A message lands on Telegram: \u201cHi, I\u2019m Daniel from the security team at your exchange. We saw a login from a new device. Please confirm your wallet so we can protect your funds.\u201d The profile photo shows the company logo. The English is good. Daniel is patient, and he knows your username.<\/p>\n
Daniel does not work at the exchange. He works for a scam crew, and the \u201cconfirm your wallet\u201d link empties your\u00a0wallet.<\/p>\n
People reported losing $3.5 billion to imposter scams in 2025, and nearly $1 billion of that went to people pretending to be a business, according to the FTC\u2019s June 2026 report<\/a>. The FBI\u2019s figure for crypto is bigger. Victims told its Internet Crime Complaint Center they lost $11.4 billion to crypto-related crime in 2025, more than half of all the losses it counted that year (IC3 2025\u00a0report<\/a>).<\/p>\n A lot of those losses started the same way. Someone claimed to work for a company, and the victim took their word for it. Some victims did not know how to check. Others saw a familiar name, a logo and a confident tone, and felt no\u00a0need.<\/p>\n The checks run from a 30-second test to reading the hidden part of an email. If you only have time for two, use the first and the tenth: both are free, and both are very hard for a scammer to\u00a0fake.<\/p>\n Never use the contact details a stranger gives you to check that stranger.<\/strong><\/p>\n If \u201cDaniel\u201d sends you a phone number, a website or an email address and says \u201ccontact us here to confirm\u201d, all three belong to Daniel. Calling the number he gave you only proves that Daniel answers his own\u00a0phone.<\/p>\n Every check in this list works the same way. You find the company\u2019s official channel yourself, from a source the stranger did not hand you. Then you ask that channel whether the person is\u00a0real.<\/p>\n It looks official, so we assume it is.<\/strong> A logo, a job title and a company name take a minute to copy. Real staff photos sit on LinkedIn and on company \u201cTeam\u201d pages for anyone to download.<\/p>\n They already know something about us.<\/strong> Your username, your last order or the exchange you use is often public, or leaked in a data breach. Knowing those details says nothing about who the sender\u00a0is.<\/p>\n There is a clock.<\/strong> \u201cYour account will be frozen in 30 minutes.\u201d The deadline is there to stop you checking. A real company will still exist after you spend ten minutes confirming.<\/p>\n The more urgent the message, the slower you should\u00a0move.<\/p>\n Type the company\u2019s address into your browser by hand, or use a bookmark you saved earlier. Skip links in the message and skip search ads, because scammers buy ads for fake support pages. Find the support page or contact form and ask: \u201cSomeone called Daniel, Telegram @daniel_sec_team, says he works on your security team and contacted me today. Is that\u00a0real?\u201d<\/p>\n Example.<\/strong> A \u201crecruiter\u201d emails about a job at a well-known firm. You open the firm\u2019s careers page from a bookmark. The role is not listed, and the HR address on the page is another one. The recruiter does not work for the\u00a0firm.<\/p>\n The catch is speed. If support takes two days to reply, wait two days, and do nothing the stranger asks in the meantime.<\/p>\n Many crypto exchanges now run a page where you paste a username, email, phone number or link, and it tells you whether the contact is official. Three examples:<\/p>\n Binance Verify<\/strong> at binance.com\/en\/official-verification checks domains, email addresses, phone numbers and social handles, Telegram included. Binance says anyone who claims to work with Binance and cannot be confirmed there should be treated as untrusted.OKX<\/strong> has a channel verification page in its Help Center. OKX says to type the \u201c@\u201d before a username, or the result can be\u00a0wrong.KuCoin<\/strong> runs an Official Verification Center at kucoin.com\/cert. It checks emails, Telegram IDs, X accounts, websites and official wallet addresses.<\/p>\n Example.<\/strong> \u201cBinance support\u201d adds you on Telegram as @BinanceSupportDesk. You paste the handle into Binance Verify, and it comes back as not official. Block the account and report\u00a0it.<\/p>\n Reach these tools by typing the exchange\u2019s main address yourself and looking in its Help Center for \u201cverify\u201d or \u201cofficial channel\u201d. If the stranger sends you a link to a \u201cchecking tool\u201d, that link is the\u00a0trap.<\/p>\n A tool can confirm that an address belongs to the company. It cannot confirm that an email really came from that address, because the From line can be forged. Bybit\u2019s own help page warns about this. For email, add check\u00a05.<\/p>\n Ask the person to prove it on a channel only the company controls. Better still, contact that channel yourself. Here is a message you can\u00a0send:<\/p>\n \u201cBefore I continue, please send me a DM from @ExampleExchange, the official account, confirming you work there and what this is about. Or I can DM that account and\u00a0ask.\u201d<\/em><\/p>\n A real employee will say \u201csure\u201d or send you to the official support channel. A scammer will make excuses: \u201cThat account is for marketing only\u201d, \u201cour team can\u2019t access it\u201d, \u201cthis is confidential.\u201d Each of those excuses means the person cannot prove\u00a0it.<\/p>\n Make sure you have the right official account. Open it from a link on the company\u2019s own website, since search results can show copycat accounts. It should have years of posts and the follower count you would\u00a0expect.<\/p>\n Then look for X\u2019s affiliate badge. Companies that pay X to verify their brand can link their staff accounts. An affiliated employee shows a small copy of the company\u2019s profile picture next to their name, and tapping it opens the company\u2019s account. A plain blue tick on a personal account says nothing about employment, because anyone can buy\u00a0one.<\/p>\n Official accounts do get hacked. If the official account suddenly DMs you first with a link, treat that as suspicious too. Most companies never start private conversations about your\u00a0account.<\/p>\n A real employee can email you from a work address in a minute. Ask for it. A recruiter or \u201cpartner\u201d who only uses Gmail, Outlook.com, Telegram or WhatsApp fails this\u00a0test.<\/p>\n Then read the address slowly. Say the real company is Example Exchange at example.com<\/strong>. Each of these addresses is\u00a0fake:<\/p>\n support@examp1e.com (the digit 1 in place of the letter\u00a0l)hr@exarnple.com (“rn” looks like “m” in many\u00a0fonts)security@example-support.com (an extra word added to the\u00a0name)team@example.co (the wrong\u00a0ending)alerts@example.com.account-check.net (the real domain is account-check.net, read from the\u00a0right)help@ex\u0430mple.com (the “\u0430” is a Cyrillic letter that looks the same as the Latin\u00a0one)<\/p>\n Two more things to check in the same\u00a0email:<\/p>\n The display name can say anything.<\/strong> \u201cExample Exchange Security\u201d might sit on top of x7k2@mail-ru.biz. Click or tap the name to see the real\u00a0address.The Reply-To can differ.<\/strong> An email can arrive from an address that looks right and still send your reply to a stranger. Hit reply and look at the \u201cTo\u201d field before you\u00a0type.<\/p>\n A correct domain is a good start. On its own it can still be forged, which is why check 5 comes\u00a0next.<\/p>\n Every email carries test results that show whether it really came from the domain in the From line. Your inbox runs these tests already. You just have to\u00a0look.<\/p>\n In Gmail, open the email, click the three dots and choose \u201cShow original\u201d. In Outlook, open the message, then More actions, View, \u201cView message source\u201d. In Apple Mail, choose View, Message, Raw\u00a0Source.<\/p>\n Find the line that starts with Authentication-Results. A real email from example.com looks like\u00a0this:<\/p>\n dkim=pass header.d=example.com; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com<\/p>\n In plain\u00a0words:<\/p>\n SPF pass<\/strong> means the server that sent the email is on the domain\u2019s approved\u00a0list.DKIM pass<\/strong> means the email carries the domain\u2019s digital signature, and nobody changed the message on the\u00a0way.DMARC pass<\/strong> means at least one of those two tests passed for the same domain you see in the From line. This is the result to read\u00a0first.<\/p>\n Warning signs: dmarc=fail, spf=fail, dkim=none, or a pass for some other domain, such as dkim=pass header.d=bulk-mailer-7.net on an email that claims to be from example.com.<\/p>\n Example.<\/strong> An email from \u201csecurity@example.com\u201d asks you to reset your password. Gmail\u2019s \u201cShow original\u201d says dmarc=fail header.from=example.com. The From line is forged. Delete the\u00a0email.<\/p>\n A DMARC pass means the email left a mail system the company approved. A hacked staff mailbox passes too, and forwarded emails sometimes fail SPF while being genuine. Treat the result as strong evidence and combine it with the other\u00a0checks.<\/p>\n Raw email source is hard to read. A chatbot such as ChatGPT, Claude or Gemini can read it for you and point at the parts that look\u00a0wrong.<\/p>\n Open \u201cShow original\u201d (or \u201cView message source\u201d) as in check 5 and copy everything.Remove your own details first: your email address, name, phone number, account numbers and any codes. Replace each with \u201c[removed]\u201d.Paste the text into the chatbot with a prompt like this\u00a0one.<\/p>\n \u201cBelow is the raw source of an email, including headers and HTML. I think it may be a phishing email pretending to be from example.com. Please check: (1) Do SPF, DKIM and DMARC pass, and for which domain? (2) Does the From address match the Return-Path and Reply-To? (3) List every link in the HTML and show where it really points, compared with the text shown to me. (4) Are any domains lookalikes of example.com? (5) Anything else suspicious? Quote the exact lines you rely\u00a0on.\u201d<\/em><\/p>\n AI is good at this job. It will catch a link whose visible text says https:\/\/example.com\/login while the code behind it points to https:\/\/example-com.login-verify.app, and it spots lookalike domains and hidden text far faster than most people\u00a0do.<\/p>\n Example.<\/strong> You paste a \u201cyour withdrawal is on hold\u201d email. The chatbot lists four links. Three go to example.com. The \u201cRelease funds\u201d button goes to a domain nobody at the company owns, and that button is the\u00a0scam.<\/p>\n Chatbots also make mistakes in both directions. An email that \u201clooks fine\u201d to a chatbot can still come from a hacked real account. Make it quote the lines it relies on, then check those lines yourself. Never paste passwords, seed phrases or one-time codes into any\u00a0chatbot.<\/p>\n Before you click anything, hover over the link on a computer, or press and hold it on a phone, to see the real address. Read the domain from the right, as in check\u00a04.<\/p>\n Then look up when the domain was created. Paste it into the ICANN lookup<\/a> and check the \u201cCreated\u201d date. A company that has existed for ten years does not send security alerts from a domain registered last\u00a0Tuesday.<\/p>\n Example.<\/strong> A \u201cpartnership manager\u201d from a known crypto project emails from bd@exampleprotocol-team.com. ICANN lookup shows the domain was created nine days ago. The project’s real site has used a different domain since\u00a02021.<\/p>\n A brand-new domain is a strong warning sign. An old domain proves less, because some scam domains sit unused for months before they are\u00a0used.<\/p>\n A LinkedIn profile is easy to fake. A good fake still leaves gaps you can\u00a0spot.<\/p>\n Look for LinkedIn\u2019s workplace check.<\/strong> LinkedIn lets members confirm their current employer, most often with a code sent to their work email, and the result shows on the profile. It confirms the company only. The job title is unchecked, and only some companies support it so\u00a0far.Start from the company page.<\/strong> Open the company\u2019s official LinkedIn page, go to its People tab and search for the name. Searching from the company side is harder to fool than clicking a profile someone sent\u00a0you.Read the history.<\/strong> Real profiles usually have years of posts, a work history that makes sense, and connections who also work at the company. Fake ones are often new, with a few hundred random connections and a headshot that looks too\u00a0perfect.Message the profile directly.<\/strong> Ask the LinkedIn account to confirm the chat you are having on Telegram or WhatsApp. Scammers often copy a real employee\u2019s profile, and the real employee will reply confused.<\/p>\n A long history plus a workplace check is good evidence that the person exists and works there. It does not show that the person messaging you on another app is the same person, so always confirm on the profile\u00a0itself.<\/p>\n Many companies publish who speaks for\u00a0them:<\/p>\n The Team or About page<\/strong> on the official\u00a0website.The docs or Help Center<\/strong>, which often list official support channels and say \u201cwe will never DM you\u00a0first.\u201dThe GitHub organization<\/strong>. Open github.com\/the-company and look at public members. A developer who says they work there can usually be found in that\u00a0list.Telegram and Discord admin lists.<\/strong> Check the admin\u2019s username, the part with the @, and ignore the display name. Anyone can set a display name to \u201cExample Support | Admin\u201d. OKX advises copying the username from the profile screen. If the \u201cusername\u201d appears only in the bio, the account is probably\u00a0fake.<\/p>\n Example.<\/strong> You post a question in a project\u2019s Discord, and \u201cMod Alex\u201d sends you a private message offering help. You check the server\u2019s member list. The real Alex has a staff role and a different username. The account in your DMs joined the server yesterday.<\/p>\n Lists go stale when people leave, so when the stakes are high, confirm with check 1 as\u00a0well.<\/p>\n If someone phones you from \u201cthe company\u201d, hang up and call the number on the company\u2019s website or on the back of your card. Ask to be put through to that person or department.<\/p>\n Example.<\/strong> \u201cYour bank\u2019s fraud team\u201d calls and asks you to move savings to a \u201csafe account\u201d. You hang up and dial the number printed on your bank card. The bank has no record of the call. The FTC says bank impersonators caused the largest reported losses among business imposters in 2025, and these scams often end with victims persuaded to move money to \u201cprotect\u201d it.<\/p>\n This check is hard to beat. Use another phone if you can, because some scams keep the line open after you hang\u00a0up.<\/p>\n Crypto has a check that nobody can fake without the private key. If a project or team member claims to control a wallet the project lists publicly, ask them to sign a message with\u00a0it.<\/p>\n Find the wallet address yourself, in the project\u2019s official docs, website or official X\u00a0account.Ask them to sign a message with today\u2019s date and your name in it, such as: \u201cI am Daniel from Example Protocol. Signed for Priya on 29 October 2026.\u201d<\/em> The date and your name stop them from reusing an old signature.Check the signature on Etherscan\u2019s Verified Signatures<\/a> page. BaseScan, Arbiscan and other Ethereum-style explorers have the same tool. Enter the address, the message and the signature, and see whether it is\u00a0valid.<\/p>\n A valid signature proves the signer controls that wallet. Whether the wallet belongs to the project depends on where you found the address, which is why step 1\u00a0matters.<\/p>\n Plenty of people still treat a video call as the final word. Since 2024 that has been a costly habit. In January 2024, a finance employee at the Hong Kong office of engineering firm Arup joined a video call with what looked like the company\u2019s CFO and other colleagues. Every other face on the call was a deepfake. The employee made 15 transfers worth HK$200 million, about $25.6 million, before checking with the head office, Hong Kong police said. Arup later confirmed to CNN<\/a> that fake voices and images were\u00a0used.<\/p>\n If a video call is part of the story, confirm through a second channel you found yourself: the company switchboard, the official X account or a work email you already confirmed with checks 4 and 5. Ask for a calendar invite sent from the company domain, and run check 5 on\u00a0it.<\/p>\n Spend a minute on a web\u00a0search:<\/p>\n “@daniel_sec_team” scam”example-support.com””Example Exchange” recruiter scam<\/p>\n Also look for the company\u2019s own warnings. Many companies publish lists of fake domains and copycat tricks on their blog or Help\u00a0Center.<\/p>\n If others have reported the same handle or domain, you know it is a scam within a minute. An empty search proves nothing, because a new scam has no reports\u00a0yet.<\/p>\n Some requests are scams however well the person passes these 13 checks, because a hacked real account can pass every test. Nothing makes these requests\u00a0safe:<\/p>\n Your seed phrase, recovery phrase or private key.<\/strong> No company ever needs it. Anyone who asks is stealing.Your password or a one-time code<\/strong> from SMS, email or an authenticator app.Remote access or screen sharing<\/strong> through AnyDesk, TeamViewer or a \u201csupport\u00a0tool\u201d.Moving money to a \u201csafe\u201d or \u201csecure\u201d wallet<\/strong> or account to protect\u00a0it.Paying to receive money<\/strong>, such as a fee to unlock a withdrawal, a deposit to start a job, or \u201cgas\u201d to claim a\u00a0prize.Installing software for a job interview.<\/strong> Fake crypto recruiters ask candidates to install a \u201cvideo call app\u201d or run a coding test that carries\u00a0malware.Connecting your wallet to \u201cverify\u201d it<\/strong>, or signing a transaction you do not understand.<\/p>\n When you see one of these, stop. You don\u2019t owe anyone a polite\u00a0goodbye.<\/p>\n The message.<\/strong> \u201c@ExampleEx_Support\u201d writes: \u201cYour withdrawal is stuck. Connect your wallet at example-unlock.com to release\u00a0it.\u201d<\/p>\n The checks.<\/strong><\/p>\n Check 2: the exchange\u2019s checking tool says the handle is not official.Check 7: ICANN lookup shows example-unlock.com was created this\u00a0month.The requests list: \u201cconnect your wallet to release funds\u201d is on\u00a0it.<\/p>\n Verdict.<\/strong> Scam. Block the account and report it to the exchange and to Telegram.<\/p>\n The message.<\/strong> A LinkedIn profile titled \u201cSenior Talent Partner at Example Labs\u201d offers $180,000 for a remote developer role. The next step is a \u201ctechnical test\u201d: download a code repository and run it on your\u00a0laptop.<\/p>\n The checks.<\/strong><\/p>\n Check 4: you ask for an email from @examplelabs.com. The reply comes from a Gmail account, \u201cbecause of internal\u00a0policy\u201d.Check 8: nobody with that name appears on Example Labs\u2019 LinkedIn People tab, and the profile is four months\u00a0old.Check 1: Example Labs\u2019 careers page lists no such\u00a0role.The requests list: running unknown code from a stranger is on\u00a0it.<\/p>\n Verdict.<\/strong> Scam. If you already ran the code, treat the laptop as compromised. Move any crypto to a new wallet created on a clean device, and change your passwords from that\u00a0device.<\/p>\n The message.<\/strong> \u201cHi, I lead business development at Example Exchange. We\u2019d like to list your token. Please sign the attached agreement and pay the $15,000 listing deposit.\u201d<\/p>\n The checks.<\/strong><\/p>\n Check 5: \u201cShow original\u201d says dmarc=pass header.from=example-exchange-listing.com. The email really came from that domain, and that domain belongs to someone\u00a0else.Check 3: you DM the exchange\u2019s official X account. The exchange replies that it never asks for listing deposits by email and does not know this\u00a0person.Check 2: the exchange\u2019s checking tool does not recognize the\u00a0address.<\/p>\n Verdict.<\/strong> Scam. The email passed DMARC for its own lookalike domain, which is why reading the domain letter by letter (check 4) comes before the header\u00a0check.<\/p>\n Before you share anything, pay anything or click anything:<\/p>\n I found the company\u2019s contact details myself. This person did not give them to\u00a0me.I asked the company, through that channel, whether this person is\u00a0real.I checked the handle or email in the company\u2019s checking tool, if it has\u00a0one.I read the email domain letter by letter, from the\u00a0right.\u201cShow original\u201d shows dmarc=pass for the company’s real\u00a0domain.I checked where every link really goes, by hovering or with\u00a0AI.The domain is more than a few months\u00a0old.Their LinkedIn, team page or GitHub matches, and I searched from the company\u2019s side.Nobody asked for a seed phrase, code, password, remote access, a fee or a software\u00a0install.I am not rushing because someone told me\u00a0to.<\/p>\n If any line fails, stop and confirm through a channel you found yourself.<\/p>\n Act in this\u00a0order:<\/p>\n Stop all contact.<\/strong> Do not send \u201cone last\u201d payment to unlock the first one. Fake \u201crecovery\u201d offers usually follow, often from the same\u00a0crew.Secure your accounts<\/strong> from a device you trust. Change passwords, reset two-factor authentication and log out of other sessions.Move your crypto<\/strong> to a new wallet with a new seed phrase if you shared the old phrase or connected your wallet to a site. Revoke token approvals you do not recognize.Tell the real company<\/strong> through its official support. The company can freeze accounts and warn other\u00a0users.Report it.<\/strong> In the US, use reportfraud.ftc.gov<\/a> and the FBI\u2019s ic3.gov<\/a>. In the UK, use Report Fraud<\/a>. Elsewhere, contact your national police cyber-crime unit.<\/p>\n Contact the company through a channel you found yourself, such as its official website or official X account, and ask whether the person works there. Back that up with the company\u2019s checking tool if it has one, a work email from the real domain that passes DMARC, and LinkedIn\u2019s workplace check.<\/p>\n Yes. Anyone can buy a blue checkmark, and it says nothing about employment. On X, staff linked to a verified company show an affiliate badge, a small copy of the company\u2019s logo next to their name. Official accounts can still be hacked, so pair the badge with a second\u00a0check.<\/p>\n No. The From address can be forged, which is why you check for dmarc=pass in the raw headers. A real staff mailbox can also be hacked, and a hacked mailbox passes every check. If the email asks for anything on the requests list, treat it as a scam even when the headers\u00a0pass.<\/p>\n AI is very good at reading raw email source and finding fake links, lookalike domains and failed SPF, DKIM or DMARC results. It still makes mistakes. Use it to point at the suspicious lines, check those lines yourself, and remove your personal details before you\u00a0paste.<\/p>\n Most large crypto exchanges say their staff will not start private chats about your account and will never ask for funds, passwords or codes. Check the company\u2019s Help Center for its own policy, and treat any unprompted private message as unconfirmed until you check\u00a0it.<\/p>\n Ask for an email from the company domain, find the role on the company\u2019s own careers page, and search the recruiter\u2019s name on the company\u2019s LinkedIn People tab. Never pay a fee, buy equipment through the recruiter, or install software as part of an interview.<\/p>\n Stop replying, block the account, and report it to the real company and to the platform where you met. If you shared anything or sent money, follow the steps under \u201cIf you already replied or\u00a0paid\u201d.<\/p>\n Gaurav Agarwal writes about crypto security and on-chain investigations. If a scam message reached you that these checks did not cover, describe it in the comments, without personal details, and I will add a check for\u00a0it.<\/em><\/p>\n How to Verify Someone Really Works for a Company: 13 Checks<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" Scammers can copy a name, a logo and a job title in a minute. A few checks you can run yourself show whether a \u201csupport agent\u201d, recruiter or business partner is\u00a0real. A message lands on Telegram: \u201cHi, I\u2019m Daniel from the security team at your exchange. We saw a login from a new device. Please […]<\/p>\n","protected":false},"author":0,"featured_media":245228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-245227","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/245227"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=245227"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/245227\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/245228"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=245227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=245227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=245227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The one rule behind every\u00a0check<\/h3>\n
Why people skip the\u00a0check<\/h3>\n
13 ways to check that someone works for a\u00a0company<\/h3>\n
1. Contact the company yourself, through its official\u00a0website<\/h4>\n
2. Use the company\u2019s own checking\u00a0tool<\/h4>\n
3. Ask them to message you from the company\u2019s official X\u00a0account<\/h4>\n
4. Ask for an email from the company domain, then read that domain letter by\u00a0letter<\/h4>\n
5. Check the email\u2019s sign-in results (SPF, DKIM and\u00a0DMARC)<\/h4>\n
6. Paste the raw email into an AI chatbot and ask it to find the\u00a0tricks<\/h4>\n
7. Hover over links and check when the domain was registered<\/h4>\n
8. Check their LinkedIn the right\u00a0way<\/h4>\n
9. Check the company\u2019s team page, docs, GitHub and community admin\u00a0lists<\/h4>\n
10. Call back through the switchboard<\/h4>\n
11. For crypto: ask for a signed message from a known\u00a0wallet<\/h4>\n
12. Don\u2019t treat a video call as\u00a0proof<\/h4>\n
13. Search their name, handle and domain with\u00a0\u201cscam\u201d<\/h4>\n
Requests that end the conversation, whoever is\u00a0asking<\/h3>\n
Three common scams, checked step by\u00a0step<\/h3>\n
Scam 1: Fake exchange support on\u00a0Telegram<\/h4>\n
Scam 2: A recruiter from a crypto\u00a0firm<\/h4>\n
Scam 3: A \u201cpartnership\u201d email to a small\u00a0project<\/h4>\n
A checklist you can\u00a0save<\/h3>\n
If you already replied or\u00a0paid<\/h3>\n
FAQ<\/h3>\n
How can I verify if someone works for a\u00a0company?<\/h4>\n
Can a verified X account be\u00a0fake?<\/h4>\n
Is an email from the company\u2019s domain always\u00a0safe?<\/h4>\n
Can AI tell me if an email is a\u00a0scam?<\/h4>\n
Will a real company ever message me first on Telegram or WhatsApp?<\/h4>\n
What is the safest way to check a recruiter?<\/h4>\n
What should I do if someone fails these\u00a0checks?<\/h4>\n