Social engineering doesn't exploit technical vulnerabilities — it exploits human weaknesses: trust, greed, fear, and urgency. This article breaks down the classic social engineering playbooks used against crypto users. The conclusion up front: 90% of retail victims are scammed through social engineering, not technical exploits, deepfake video calls are an emerging threat in 2025-2026, and any "support agent" who asks you to send funds, hand over your private keys, or hand them remote control of your computer is a scammer. For your day-to-day account, register through the Binance Official Site, Android users can install the Official Binance App, and iPhone users switching to an overseas Apple ID should check the iOS install guide.

1. Seven Classic Social Engineering Playbooks

2. Playbook 1: Fake Customer Support

This is the most common form of social engineering.

Typical scripts:

• "Your Binance account shows unusual login activity and needs to be handled immediately"
• "There's a problem with your KYC information that needs to be re-verified"
• "You can speed up your withdrawal, but you'll need to deposit a margin first"
• "Your account has been frozen by risk control; you need to provide your seed phrase to unfreeze it"
• "You've won a prize from a promotion, but you need to pay the tax first to claim it"

Typical contact channels:

• Adding you on WeChat out of the blue (username includes "support")
• Adding you on QQ (impersonating a "Binance official support" group member)
• Phone calls (spoofed numbers displaying "00xxxxxxxxxx")
• Text message links (impersonating an exchange's domain)
• Telegram group DMs impersonating support
• Impersonation emails

Real case 1:

A user searched for "Binance customer support" on a search engine and added a QQ contact claiming to be "Binance support." The "agent" said the user's account had been frozen over suspicious transactions and needed "0.5 BTC transferred to a designated address as a margin deposit, which would be fully refunded after verification." The user complied and lost 0.5 BTC (around $50,000).

Real case 2:

In 2025, a user received a phone call from someone who accurately recited the user's name, ID number, phone number, and Binance registration date — information that had been circulating on the black market since a May 2025 data breach. The "agent" claimed the account showed unusual activity and asked the user to install AnyDesk for remote assistance. After installation, the scammer moved $80,000 worth of assets out of the user's Binance account within 30 minutes.

Protection tips:

• Official support will never contact you first (unless you previously filed a ticket and are receiving an email reply)
• Official support will never ask you to transfer a "margin deposit"
• Official support will never ask you to install remote-control software
• Official support will never ask for your seed phrase, private key, or password
• Any "you've won a prize" message is a scam

Q: How do I actually reach real customer support?

The only correct way:

1. Log in to the official website or app (bookmark the domain directly; don't reach it through a search engine)
2. Open the "Live Support" feature (usually a floating widget in the bottom-right corner)
3. Official support only responds when you contact them first

Official support will never, ever:

• Add you on WeChat or QQ
• Call you on the phone
• Text you about "account issues"
• DM you on social media

3. Playbook 2: The Remote-Control Trap

Scammers ask users to install remote-control software like TeamViewer, AnyDesk, or similar tools.

Typical scripts:

• "Let me remote in and fix the account issue for you"
• "Our engineer will remote in to look at the anomaly"
• "Just follow my instructions"

What happens once they're in:

1. They get the user to log into their crypto exchange
2. They wait until the user steps away for a moment
3. They edit the withdrawal whitelist to add the scammer's address
4. They disable notifications and block relevant emails
5. They withdraw the funds and shut down the computer

Real case:

An older user received a call from someone claiming to be from "Binance risk control," saying remote assistance was needed for an account anomaly. After installing AnyDesk, the scammer told the user to "enter your login password and 2FA code, then step away for 5 minutes to rest." By the time the user came back, 120,000 USDT had been drained from the account and the scammer had disconnected.

Protection tips:

• Any "support agent" asking you to install remote-control software is a scammer
• Official support never needs remote control (live chat can walk you through steps instead)
• If you've already installed remote software: uninstall it immediately, change your passwords, and check every account

Q: Is remote-control software itself a problem?

TeamViewer and AnyDesk are legitimate tools widely used for IT support. The issue isn't the tool — it's that:

• You shouldn't let a stranger take remote control of your computer
• In a crypto trading context, remote control equals stolen assets

Using remote-control software in a normal context (like family IT support) is fine — but never install it in a crypto or banking context.

4. Playbook 3: Fake Project Team Scams

Scammers impersonate official team members of a crypto project and DM users directly.

Typical scripts:

• "Our project is about to list on Binance — here's an early insider price just for you"
• "Limited-time airdrop, only 3 whitelist spots left"
• "You interacted with our project before, so you're eligible to claim XXX tokens"

Scam patterns:

1. Private sale scams: asking you to send ETH/USDC to a "project team wallet"
2. Airdrop phishing: linking to a fake Approve-signing phishing site
3. Presale scams: buying "insider-priced tokens" that turn out to be counterfeit or worthless

Real case:

A user received a DM on Discord from someone "claiming to be a LayerZero team member," saying an airdrop was coming and offering the user an early whitelist spot. After clicking the link and connecting their wallet, the user signed a "Verify wallet" transaction that authorized a malicious contract, which drained 4,500 USDC from the wallet.

How to spot it:

• Official project teams never DM users first (not on Discord, Twitter, or Telegram)
• Official airdrops never require "paying gas first" or "signing a verification transaction"
• Whitelist spots are never handed out through DMs (they're always distributed through on-chain events or official announcements)

Q: How do I verify a project account is genuine?

Five steps:

1. Check for a Twitter verified badge (blue check plus a known account name)
2. Check the follower count (a real account usually has 100,000+)
3. Check the account creation date (a real account is usually 1+ years old)
4. Cross-check against official documentation (the project's website lists all its official accounts)
5. Don't trust any DM (even a "verified" account could have been hacked)

Official announcements 100% go through pinned Twitter posts and Discord announcement channels — never through DMs.

5. Playbook 4: Romance Scams ("Pig Butchering")

Romance scams target older, single users.

Typical flow:

1. Build a relationship (30-90 days): meet through a dating site or social platform, then a long-distance online romance
2. Build trust: the scammer claims to work in finance, be "good at investing," and be based in "Singapore or Hong Kong"
3. Steer toward crypto investment: recommending an "exclusive exchange" or a "private mining project"
4. Small taste of success: the user invests $1,000-$3,000 first, and fake data shows "you're up 50%"
5. The big harvest: the user invests more heavily — $50,000-$500,000 — then the platform disappears or blocks withdrawals

Real case:

A retired 55-year-old teacher met "Mr. Li, who works in finance in Singapore" on a dating site. After a three-month online romance, she was steered into an "exclusive crypto exchange investment" called KCEX. Her first $7,000 deposit successfully withdrew as $7,700, so she invested another $400,000 (her retirement savings plus a loan). The platform then claimed her "account was abnormal and needed $70,000 transferred to unfreeze it." She ultimately lost $400,000.

Warning signs:

• Claims to "work in finance" and to be based in "Hong Kong, Singapore, or Dubai"
• Rarely video calls, or keeps video calls very short
• Never meets in person (citing the pandemic, business trips, etc.)
• Recommends an "exclusive platform" (not a mainstream exchange like Binance or OKX)
• Asks you to download an "exchange app" (actually a fake app built by the scammer)

Protection tips:

• Never discuss money with an online romantic interest
• Any "exclusive investment opportunity" is a scam
• Never trust screenshots showing "how much you've made" (screenshots can be faked)
• Only use mainstream exchanges (Binance, OKX, Coinbase, etc.)
• File a police report and consult your national anti-fraud hotline

Q: Can money lost to a romance scam be recovered?

The recovery rate is extremely low (under 5%):

• Scammers are usually based overseas
• The funds have already been laundered on-chain and can't be traced
• Once the platform disappears, there's nothing left to claim against

Prevention is worth 100 times more than recovery.

6. Playbook 5: Deepfake Attacks

An emerging threat in 2025-2026: AI face-swapped video calls.

How it works:

• Scammers collect video footage of the target (social media, interview clips)
• They train an AI model to generate a "face-swapped video"
• They perform real-time face swapping and voice cloning during a video call

Real case:

The finance department of a multinational company received a video conference invitation from their "CFO." In the meeting, the CFO plus four "colleagues" were all "present" and asked for an urgent transfer of HKD 200 million (about $25.7 million) to a designated account. Finance staff completed the transfer, only to later discover that every "colleague" in the call was an AI face-swap and the real CFO had no idea any of this had happened.

Deepfakes targeting crypto users:

• A "video call from the Binance CEO" asking you to verify your account
• A "video of a family member in danger" asking for urgent crypto to help
• A "fake project team video call" pitching an investment

How to spot it:

• Ask a question only the real person would know (their elementary school teacher's name, a family inside joke)
• Ask them to perform a specific gesture (cover their mouth with a finger, turn their head, touch their ear): AI face-swaps often handle these poorly
• Watch the lighting, pupils, and mouth movements closely: AI face-swaps often show small, unnatural glitches
• Verify through a second channel: hang up and contact the real person through a different method to confirm

Q: How can I tell if a video call is a deepfake?

A simple test:

1. Ask them to turn to a 90-degree profile: AI face-swaps handle side profiles poorly and often show visible distortion
2. Ask them to quickly wipe their face with a hand: real-time face-swap algorithms can't keep up, and the face may briefly "disappear"
3. Ask them to take off or put on glasses: AI struggles to render glasses edges correctly
4. Ask about something private they just mentioned: even if AI can mimic tone, it will stumble on the details

The most reliable check: contact the real person through a second, independent channel.

7. Playbook 6: Dark-Web Extortion

"I have your private video — send 1 BTC to this address, or I'll send it to everyone in your contacts."

Typical extortion tactics:

• Mass extortion after a database leak: scammers pull emails and passwords from leaked databases and send mass emails
• The fake "adult site malware" claim (which doesn't actually exist): claiming to have recorded the user visiting adult websites
• Photoshopped fake images: composited "private video" screenshots

Real case:

Hundreds of users received an email claiming "we recorded you through your webcam visiting adult websites" and demanding 1 BTC (around $80,000) be sent to a specified address, or the footage would be sent to all their contacts. The email included the user's real email password (sourced from a database leak) as "proof." In reality there was no video at all — it was purely a social-engineering scare tactic.

Protection tips:

• The vast majority of these threats are pure intimidation (there's no real video)
• Do not reply, and do not pay
• Change your email password and any reused passwords on other platforms
• File a police report (keep the email as evidence)

Q: How did they get my real password if there's no video?

The scammer's password source is a database leak:

• Historical breaches from LinkedIn, Adobe, Yahoo, and others
• Password reuse means the scammer knows a matching email-password combination

This does not prove they have a video — it only proves your email password has been leaked and needs to be changed immediately.

8. Playbook 7: Fake Coworkers or Fake Bosses

Targets corporate finance staff or crypto treasury managers.

Typical scenarios:

• An email impersonating the CEO: "Urgent — transfer X USDT to this address"
• WeChat impersonating the finance director: "Handle this crypto payment right away"
• A text impersonating the chairman: "Don't tell anyone, just transfer it directly"

Warning signs:

• Urgency: "immediately," "right now," "within 5 minutes"
• Secrecy demands: "don't tell anyone else"
• Bypassing normal process: "skip the ERP system, handle it directly"
• An amount that's "just right": close to the maximum you're authorized to approve

Real case:

A CFO at a crypto foundation received a "CEO email" requesting an urgent transfer of 500,000 USDT to a specified wallet, citing it as "negotiation collateral to be returned next Monday." The CFO made the transfer, only to later discover the real CEO knew nothing about it — the email had come from a spoofed domain that differed by a single letter.

Protection tips:

• Be suspicious of any instruction that combines "urgent," "secret," and "large amount"
• Verify through a second channel: call the person directly to confirm
• Follow standard process: never bypass company approval or reimbursement systems

9. The Psychology Behind Social Engineering

The human weaknesses scammers exploit:

Q: How do I train myself to spot social engineering?

Three principles:

1. "Anything that pressures you to act urgently — pause first": scammers fear nothing more than "let me think about it"
2. "Decline based on what your role actually requires": support staff have no legitimate reason to ask you to send money
3. "Anything too good for you to have earned isn't real": guaranteed returns don't exist

When in doubt, hang up and verify through a second channel.

10. Educating Family and Employees

Social engineering has a chain-reaction effect:

• You get scammed — you lose personal assets
• Your family gets scammed — you lose household assets
• Your employees get scammed — the company loses assets

Key points for family education:

• Don't stay on the phone with unknown callers for long
• Don't install "support apps" from unknown sources
• If you get a call about "a family member in danger," call that family member directly to confirm first

Key points for employee education:

• Company transfers always follow standard process (never bypass approval)
• Verify any "urgent instruction from the boss" with a direct call
• Check email domains carefully (phishing domains often differ by a single letter)
• Crypto treasury roles should require dual approval for all large transactions

11. Emergency Response

If you've been targeted by social engineering:

1. Stop immediately

• Stop believing anything the other party says
• Don't follow any further instructions from the "support agent"

2. Assess the damage

• Which accounts have been accessed?
• Which funds have been moved?
• What information has been exposed?

3. Contain the damage

• Change the passwords on every related account
• Disable API keys
• Contact exchange risk control to freeze the account
• Contact an on-chain analytics firm to trace the funds

4. File a police report

• File a report at your local police station (keep the filing record)
• Contact your national anti-fraud hotline
• Tell family and coworkers (to prevent the scammer from targeting your network next)

5. Take care of yourself emotionally

• Getting scammed isn't shameful — these scammers are professionals
• Lean on support from family and friends
• Consider talking to a therapist if needed (especially for long-term victims of romance scams)

12. FAQ

Q: Can money lost to social engineering be recovered?

Recovery rates:

• Assets stolen inside a CEX: 50-80% (through exchange risk control freezes)
• Funds moved on-chain through a DEX: under 5%
• Cross-border scams (from certain overseas scam hubs): essentially impossible

Speed of response is critical (within 24 hours).

Q: If a friend gets scammed, can they come after me?

It depends on the legal specifics:

• If you simply introduced a friend to crypto: you're not liable
• If you helped a friend "invest" in a scam project: you could be held liable (as an accomplice or facilitator)
• If you were purely a fellow victim: you're not liable

Responsibility for social engineering rests primarily with the scammer, but avoiding recommending specific platforms or projects to friends reduces your risk of disputes.

Q: Can I keep using Binance after being scammed by a fake support agent?

Yes. The problem isn't the exchange — it's your account security:

• Change your password and 2FA
• Check your API keys
• Check your login history
• Strengthen your security settings (anti-phishing code, withdrawal whitelist)

Q: How do I verify an "official Binance" phone number?

Binance doesn't operate a mainland Chinese phone support line:

• Any call claiming to be "Binance support" is a scam
• Official support is reached through overseas English-language channels (that you contact first)
• Official support never calls users first

Q: Can I actually sue a scammer?

Possibly, but it depends on:

• Whether the scammer's identity can be confirmed (usually impossible if they're overseas)
• The amount involved (small amounts make litigation cost-prohibitive)
• Jurisdiction (cross-border prosecution is extremely difficult)

Local police will usually file a report, but actual prosecution rarely goes far.

Q: Is it worth sharing my scam experience publicly?

Absolutely:

• It warns other users away from similar scams
• It helps police gather evidence
• It's emotionally healing (talking about it beats keeping it bottled up)

Many anti-fraud awareness videos and articles are based on real victims' accounts.

Q: What should I do if I notice someone I know is being scammed?

Three steps:

1. Stay calm when talking to them: don't bluntly say "you're being scammed" — that can trigger defensiveness
2. Show them evidence: search for similar known scam cases
3. Contact the police: if they still don't believe you, police can step in to warn them directly

Long-term scams like romance scams are hard to break through with words alone once the victim is deeply invested.

Q: Can AI assistants help detect social engineering?

Partially. AI assistants can:

• Identify phishing email characteristics (domain, wording)
• Assess the plausibility of a crypto transfer request
• Provide anti-fraud information lookups

But the final judgment call still requires a human: whether to trust, whether to transfer funds. AI is a helper tool, not a replacement for human judgment.

Data Sources

• Public case files from national anti-fraud centers
• Case summaries from the Hong Kong Police anti-scam coordination center
• U.S. FBI Internet Crime Report (2024)
• Chainalysis Crypto Crime Report (2025)
• SlowMist compilation of social engineering attack cases

Risk warning: This article is an independent third-party summary and does not constitute investment or legal advice. Social engineering is the leading cause of retail losses in the crypto industry, and prevention matters far more than recovery. All data reflects April 2026.