After a major breach, the attackers who show up next aren't after the exchange. They're after you. Here's what fake support, refund and airdrop scams look like, and the daily habits that stop them.
Every day is zero day. You don't get advance notice of the morning someone targets you, so the habits have to be in place before the headline. This week's Binance incident is a good example: within hours the exchange was telling users to rely only on official channels, because criminals move fast to exploit the confusion.
Fake support. Scammers buy search ads for "Binance support number," reply to complaints on social media, and call or text pretending to be the exchange's security team. The script: your account is at risk, move funds to a "safe" wallet, or read me the code we just sent. A real support agent will never ask for a password, a one-time code, or a seed phrase, and will never ask you to move funds.
Refund and recovery scams. Emails and sites promise to "claim your compensation" or recover lost funds for a fee. The FBI has warned about fake recovery services that target people who have already lost money. If an exchange pays anyone back, it does it inside your account. You never have to connect a wallet or pay a fee.
Airdrop and "verify your wallet" phishing. Fake token giveaways and "wallet verification" pages ask you to connect a wallet and approve a transaction. That approval can hand over your funds. If you didn't go looking for it, don't connect.
SIM swaps. A criminal talks your mobile carrier into moving your number to their phone, then receives your text codes. Ask your carrier for a port-out PIN or number lock, and move important accounts off text-message codes.
The daily habits.
1. Get news only from the official app or a site you typed yourself.
2. Use a passkey or hardware key for exchange, email and banking logins.
3. Turn on withdrawal allowlists so funds can only go to addresses you saved in advance.
4. Treat any urgent call, text or DM about money as a scam until you verify it yourself.
5. For businesses: require two people to approve any crypto or wire movement, and tell staff these rules before the next headline, not after.