The scam that sells you safety
A new wave of fake "AML checkers" promises to tell you whether your crypto wallet is clean. The check is free. The signature it asks for is not.
Here is the pitch. A site — or a bot, or a helpful stranger in a Telegram group — tells you that your wallet may be flagged. Tainted coins, it says. Money that passed through a hack or a sanctioned exchange before it reached you. Paste your address, run a free "AML check," find out if you're at risk of getting frozen by an exchange.
Decrypt reported this week that scammers are impersonating crypto compliance services to get users to approve transactions that hand over access to their funds. The check itself is theatre. The real product is the button you press at the end of it — the one that asks your wallet to sign something. Sign it, and you are not verifying anything. You are giving a stranger permission to move your tokens whenever they feel like it.
Most crypto scams sell you greed. This one sells you fear — and fear is a better product. Anyone who has had a withdrawal held up by an exchange, or read about a friend's account being frozen for coins they never chose to receive, already knows the feeling. The scam doesn't have to invent the anxiety. It just has to offer a cure.
The mechanics are old and boring, which is exactly why they work. Signing a transaction in a crypto wallet is not like typing a password — it's more like signing a blank cheque and leaving it on the table. A lot of approvals don't move money right away. They grant permission to move it later, in any amount, at any time. Someone can approve on Tuesday and be drained on Friday, then spend the weekend trying to work out what they clicked.
A real compliance check never needs your signature. Looking up an address is a read-only act — anyone can do it with a public block explorer, no wallet connection required.
That is the whole tell, and it fits in one line. If a "safety" tool asks you to connect a wallet and approve something, the tool is the threat. The information it claims to give you is already public, free, and requires nothing from you but the address itself.
Anyone who has ever received tokens from a stranger, an airdrop, or a random person on Telegram and quietly wondered whether that money was clean — that doubt is the raw material of this scam. It hits hardest at people early in this: the twenty-somethings with a first couple of thousand in a wallet, who don't yet know which warnings are real, and who are exactly the ones most likely to panic and press the button. It also reaches people who came in through a job — freelancers and remote workers paid in stablecoins, who now handle crypto because a client sent it, not because they wanted a hobby in blockchain forensics. And it reaches parents and older relatives who were told crypto was dangerous, and will believe a screen that confirms it.
Watch where these fake checkers move next. Right now they live on lookalike websites and Telegram bots. The version to watch for is the one that arrives in your inbox pretending to be your actual exchange — same logo, same tone, subject line about a compliance review of your account. If wallet security firms start reporting that pattern in their next round of drainer reports, this stops being a niche trick and becomes a mass email campaign. The other thing to watch is your own approvals: revocation tools let you see every permission your wallet has ever granted, and most people who check for the first time are surprised by how long that list is.
The cleverest part isn't the code. It's that the scam borrowed the language of the people who are supposed to protect you — compliance, screening, risk score — and used it as a costume. When safety itself becomes a brand anyone can wear, the only defence left is knowing what a real check never asks for.
Sources: Decrypt, "Fake Crypto AML Checkers Are Trying to Drain Users' Wallets" (report on scammers impersonating compliance services)