Skip to content
Last updated 2026-11-05

Common Transfer Phishing Scams and How to Stay Safe

Transfer phishing is an ordinary payment request with one detail changed: the address, the amount, or the reason behind it. The habit that defeats it is checking the full destination against a source you already trusted, not against the message that asked for it.

Who this is for

Anyone who sends BTG because another person asked: a purchase, a trade, a fee, a deposit, or a "refund". If you only ever send to addresses you saved yourself, treat this page as a review.

How the scam works

The contact arrives where you are already talking: a marketplace chat, a group, a DM, or the account of someone you know. The story is ordinary. You owe a fee, a refund is on its way, a seller wants a deposit, an investor needs the funds moved today.

Then the address is replaced. Three versions are common. The sender gives one address, lets you read it back, then sends a "corrected" one. Or the account you are talking to is taken over mid-conversation, and the destination changes at the moment you are ready to pay. Or the message contains an address that matches the real one at the start and the end and differs in the middle, where nobody looks.

Pressure does the rest: an auction closing, a limited slot, a claim that the sender's account is restricted until the payment lands. Some requests open with a small "test" transfer, which exists to prove the channel works before the larger one.

Two details matter on chain. A confirmed transfer cannot be recalled by anyone, so the check has to happen before you sign. And a "payment" is not always a transfer. If the wallet shows an approval or a contract interaction, you are being asked for permission, not for a payment.

Warning signs

  • The address exists only in the conversation, and never in an invoice, a signed message, or a record you made earlier.
  • A "corrected" address arrives after you confirmed the first one.
  • The reason is urgent, and you cannot verify it independently.
  • The wallet shows Approve, Permit, or a contract call when you expected a plain send.
  • A familiar account suddenly has a new tone, a new wallet, or a new payment channel.
  • A small test payment is demanded before a larger payout.

If it happens to you

  1. Stop sending. Do not complete a second half and do not send a "correction".
  2. If the transaction is still pending, a replacement with the same nonce and a higher fee can sometimes cancel it. A confirmed transaction cannot be touched.
  3. If it confirmed, save the transaction hash. Report the address to the platform where the contact happened and to your wallet provider.
  4. If the destination belongs to an exchange, contact that exchange. Only the receiving platform can decide whether to act on a police request, and it is not obliged to.
  5. If you signed an approval instead of sending, revoke it now, and move remaining funds if the key may be exposed.

Next steps

Self-check

  • Is the destination address written down somewhere other than the chat that requested it?
  • Can you compare all 42 characters, not the first four and the last four?
  • Would you refuse a payment that had to be made within ten minutes?
  • Can you tell an approval screen from a transfer screen in your wallet?