Free tools Windows power users keep installed
One-click scans. No signup required.
Assume every unexpected call, text, email, direct message, pop-up or “support” chat about your crypto account is hostile until you verify it independently. Do not click its links, call its number, disclose a password, one-time code, recovery phrase or identity document, grant remote access, or move funds to a “safe” wallet or crypto ATM. Open your exchange or wallet app yourself (or type a domain you already know), then use its verified support channel. If you may have exposed your account, act from a clean device: change the password, revoke sessions and API keys, secure two-factor authentication, and contact the exchange immediately.
Why crypto scams can become irreversible withdrawals
Crypto transactions generally settle on a blockchain rather than through a bank that can routinely reverse a payment. Once you approve a transfer to an address controlled by a criminal, recovery may be impossible. An attacker does not always need to “hack” an exchange: tricking you into revealing a login code, approving a malicious transaction, or sending a payment can be enough.
As an Amazon Associate I earn from qualifying purchases.
The most reliable defense is to separate urgency from verification. A genuine security team does not need you to bypass normal sign-in, disclose a secret, or send cryptocurrency to protect an account. The Federal Trade Commission (FTC) states: “No legitimate business is going to demand you send cryptocurrency in advance – not to buy something, and not to protect your money.”
The rules to follow when someone contacts you
- Stop the conversation. Do not stay on a call while the person “guides” you through a withdrawal, wallet transfer or identity check.
- Do not use their contact details. Ignore links, QR codes, callback numbers, email addresses and screen-sharing invitations supplied in the message.
- Never disclose secrets. This includes passwords, one-time passcodes, authenticator codes, recovery phrases, private keys, PINs and identity documents.
- Do not move money for safety. A “secure,” “escrow” or “government” wallet is still the scammer’s wallet if the request came from an unsolicited contact.
- Verify independently. Open the official app or type the exchange’s known web address yourself. Check account notices there and start a support request through the published help center.
The FBI advises hanging up, navigating separately to the official exchange website and never providing login information when an apparent exchange employee contacts you. Its warning is explicit: “If you receive a call or message indicating any kind of account problem or compromise, do not respond, even if it appears official and indicates you must act immediately.”
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Scam patterns that target crypto users
Fake exchange-security alerts
A caller, text or email claims that your account was compromised, a withdrawal is pending, or your identity must be rechecked immediately. The criminal may know your name, the exchange you use or partial transaction details gathered from data breaches and public posts. The objective is to obtain your password, one-time code, identity document or a session through a convincing login page. The FBI says these messages are designed to obtain account access and steal cryptocurrency.
Legitimate support will not ask you to read a one-time code over the phone, install remote-control software, or send coins to a new address. End the contact and check the account through the app you opened yourself.
Government, bank and technical-support impersonation
Impostors claim to be from a tax agency, bank, police department, internet provider or device-support desk. They create fear—an arrest, frozen bank account, hacked computer or imminent loss—and keep you on the line while you withdraw cash or buy cryptocurrency. FTC and Commodity Futures Trading Commission (CFTC) guidance describes this combination of authority, urgency and coaching as a common fraud pattern.
Do not let a caller dictate what you do on another account. Contact your bank, agency or technology provider through a statement, card or official website, using a new call or browser session.
Crypto-ATM and QR-code theft
A scammer may direct you to a Bitcoin or other crypto ATM, provide a QR code and tell you to deposit cash to “protect” your funds or settle a problem. The FTC warns that cash deposited after scanning a scammer-supplied QR code goes directly to the scammer’s wallet. Reported Bitcoin-ATM scam losses exceeded $65 million in the first six months of 2024, and the median reported loss was $10,000 during that period.
In a 2026 advisory citing FBI Internet Crime Complaint Center data, the CFTC reported more than $388 million in reported crypto-ATM scam losses in 2025. Treat any demand to use an ATM, voucher or QR code under pressure as fraud.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Fake recovery and “investment” services
After an initial theft, another person may promise to recover your coins. They invent taxes, legal deposits, validation charges or release fees and say one more payment will unlock the account. A frozen balance and a fee demand are not proof that funds exist or can be recovered. Stop sending money, preserve the evidence and report the case; do not pay a second “verification” amount.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAddress substitution and impersonation tokens
Malware, a compromised browser extension or a deceptive token can make a destination look familiar. Some criminals use an address with the same beginning and ending characters as a real address. The FBI advises checking the entire cryptocurrency address before sending. A token bearing a familiar name is not necessarily issued by the project you intended to use; verify the contract and network in an independent, trusted source.
Harden your exchange account before a scam occurs
1. Create a unique password
Use a long, randomly generated password stored in a reputable password manager. It must be unique to the exchange: a password reused on an email, shopping or social account can let a breach elsewhere become a crypto withdrawal. Do not keep the password in a notes app, browser profile shared with others or an unencrypted document.
2. Use the strongest available two-factor authentication
Prefer a hardware security key or an authenticator app over SMS when the exchange supports them. SMS can be exposed through number-porting and phone-account attacks. Save the authenticator’s recovery codes offline in a secure place; do not store a screenshot in cloud photo backups. A second factor cannot protect you if you voluntarily read its code to an impostor, so treat every code request as a stop signal.
3. Turn on withdrawal controls and alerts
In the exchange’s security settings, enable every control it offers for outgoing funds:
- Withdrawal allowlists that restrict transfers to addresses you have approved.
- A mandatory waiting period for a newly added address.
- New-device and new-login notifications.
- Alerts for withdrawals, API-key creation and changes to account security.
- A separate withdrawal limit or approval requirement, if available.
Read the exact behavior of each control. An allowlist may protect only withdrawals and not trades, internal transfers or blockchain-network changes. Confirm that alerts reach an email account you also protect with a unique password and strong two-factor authentication.
Rank #3
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
4. Minimize exchange balances
Keep only the amount needed for active trading or near-term transfers on an exchange. Moving long-term holdings away from a continuously connected account limits the value an attacker can withdraw if your credentials are stolen. This is a risk-reduction measure, not a guarantee: moving funds introduces its own address and signing risks.
5. Audit connected access
Regularly review logged-in sessions, recognized devices, API keys, third-party trading permissions and saved withdrawal addresses. Revoke anything you do not recognize and remove permissions you no longer need. Use the official interface reached independently, not a link in an alert. An API key with trading or withdrawal rights can be as dangerous as a leaked password.
Use a hardware wallet safely for long-term holdings
A hardware wallet keeps private keys in a dedicated device instead of exposing them continuously to an internet-connected computer. Manufacturer documentation describes Secure Element storage and physical approval of transactions on the device. The security benefit is reduced online key exposure; the responsibility for backups and careful signing remains yours.
- Buy through an authentic channel. Use the manufacturer’s official store or an authorized seller. Inspect packaging and initialization instructions, and never use a device that arrives with a prewritten recovery phrase.
- Initialize it yourself. Let the device generate the recovery phrase. Write it on paper or another durable offline medium; never photograph it, paste it into a website, save it in cloud storage or type it into a computer.
- Set a strong device PIN. Keep the PIN separate from the recovery phrase and do not disclose either to support personnel, family members who do not need access, or anyone contacting you unexpectedly.
- Install software only from the manufacturer’s official site or app store. Keep the device firmware and companion application current, but verify update prompts by opening the app yourself.
- Verify on the device screen. Compare the complete destination address, asset and network shown on the wallet’s own display with your intended transaction. Do not rely only on a computer screen or a copied address.
- Test recovery before depositing a large balance. Confirm that your written phrase restores the correct wallet using the manufacturer’s documented process, in an offline and controlled environment.
A hardware wallet cannot stop you from approving a fraudulent address or from revealing your recovery phrase. If a website asks you to enter the phrase to “sync,” “validate” or “unlock” the wallet, close it. The phrase is the backup that controls the assets; whoever has it can usually recreate the wallet elsewhere.
Exchange custody versus self-custody hardware wallets
| Security question | Exchange custody | Hardware-wallet self-custody |
|---|---|---|
| Who controls the private keys? | The exchange controls or administers the keys while you hold an account claim. | You control the keys and recovery phrase. |
| Main exposure | Phishing, stolen credentials, account takeover, exchange compromise and withdrawal-policy failures. | Phishing, malware that tricks you into signing, lost or exposed recovery phrase, and physical-device loss. |
| Convenience | Fast trading and transfers inside the platform; support may be able to restrict an account. | Extra device connection and address checks for each transfer. |
| Recovery responsibility | Account recovery follows the exchange’s identity and security procedures. | You must protect the phrase and restore the wallet yourself; loss of the phrase can mean permanent loss. |
| Withdrawal controls | May include allowlists, limits, alerts and time delays configured in account settings. | No exchange can impose a delay on a transaction you sign; controls depend on the wallet and application. |
| Physical confirmation | Usually not required for a web withdrawal after account authentication. | The device can require a physical button confirmation, but it confirms whatever address and amount you approve. |
Many people use both models: a limited exchange balance for active use and self-custody for holdings they can safely back up. Choose based on whether you are better equipped to manage exchange authentication or to protect a recovery phrase and independently verify every transaction.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify every withdrawal and deposit
Check the full address and network
Do not approve a transfer because the first and last characters look right. Compare the entire address, preferably by scanning from a trusted source and then confirming the full value on the hardware wallet or exchange confirmation screen. Confirm the network as well: sending an asset on the wrong network can make it inaccessible or require a recovery process that may not exist.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Use a small test transfer
For a new destination, send a small amount first when fees and the asset’s minimums make that practical. Wait for the expected confirmation, then send the remainder only after the address, network and recipient have been independently confirmed. A test transfer does not make a malicious destination safe; it only catches copying and network mistakes before the larger amount.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Beware approval transactions
Decentralized applications may ask you to approve a contract to spend tokens. Read the asset, spender and allowance shown by the wallet. Avoid unlimited allowances when a limited amount is sufficient, and periodically revoke approvals you no longer need through the wallet’s official tools. A physical confirmation proves that you signed; it does not prove that the contract is honest.
What to do if you clicked a phishing link or suspect unauthorized access
Speed matters, but do not let the attacker’s urgency dictate your next action. Use a device you trust; if the original computer may contain malware, use a different clean device and a network you control.
- End contact and stop payments. Do not reply, call back, send a second fee or approve another transaction “to cancel” the first one.
- Secure the email account first if it is connected to the exchange. Change its password from the clean device, sign out other sessions and enable strong two-factor authentication. An attacker controlling email can reset an exchange account.
- Change the exchange password. Use a new, unique password generated by your password manager. Do not reuse the exposed password anywhere.
- Revoke access. Sign out all sessions, delete unknown devices, disable unfamiliar API keys and remove unrecognized withdrawal addresses. If your second factor may be exposed, reset it using the exchange’s documented recovery process.
- Contact the exchange through its verified channel. Ask whether it can freeze withdrawals, lock the account or flag a recipient address. Do not use the phone number, link or chat supplied by the suspected scammer.
- Protect any self-custody wallet. If the recovery phrase was typed into a website, photographed, emailed or shown to someone, treat that wallet as compromised. Create a new wallet on a clean device, record its new phrase offline and move remaining assets only after checking the complete destination address and network.
- Check the device for malware. If you granted remote access or downloaded a suspicious file, update security software, run a full malware scan, delete detected threats and change passwords again after the device is clean. The FTC recommends these steps after remote-access scams.
- Preserve evidence. Save wallet addresses, transaction hashes, timestamps, emails, phone numbers, usernames, payment receipts and screenshots. Do not alter screenshots or delete the conversation before recording the details.
Blockchain transfers may be irreversible. Ask the exchange whether it can freeze a recipient account or coordinate with another service, but do not promise yourself that a reversal is possible.
How to report a crypto scam
Report the incident even if the amount was small or no funds were lost; reports help agencies connect addresses and campaigns. In the United States, submit fraud details to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov. Include the transaction hash, sending and receiving addresses, amount and asset, date and time, exchange or ATM used, messages, phone numbers, websites and screenshots. Also notify your bank or card issuer if cash, a card or a bank transfer was involved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical monthly security check
- Confirm the exchange password is unique and stored in your password manager.
- Test that two-factor authentication and offline recovery codes still work.
- Review recent logins, devices, API keys, connected applications and withdrawal addresses.
- Confirm withdrawal allowlists, time delays, limits and transaction alerts are enabled.
- Update wallet firmware and its companion app only through official channels.
- Inspect the recovery phrase’s physical storage without photographing or digitizing it.
- Revoke unused token approvals and disconnect applications you no longer recognize.
- Check that trusted beneficiaries still have the correct complete addresses and networks.
These checks reduce the chance that a quiet account change becomes an unnoticed withdrawal. They do not replace the core rule: an unsolicited request for credentials, a code, a recovery phrase or an advance crypto payment is a scam signal, regardless of how official it looks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
