MSTR Cat

Crypto Law/Level IV · Holders' traps/4.2 Scams the law sees/Lesson 4

Impersonation and fake support

How scammers pose as exchanges, banks, tech support and government agencies, why knowing your details proves nothing, and what US law says about impersonation.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Free rule: if someone contacts you about an account problem, hang up and call the firm or agency using contact details you find yourself; the FBI says officials never demand payment in crypto, prepaid cards or by courier.
  2. Write down each platform’s official support route in advance and never share a seed phrase or one-time code; impersonating a business or government is unlawful under the FTC Rule, 16 C.F.R. Part 461.
  3. If you already sent funds, lock the account through the real firm and report free to ic3.gov and ReportFraud.ftc.gov; check whether the platform offers reimbursement, as Coinbase did for eligible customers after its 2025 data incident.
  4. An investment-account theft loss may be deductible under §165(c)(2) on Form 4684 (IRS CCA 202511015); personal-use losses remain nondeductible under §165(h)(5), so keep proof the assets were held for investment.

Materials16 C.F.R. Part 461, the FTC’s Rule on Impersonation of Government and Businesses (on ecfr.gov)FBI public service announcement ‘FBI Warns of Scammers Impersonating Cryptocurrency Exchanges’ (1 August 2024)Coinbase Global’s Form 8-K filed 15 May 2025, Item 1.05, describing a customer-data incidentThe official support contact route for each platform you use, written down in advance

Wonder

  1. How did a caller who said he was from my exchange know my balance and recent trades?
  2. Would a real exchange, bank or government agency ever ask me to move crypto to a ‘safe’ wallet?
  3. Is pretending to be a company or an official illegal in itself, or only when money is taken?

Explore

  1. Impersonation scams start with an unexpected call, text, email or social media message from someone claiming to be your exchange, wallet maker, bank, tech support or a government agency. The FBI’s August 2024 alert describes the script: the caller says your account has a problem or is under attack, creates urgency, and asks you to share login details or one-time codes, click a link or show identification. Variants ask you to install remote-access software, or to move funds to a ‘safe’ wallet that the scammer controls. Government versions accuse the target of a crime and demand payment, often in crypto or cash fed into a crypto kiosk.
  2. The losses are large. The FBI’s 2025 report counted more than 80,000 complaints of tech or customer support and government impersonation fraud, with losses over $2.9 billion; complaints about crypto kiosks alone reached 13,460, with $389 million lost, about $257 million of it by people aged 60 and over. A September 2026 FBI alert reported nearly 61,000 complaints of law enforcement or government impersonation between January 2025 and July 2026, with losses above $1.6 billion. It states that officials will never ask for payment by prepaid card, cryptocurrency or courier, and never phone or text the public to demand payment.
  3. A caller who knows your details has not proved anything. In a Form 8-K filed on 15 May 2025, Coinbase disclosed that on 11 May it received an extortion email, and that the attacker had paid contractors or employees in support roles outside the US to collect customer data: names, addresses, masked Social Security numbers, government ID images, balance snapshots and transaction history. Passwords and private keys were not taken. The company refused to pay, said it would voluntarily reimburse eligible retail customers who had sent funds to the attacker as a direct result, and preliminarily estimated costs at $180 million to $400 million. Leaked data makes impersonation convincing.
  4. US law addresses impersonation directly. The Federal Trade Commission’s Impersonation Rule, 16 C.F.R. Part 461, took effect on 1 April 2024. It makes it an unfair or deceptive practice to materially and falsely pose as a government entity or a business or its officers, or to misrepresent an affiliation with one. The FTC said the rule lets it bring federal court cases seeking money back for consumers and civil penalties. Under criminal law, falsely pretending to be a US officer or employee is a crime under 18 U.S.C. §912, punishable by up to three years, and the scheme itself is usually wire fraud. Enforcement depends on finding scammers, who are often abroad.
  5. Fake support also waits for you to reach out. Search adverts and lookalike sites imitate exchange login pages, and fake social media profiles pose as companies and agencies. The FBI’s November 2025 alert on account takeover fraud reported more than 5,100 complaints and over $262 million in losses since January 2025, and warned that two-factor codes do not protect you if you type them into a fraudulent login page. A real support agent has no reason to ask for your seed phrase, which controls a self-custody wallet completely (lesson 4.1.5), and a ‘safe wallet’ chosen by a caller is the caller’s wallet.
  6. The FBI’s core advice is simple: if someone contacts you about an account problem, hang up or stop replying, and contact the company or agency through a phone number or address you find yourself, not one the caller gives. Writing down each platform’s official support route in advance makes this easier under pressure. If you have already shared codes or sent funds, contact the real firm through its official channel to lock the account, change passwords on that and any reused accounts, keep the messages and transaction IDs, and report to the IC3 and the FTC (lesson 4.2.7). Expect follow-up ‘recovery’ offers (lesson 4.2.5).

Key facts

  • The FTC’s Rule on Impersonation of Government and Businesses, 16 C.F.R. Part 461, took effect on 1 April 2024.
  • Under 18 U.S.C. §912, falsely pretending to be a US officer or employee is punishable by up to three years in prison.
  • The FBI’s 2025 report counted more than 80,000 tech or customer support and government impersonation complaints, with losses exceeding $2.9 billion.
  • The FBI IC3 received 13,460 complaints involving crypto kiosks in 2025, with about $389 million in reported losses.
  • Coinbase disclosed in a Form 8-K filed 15 May 2025 that support personnel paid by an attacker had taken customer data, but not passwords or private keys.
  • Coinbase preliminarily estimated the incident’s costs, including voluntary customer reimbursements, at about $180 million to $400 million.

Exercise nine, six, three, one

9CollectList up to 9 ways an organisation you deal with could contact you, such as phone calls, texts, emails, app notifications, social media messages, letters or search results you click.
6ClusterSort them into 6 categories: contacts you started, contacts they started, official app or account messages, public social media, search results and adverts, and physical mail.
3DistillReduce the 6 categories to 3 groups: channels you can verify yourself, channels that are easy to fake, and channels you would never use to share codes or move money.
1CrystallizeWrite 1 sentence describing what you would do if a caller claiming to be your exchange said your account was under attack.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS