
Cloned interfaces
A pixel copy on a near-miss domain. The swap screen works; the deposit address is the attacker's.
Gives it away: Read the domain, not the design.
See the Safety Academy →Know the Scam is the educational series SimpleSwap publishes on crypto fraud: each attack documented in full, with the mechanics laid bare rather than summarised into advice. This page groups the patterns it covers by method.
The distinction the series starts from is between a hack and a scam. A hack breaks code. A scam needs a decision from you, which means it has to surface before it can succeed — and that is the opening.
Six signals that appear regardless of which pattern you are looking at.
Each links to its full write-up in Know Scam on the SimpleSwap blog.

A pixel copy on a near-miss domain. The swap screen works; the deposit address is the attacker's.
Gives it away: Read the domain, not the design.
See the Safety Academy →
The crude tells are gone. Modern phishing mirrors the real thing closely enough that visual checks fail.
Gives it away: Arrive by bookmark, never by a link you were sent.
Read the breakdown →
Weeks of rapport, then a platform showing gains you cannot withdraw.
Gives it away: A friendship that ends at a trading platform is the scheme.
See the Safety Academy →
Synthetic video of a familiar face promising to double whatever you send.
Gives it away: Send-first giveaways do not exist.
Read the breakdown →
They answer public questions for help, then ask for a phrase or a test transfer.
Gives it away: Real support never opens the conversation.
Read the breakdown →
Malware silently swaps the address between your copy and your paste.
Gives it away: Compare the full pasted string every time.
Read the breakdown →
A script promising a bonus, built to harvest credentials or a signature.
Gives it away: No bonus requires running code or connecting a wallet.
Read the breakdown →
A single signature grants a contract standing permission over your tokens.
Gives it away: Read what the signature authorises before approving.
Read the breakdown →
Bots trade around your pending transaction, so your fill is worse than your quote.
Gives it away: Tighten slippage; use private routing where offered.
Read the breakdown →
History is seeded with a lookalike address so a later copy-paste goes astray.
Gives it away: Check the middle of the address, not just the ends.
Read the breakdown →
Buying works. Selling does not, by design or by vanished liquidity.
Gives it away: Confirm someone else has sold before you buy.
Read the breakdown →
Unrequested tokens lure you to a claim page that empties the wallet.
Gives it away: Tokens you did not expect are the hook.
Read the breakdown →Any other domain carrying the name is a copy, however exact the interface.
Logos, colours and layout clone in minutes. The domain does not.
HTTPS encrypts the connection. Phishing sites hold valid certificates too.
Standard swaps never require one, and never a seed phrase.
An account that contacts you first did not come from SimpleSwap.
Once confirmed there is no chargeback, so the check belongs before you send.
Every pattern on this page is drawn from the SimpleSwap Safety Academy, kept current with new cases as they appear.