Most crypto theft does not start with a hacked blockchain but with a convincing message. Here is how the manipulation works and the signs that give it away.
Published September 30, 2026 · 3 min read
Social engineering means manipulating a person into acting against their own interest, rather than breaking any technology. The scammer does not need to crack a wallet if you can be persuaded to open it for them. In crypto this works especially well because blockchain transfers are irreversible: once you send funds to the wrong address, nobody can bring them back. The attack can arrive as a message, a call, a support chat or a friendly stranger, and the channel matters less than the pressure it applies.
Scammers rely on a small set of levers that push people to act before they think. The table below pairs each lever with what it typically sounds like and a sensible response. Any single lever is a reason for caution, and several at once are a strong signal. Pressure is the common thread: the scam usually needs you to decide now.
| Lever | What it sounds like | Healthy response |
|---|---|---|
| Urgency | Act now or the offer disappears | Stop and take time to check |
| Authority | We are support or security and need to verify you | Contact the service via its official channel yourself |
| Fear of loss | Your funds are at risk unless you move them | Do not move anything; verify the claim independently |
| Promise of easy gain | Send a little and get much more back | Treat it as a warning, not an opportunity |
The goal is usually one of three things: a code, a login, or a transfer sent to an address they control. These are exactly the things a real service never needs you to hand over. A verification code is meant for you alone, and no support agent has a legitimate reason to ask for it. If a request involves any of the items below, treat it as suspicious no matter how professional the sender looks.
Start with the pressure: a deadline, a threat of losing access or money, or a reward that shrinks if you hesitate. Then look at who is asking and why they contacted you first, because unexpected contact from an official-sounding sender deserves doubt. Finally, check what is being requested; codes, logins and urgent transfers are the tell. A promise of easy gain with little effort or risk is another warning sign. This is general information, not investment or legal advice.
Slow down and verify through an official channel, meaning one you open yourself rather than a link or number the sender gave you. This step alone defuses most of these tactics, because they depend on speed. Do not share any code, and do not send anything while the conversation is still going. If a card is at risk, freezing it takes one tap in the Nexus Pay app and can be undone the same way, which buys time to check calmly.
Build small barriers that give you a moment to think. Nexus Pay offers an optional four-digit access code, and a Google login can be linked as a second way into the wallet. Before any deposit, confirm that the address matches the network you are using, since each address belongs to one network and a wrong-network transfer cannot be reversed. Above all, keep the rule simple: no legitimate service needs your codes, so the answer to such a request is always no.
In Telegram, in a minute, with no paperwork.
Open Nexus Pay
Opening…