Crypto payment scams
Crypto payments are generally irreversible, fast and sent to addresses that do not carry a name. Those same features make them attractive to fraudsters. This guide describes common scam patterns aimed at consumers and at businesses, the controls that reduce the risk and where to report in Canada.
Key points
- Pressure to pay urgently, and only in crypto, is a red flag in almost any context.
- Businesses face fake invoices and swapped wallet addresses as well as consumer-style scams.
- Anyone who promises to recover lost crypto for an upfront fee may be running a second scam.
- Report fraud to the Canadian Anti-Fraud Centre and your local police, and keep every record.
Why scammers like crypto payments
With a card payment, a cardholder can dispute a charge. With most on-chain payments, there is no issuer to call and no general mechanism to reverse a transfer once it is confirmed. A refund only happens if the recipient chooses to send one. Chargebacks versus irreversible payments explains the difference in detail.
Addresses are long strings that are easy to swap and hard to check by eye. Transfers can move across borders in minutes. And many people are new to the technology, which makes official-sounding instructions easier to believe. None of this makes crypto unusual as a target; it means the usual fraud warnings apply with less room for correction.
Scams aimed at consumers
When in doubt, hang up and contact the organization at a number or address you find yourself, not one given in the message. The consumer guide has more on paying with care on any rail.
| Pattern | What it looks like | Red flag |
|---|---|---|
| Impersonation | A caller or message claims to be a government agency, police, a utility or your bank and says you owe money or your account is at risk. | A demand to pay a tax bill, fine or fee in crypto, often at a crypto ATM, and to stay on the line. |
| Investment pitch | A new online contact or advertisement shows rapid returns on a crypto platform and urges you to deposit more. | Guaranteed or unusually high returns, and withdrawals that require a further fee. |
| Romance or friendship | Someone met online builds trust over weeks, then needs help with an emergency or an opportunity. | A request for crypto from someone you have never met in person. |
| Tech support | A pop-up or caller says your computer is compromised and asks you to move funds to a new wallet to protect them. | Any instruction to move your funds to protect them. |
| Recovery | After a loss, someone offers to trace and recover your crypto for a fee. | An upfront payment, often in crypto, before any recovery. |
Scams aimed at merchants and finance teams
Businesses face their own patterns, and many of them target the payment details rather than the person.
- Fake or altered invoices: an invoice that looks like it comes from a real supplier asks for payment in crypto, or to a new wallet address.
- Address swaps: a compromised email account sends a message that payment details have changed. Malware on a computer can also replace a copied address with the attacker's address at the moment you paste it.
- Over-payment refunds: a customer appears to over-pay, then asks for the difference back to a different address, or before the original payment has confirmed.
- Fake payment confirmations: a screenshot or email shows a payment that never reached the ledger.
- Fake support: someone posing as your wallet or payment provider asks for a recovery phrase, a login code or remote access.
A wallet's recovery phrase or private key gives full control of the funds. No legitimate support process needs it. See wallet security for businesses.
Recovery scams deserve their own warning
People who have already lost money are targeted again. A recovery scam may claim to be a law firm, a government unit or a blockchain investigator. It may show convincing tracing reports and ask for a fee, a tax or a deposit before releasing funds.
Because confirmed on-chain payments are generally irreversible, be very cautious of anyone who promises recovery in exchange for payment. Report the original loss and the recovery approach to the Canadian Anti-Fraud Centre and your local police.
Controls that reduce the risk for a business
- Generate payment requests from your own system, encoding the address and amount, instead of typing or copying addresses; see payment request standards.
- Verify any change to a supplier's payment details by calling a number already on file, never one in the message.
- Send a small test payment to a new address and confirm receipt before sending the balance.
- Require two people to approve outgoing payments and refunds above a set amount.
- Treat a payment as received only when it is confirmed on the ledger at your threshold, not when a screenshot arrives; see reconciling on-chain payments.
- Refund only to the original sending address, or to an address verified through a separate channel, and only after the original payment is confirmed.
- Train staff on these patterns and make it normal for them to pause a payment that feels wrong.
Check who you are dealing with
Registration does not prove a business is honest, but its absence can be a warning sign. Payment service providers in scope of the Retail Payment Activities Act must register with the Bank of Canada, which keeps a public PSP registry; the Bank does not license or endorse registered providers. Money services businesses, including those dealing in virtual currency, must register with FINTRAC before offering those services. Crypto trading platforms are overseen by provincial securities regulators.
Questions to ask a payment provider turns these checks into a list.
If it happens: first steps
- Stop any further payments and do not send money to anyone promising to fix it.
- Record the transaction hash, addresses, amounts, times and every message, call log and website involved.
- Contact the platform or provider you used to send the payment and ask them to flag the receiving address.
- Report to the Canadian Anti-Fraud Centre and your local police.
- If a financial institution was involved, the Financial Consumer Agency of Canada has information on your rights and how to complain.
Questions people ask
Can a crypto payment to a scammer be reversed?
Confirmed on-chain payments are generally irreversible. A return only happens if the recipient sends one or if an intermediary holding the funds acts, so report quickly and keep records.
Is a request to pay a bill in crypto always a scam?
Not always, but pressure to pay urgently, only in crypto and through an unusual channel is a strong warning sign. Verify independently before paying.
Where do I report crypto fraud in Canada?
Report to the Canadian Anti-Fraud Centre and your local police. Keep the transaction hash and all messages.
Does a provider's registration mean it is trustworthy?
No. Registration with the Bank of Canada or FINTRAC is a regulatory requirement, not an endorsement. It is one check among several.
Sources
- Canadian Anti-Fraud Centre
- Financial Consumer Agency of Canada
- Bank of Canada — PSP registry
- FINTRAC — Money services businesses
Reviewed October 30, 2026. Educational information only; not financial, legal, tax or investment advice. This site does not process payments or hold funds.