Frequently asked questions

Scam Alerted is a live alert feed for online fraud. Each entry documents one operation: the domain, the wallet addresses and handles it uses, the platform it recruits through, the payment rails it demands, what people reported losing, and the dates everything happened.

It is built as a feed rather than an archive because online fraud runs on a short timetable. Infrastructure is registered, advertised hard, and abandoned within weeks. A record published months later is history. A record published within days can interrupt an operation while it is still taking money.

Every submission runs through the same checks: domain registration date and registrar records, hosting and certificate history, reverse image search on any product or profile photography, whether the claimed legal entity exists in the register of the country it names, whether a claimed licence number appears in the relevant regulator's own database, and whether the payment beneficiary or wallet matches the advertised brand at all.

Reported wallets and handles are also checked against alerts already on file. That cross-reference is what most often links a site registered last week to an operation that has been running for a year under different names.

Critical: Payment evidence on file, nothing delivered, and nothing refunded. Assume anyone reaching you with these details belongs to the same operation.

Elevated: Multiple objective indicators and reported payments, with verification still in progress.

Monitoring: Reported and published for transparency while checks continue. No confirmed loss yet.

Cleared: Checked and found legitimate, or the complaint was resolved by the operator.

No, and this is the most important limitation to understand. An absence means nothing has been reported yet, which is exactly the state every new operation is in. The most dangerous sites are usually the ones nobody has documented because they only launched days ago.

Treat a clear lookup as the absence of a warning, not the presence of a clearance. Run the independent checks regardless.

Because appearance is the cheapest part to fake. Templates, copied catalogues, scraped product and profile photography, invented staff biographies, generated reviews, live price tickers, and functional dashboards are all commodity components. A trading platform showing your balance climbing is a number in a database with a chart drawn around it.

Design quality carries almost no signal. Domain age, the identity of the payment beneficiary, and whether an independent register confirms the entity carry nearly all of it.

No. The padlock means traffic between your browser and that server is encrypted. It says nothing about who controls the server or whether they intend to deliver anything. Domain-validated certificates are issued automatically, free, within minutes, which is why every operation in this feed had a valid one.

The same applies to trust badges, verified-seller seals, app-store presence, and reviews displayed on the site itself. Those are images and listings the operator placed there. Nobody checked them.

Payment is requested through a rail with no reversal: crypto, bank transfer to a personal name, Zelle, Cash App, gift cards. The beneficiary name does not match the brand. The domain or account was created within the last few months. A returns, withdrawal, or delivery process exists on paper but every attempt to use it produces a new fee.

Contact arrived unsolicited through a messenger app. There is a deadline attached to the decision. Verification you did not arrange yourself is offered enthusiastically, while verification you propose — a live unscheduled video call, a regulator lookup, a small test withdrawal — is deflected.

Because no market position was ever opened. The displayed balance is a value in the operator's own database, and it grows because growth is what keeps deposits arriving. The withdrawal block is the harvest stage.

The requests that follow — a withdrawal tax, a liquidity fee, a compliance deposit, an anti-money-laundering verification payment — all share one property: they must be paid from outside the account. That requirement is proof that the balance is not real, because a genuine platform deducts fees from funds it actually holds.

Contact your bank or card issuer first and use precise language: for a card, request a chargeback for goods or services not received; for a transfer, request a recall and ask whether a reimbursement scheme applies. Same-day requests are stopped materially more often than next-day ones. If you paid a crypto exchange from your own account, contact the exchange immediately — funds occasionally have not left yet.

Then stop paying. Every additional fee framed as unlocking your funds is the same scheme continuing. Secure your accounts: change passwords, revoke active sessions, re-enrol two-factor authentication, and revoke any wallet token approvals you granted. Preserve everything before you block anyone, then file with your national fraud body.

Not through any reversal mechanism, because none exists. Once a transaction confirms it is final. Tracing is possible and worth doing through your national fraud body, but tracing is not recovery and it rarely results in funds returning.

This is precisely why recovery fraud is so effective on crypto losses. Anyone who contacts you after a loss offering to trace or retrieve funds for an upfront fee, a gas payment, or a tax clearance is running the second stage of the same operation.

No. Treat it as fraud without exception. Genuine agencies, regulators, and courts do not contact victims first about money they lost, and none charges a fee in advance to return it. Victim lists circulate, which is why the caller already knows your amount and your platform — that knowledge is evidence they bought the list, not evidence of legitimacy.

The same applies to support numbers found through search advertising and to anyone asking for remote access to your device. Never grant remote access to someone who contacted you or whom you found via an advert.

No. Published reporter accounts carry a first name or initials only, never an email address, phone number, home address, or banking detail. Ask to appear as an anonymous reporter and that is honoured.

An analyst may email you for clarification. Your contact details are used for that and nothing else, and never form part of the published alert.

Neither. Nothing here is behind a fee, a login, or a paywall, and no one working on this feed will ever contact you offering recovery. A warning nobody can reach protects nobody, and a service charging victims is indistinguishable from the fraud it claims to fight.

Corrections are published. Write from an email address on the domain in question with documentation: company registration in the jurisdiction claimed, any licence or authorisation number that can be confirmed in the regulator's own register, and records showing the disputed transactions were completed.

Where the documentation holds up, the alert is re-graded as cleared or withdrawn, with a dated note explaining what changed. Corrections are never applied silently.

Yes, with a link back. Write to press@scamalerted.com and we will share the underlying evidence we can lawfully disclose, including identifier overlaps between alerts that are not published in full. Bulk scraping of the feed is not permitted.