Crypto scams on small chains: the common tricks and how to avoid them

Most crypto losses are not clever hacks. They are a handful of old tricks that work because people are in a hurry. Small, fast-moving communities are a favorite target, because new users join every day and many of them are still learning. The good news is that a few fixed rules stop nearly all of them.

Rule 1: nobody needs your recovery phrase

Your recovery phrase (seed phrase) is the wallet. Whoever has it controls every coin in it, on every chain, forever. No real team, admin, support agent, website or app will ever ask for it, and there is no such thing as "validating", "syncing" or "unlocking" a wallet by typing it somewhere.

If a page or a person asks for it, the conversation is over: it is a scam. PEPU BANK will never ask for it, and if a recovery phrase is pasted or typed on our site, it is erased at once.

Rule 2: support never messages you first

A very common pattern: you ask a question in a public group, and within minutes someone sends you a private message offering help, often with an official-looking name and logo. They then send a link to a "support form" or ask you to connect your wallet to "fix" the problem. Real admins and moderators do not open private conversations to offer help. Ask in public, and ignore private messages that start the contact.

Rule 3: check the address bar, every time

Lookalike domains copy a real site pixel by pixel and change one letter in the address, or use a different ending. Search ads and links in group chats are the usual way in. Bookmark the sites you use and open them from the bookmark. PEPU BANK lives at pepubank.net and its subdomains, such as pad.pepubank.net; any other domain using the name is not us.

Rule 4: read what you sign

Connecting a wallet only shares your address, which is harmless. The danger is in what you approve or sign afterwards. A fake site will ask for an unlimited token approval or a signature that turns out to be a permit for your tokens. If a request is unclear, reject it. A real app will still be there in five minutes when you have checked what it does.

Rule 5: check the token before you buy

A honeypot is a token that you can buy but not sell: the contract blocks sales or charges an enormous tax on them. Others have an owner who can mint new supply, change fees or freeze transfers at will. These traps are visible on chain if you look before buying: who owns the contract, whether it can be changed, how the holders are spread, whether the liquidity is locked, and whether a test sale goes through. Our guide on checking a token walks through each point.

Rule 6: double-check large transfers

Some malware and some scams swap the address you copy for a similar-looking one. Before sending a large amount, compare the first and last characters of the address with the source, and consider sending a small test first. On PEPU BANK, a large transfer asks you to type the last 4 characters of the address for exactly this reason.

If something already went wrong

• Move what is left to a new wallet with a new recovery phrase, created on a device you trust.
• Revoke the approvals of the affected wallet.
• Do not pay anyone who promises to recover your funds: "recovery services" that contact you are a second scam.
• Warn your community in public, with the scammer address and the fake link, so others do not fall for it.