Common Scams & Tactics
Here are some of the common scam types you may experience in the Web3 environment.
Last updated
Was this helpful?
The Sandbox Documentation
Here are some of the common scam types you may experience in the Web3 environment.
Last updated
Was this helpful?
Learn how to to help keep our community safe.
For better protection against scams on Web3, consider utilising Security Tools.
Sometimes scammers will design a fake mint or sale.
They may create a fake website to facilitate this.
They may also try to send you a DM on social media.
Or if your email was part of a data breach, such as those of OpenSea and CoinMarketCap, they may also send you an email.
This scam generally involves getting you to click a fake link, which will either:
Connect the scammer's DAPP to your wallet, allowing them to drain it of funds and NFTs.
Take the funds you paid and give you nothing back in return.
This is a type of phishing scam.
Always double-check The Sandbox's official Social Networks, News & Blogs to make sure any mint or sale news is legitimate.
See Security Tools for third-party tools that can be used to help combat this scam type.
Scammers may send you an invitation to take part in a test, alpha, or beta of some kind.
They may create a fake website to facilitate this.
They may also try to send you a DM on social media.
Or if your email was part of a data breach, such as those of OpenSea and CoinMarketCap, they may also send you an email.
This scam may involve:
Tricking you into connecting your wallet to a fake DAPP to drain it of funds and NFTs.
Asking you to confirm your identity by performing a KYC check, which in reality steals your data for the scammer to use elsewhere.
Tricking you into downloading fake software or launchers, which in reality is malicious software such as malware, crypto miners, or ransomware.
This is a type of phishing scam.
Always double-check The Sandbox's official Social Networks, News & Blogs to make sure any test or event news is legitimate.
Scammers may try to offer you a job or position at their "company". Particularly on social media and other communities.
A lot of the time, but not always, the pay they offer for this position is a bit higher than you'd expect (ie, $50 USD an hour). This is for two reasons:
To encourage more people to fall for it, especially those who are inexperienced in recognising things that are too good to be true.
To put off the more experienced individuals who know it's too good to be true and less likely to fall for it.
The purpose of this scam may be to either:
Gain access to your wallet by either:
Asking you for the seed phrase
Making you click a fake link that attaches a DAPP to the wallet to drain it.
Steal your personal KYC data by stating you need to pass KYC.
If you are looking for a job, make sure that you only use official job searching websites or the careers page on official company websites. Do not trust random job offers that happen to pop up on social media, communities, or your DMs.
A less common but still possible scam that can be experienced is a referral scam.
This scam involves the scammer creating a fake website and offering a referral or affiliate program with rewards.
However, the stated rewards are never delivered to the referees.
This scam type could be trying to:
Connect a wallet-draining DAPP to your wallet by getting you to "connect" your wallet to their platform.
Steal your KYC data, if KYC was a requirement for registration.
Generate funds by bombarding you and those you refer with ads.
Encourage you to purchase a "premium account" that will give you access to better referral rewards, which don't actually exist.
This scam may also be a type of pyramid scheme.
Romance scams have been around for centuries - because they have a high rate of success - so it is no surprise they are also present in Web3.
These scams will often prey on those who appear to be vulnerable, such as those who have low self-esteem, low confidence, social anxiety, feeling lonely, and so on.
This is also known as a "long con" type of scam, because it's a scam that takes some time and patience to develop.
This scam involves the scammer taking time to earn your trust, making you feel good with compliments, and perhaps sending an occasional (often very cheap) small gift, like flowers or an online gift card.
In reality, the scammer is actively speaking to multiple people at the same time.
They will gather and store data on each person in their sights, such as your personality type, your favourite things, your pets/family names, your sexual preferences, any personal selfies you send them, and so on.
They may pose as someone they are not. For example, a 43-year-old man may be using the photographs of a 23-year-old woman stolen from social media.
Eventually, the scammer will try to encourage you to send some funds. For example:
They may say they got themselves into debt and need help. Meaning you will be sending them funds for some time.
They may say they need financial help with a child, house payment, rent, etc. Meaning you will be sending them funds for some time.
They want you to be their "sugar daddy", which involves you paying for things for them. Meaning you will be sending them funds for some time.
They want to meet you but need help with costs such as a plane ticket and hotel. This is usually a one-time thing, but they may try a second time by faking a cancelled plane.
If you refuse to send them funds, they may often resort to blackmail, such as:
Threatening to send to your family and friends any compromising selfies you shared with the scammer.
Threatening to sell any compromising selfies or other media you shared with the scammer to adult-themed websites.
Threatening to come to your home, physically rob your home, or similar, if you gave them a postal address to send you a gift.
⚠️ If you are a victim of blackmail or other threats, it is extremely important that you report this to the authorities immediately, despite any warnings from the scammer not to do so. They will be extremely discreet and tread very carefully until any sensitive or compromising media or information has been recovered from the scammer/blackmailer so that they cannot carry out their threats.
If you are seeking genuine companionships or relationships, use an appropriate trusted community, like a dating website. Such official services will usually offer some degree of security against romance scammers. Do not be so quick to trust random people who happen to pop into your life on social media or in unrelated online communities.
This type of scam involves the scammer posing as a seasoned investor who has made a lot of money through investment scams.
They may either:
Offer fake investment advice or fake "insider trading" advice.
Offer to teach you how to become a successful crypto or investment trader.
They will usually, but not always, say things like:
"For sharing my time and knowledge with you, you'll only need to pay me 10% of everything you earn".
This scam type may involve the scammer asking you for an upfront fee or deposit.
If you pay this fee, one of two things will happen:
The scammer will disappear with the money you gave them.
The scammer will continue to try to take more funds.
If the scammer decides to continue to try to take more funds from you, this may involve:
Tricking you into investing into an "upcoming project", which is actually a rug pull they operate.
Tricking you into connecting your wallet to a fake investment website, which actually connects a wallet-draining DAPP to your wallet.
Sometimes but not always, the investment scam may have fake celebrity endorsement adverts.
This may also be known as a "fake Ponzi Scheme" (see below for information on Ponzi Schemes).
This is somewhat similar to the investment & investment mentorship scams above.
Ponzi schemes are generally operated by established long-term traders or investors.
The scam works by luring new, fresh investors into the market, often with far-fetched promises.
Because they are new to the investment world and inexperienced, the victims fall for this scheme quite easily.
Vague verbal constructions such as "hedge futures trading", "high-yield investment programs", or "offshore investment" might be used. In fact, there is no investment or trading, the funds are kept by the scammer.
Money invested into the scheme is used to string along those who fall for it, until it is time for the scammer to take the entire pot and disappear.
Example:
If 10 people invested $500 each into the scheme, the scammer gets $5,000.
The scammer uses some of this initial $5,000 to give "profits" back to the victims, for example $100 each. Meaning the scammer still has $4,000 profit in the pot.
The victims will then believe that their investment is working and will encourage others to join in too, increasing the amount of money in the scammer's pot.
Eventually, when the pot is deemed large enough by the scammer, they may disappear with the money. Or, especially if they are too much of a well-known figure, they may invent excuses for the funds vanishing, such as:
Market crashes.
Government fines.
Getting hacked/compromised.
A rug pull is a type of scam where the scammers create a fake crypto or blockchain project, usually some type of coin or NFT collection.
The scammers will encourage you to "pump up" the project and "invest a lot early" so that you get massive returns when the project kicks off.
In reality, once the scammer has generated a sizeable amount of funds from your "pumps", they will take the funds and disappear.
The coin or NFT you invested in will turn out to be either:
Completely worthless.
Impossible to resell due to the specifics of the smart contract.
CoinTelegraph offers an educational article on spotting and avoiding rug pulls
This scam is possible to be carried out on:
Public WiFi networks.
Unprotected home/business WiFi networks.
Unprotected bluetooth connections.
Information sent across a public or unprotected network, including crypto wallet information, can be intercepted by a scammer using that same network.
The information you are sending across the unprotected network would be filtering through the scammer's device on its way to its intended location - hence the term "man in the middle".
Avoid using public access WiFi if you can. If it is absolutely necessary to use a WiFi connection, then do not use it to send personal information. For example, making a bank transaction, online purchase, or connecting a crypto wallet.
A VPN may add an extra layer of security to protect you on public networks. However, they are not foolproof. Though currently rare, data sent through a VPN can still be intercepted, traced, and decrypted by those with the tools to do so (ie, someone who somehow came to be in possession of law enforcement technical equipment).
Contrary to popular belief, a VPN does not make you anonymous online. Their primary purpose is to hide your IP and browsing data from third-party advertisers and data miners, not to hide your identity.
Learn more about Man in the Middle Attacks.
Send you a DM claiming to be a support representative, admin, moderator, staff, or Ambassador. They will pretend to be assisting you with an issue you mentioned in a public chat channel.
Send you a DM claiming there's a sale, mint, giveaway or similar. Or claiming that you have won something or that you have been selected to take part in a test.
Post a link that looks like a typical attempt to shill another project (which is against our community rules). However, the link they are shilling is actually to a fake website or compromised app to attempt to steal your wallet credentials.
Claim that they are a crypto expert or investor who is looking to share their skills with you in return for commission on the profit you make with their teachings. This is an attempt to steal funds from you, not to make you any money.
Post a fake sob story about being in a tough spot, being heavily disabled, having medical expenses, being a war victim, and so on, asking people to send them donations.
The Sandbox supports charitable causes and encourages you to donate to officially registered charities if you wish to contribute, not to random people claiming hardship in conversations and communities, as they are likely scammers.
Pose as an interested buyer for an NFT you are selling, then try to encourage you to send them the NFT first in private so that fees are cheaper. If you make the mistake of sending them the NFT, they will not pay you because they never intended to. Conduct all sales through official marketplaces like OpenSea only.
Staff will also not mediate, oversee, or assist with "private" sales. Not only do staff not have the time to do this, it is also not their job. Scammers may utilise multiple accounts to impersonate staff overseeing a private sale.
Pose as a person seeking services from a creator or studio or offering such services. They may ask for something to be sent to them, like NFTs (as "proof of work"), funds, account access, or wallet seed phrases.
Always have a legally-binding and fully-signed contract with people you hire before any services or funds change hands. See Collaboration Security.
Pose as a person who is looking to hire testers, managers, or moderators, offering you cash for work. These scammers are likely to ask you to undergo a KYC process for their security. However, this process is actually an attempt to steal your KYC data for their own use.
In less common cases, they might also trick you into giving them access to your wallet in order to drain it.
Attempt to get you to click a fake link on social media or instant messengers, which might be disguised as a promotional link or a NSFW link, to entice you to click it. Clicking it and following through with the process may give the scammer access to your account.