2023) on fake mobile beta-testing appsFINRA BrokerCheck, or the UK FCA Firm Checker and Warning List if you are in the UKThe web address and app name of any platform you use, typed out character by character

Wonder

  1. How can an app that I downloaded from a real app store be fake?
  2. If the website shows my balance growing, isn’t the money really there?
  3. Does a registration number on a platform’s website prove it is legitimate?

Explore

  1. A fake exchange is a website or app built to look like a trading venue or wallet, while the deposit addresses it shows belong to the scammers. Nothing is traded. The balance on screen is a number in the operators’ own database, and they can make it rise as fast as they like. The FBI described the pattern in an October 2022 alert: fake sites and apps let victims track ‘investments’ that appear to grow exponentially, and when victims try to cash out they are told to pay taxes or extra fees. Compare a real exchange account (lesson 4.1.1), where at least an identifiable firm owes you something.
  2. Victims usually reach these platforms through someone else. Some arrive through a link from a new online friend (lesson 4.2.1). Others type a slightly misspelled web address or click a search advertisement: in December 2022 the FBI warned that criminals buy search-engine ads that imitate cryptocurrency exchanges to collect logins. In August 2023 it warned of malicious ‘beta-testing’ apps, test versions that are typically not subject to the app stores’ normal review, which contacts on dating apps persuade victims to install as crypto exchanges. A joint SEC, CFTC, FINRA and NASAA alert adds that even an app in a well-known store is not necessarily legitimate.
  3. Fake platforms often display real-looking credentials: a company number, a licence claim or a regulator’s logo. FinCEN, the US Treasury bureau that registers money services businesses, warns on its MSB Registrant Search that a listing is ‘not a recommendation, certification of legitimacy, or endorsement’, that it does not vet what registrants submit, and that claims of FinCEN ‘approval’ are false and may be part of a scam. Registration and licensing do matter (lessons 1.3.4 and 1.3.6), but a number proves nothing until you check that the entry exists and that its contact details and web address match the site you are using.
  4. Outside the US the same check applies. In the UK, the Financial Conduct Authority (FCA) says almost all financial firms must be authorised or registered by it. Its Firm Checker shows whether a firm is authorised, and the FCA advises confirming that the firm reference number and contact details you were given match the register; criminals copy real firms’ details to create ‘clones’. The FCA also publishes a Warning List of unauthorised firms. In the EU, ESMA publishes an interim MiCA register of authorised crypto-asset service providers and non-compliant entities (lesson 3.3.2). The rule is the same everywhere: reach the register by typing the regulator’s address yourself, never through a link the platform supplies.
  5. The cash-out stage is the trap. When a withdrawal is blocked, the platform’s ‘support’ asks for a tax, an unlocking fee or a verification deposit. The FBI’s 2025 annual report calls these charges a final attempt to take more before the scammers disappear, and the joint investor alert notes that targets frequently recover neither their money nor the promised profits, so paying only adds to the loss. In law, running a fake platform is wire fraud under 18 U.S.C. §1343. US agencies also pursue the infrastructure: a Justice Department Scam Center Strike Force, described in the FBI’s 2025 report, works to seize US-based facilities and accounts that scam centres use.
  6. A practical check before any deposit: find the firm on the relevant regulator’s register yourself, compare the web address and app publisher letter by letter, and be wary of any platform that a new contact chose for you. The FBI’s red flags for malicious apps include a high number of downloads with few reviews, permissions unrelated to the app’s purpose, and spelling errors in the description. If money has already gone, keep the deposit addresses, transaction IDs and screenshots, report promptly (lesson 4.2.7), and expect follow-up offers to ‘recover’ the funds, which are usually a second scam (lesson 4.2.5).

Key facts

  • FinCEN states that inclusion in its MSB Registrant Search is not a recommendation, certification of legitimacy or endorsement of a business.
  • FinCEN does not license or vet the information that money services businesses provide when they register.
  • FBI alert I-081423-PSA (14 August 2023) warned that fake crypto exchange apps were being distributed as mobile beta-testing apps.
  • In December 2022 the FBI warned that criminals buy search-engine ads imitating cryptocurrency exchange platforms to steal login credentials.
  • The UK FCA’s Firm Checker shows whether a firm is authorised, and the FCA’s Warning List names unauthorised firms.
  • A joint SEC, CFTC, FINRA and NASAA investor alert warns that an app’s presence in a well-known app store does not make it legitimate.

Exercise nine, six, three, one

9CollectList up to 9 details you could check about a trading platform or app, such as its web address, app publisher, registration claims, reviews, permissions, contact details and how you first heard of it.
6ClusterSort them into 6 categories: address and domain, app store details, regulatory registration, people who introduced it, withdrawal terms, and contact or support channels.
3DistillReduce the 6 categories to 3 checks that could be done before any money is sent and that do not rely on information supplied by the platform itself.
1CrystallizeWrite 1 sentence explaining why a balance shown on a platform’s screen is not proof that the money exists.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS