Fake airdrops and fake support staff

Why airdrop season is peak season

Because for a few weeks, "unfamiliar link + do something + get tokens" is a completely normal-looking combination. Any other month you'd hesitate. During a launch that's precisely what you're waiting for.

Two things amplify it. Time pressure: an Alpha event only counts if you confirm it yourself, the points come off the moment you confirm, and each round has a start and an end — people in a hurry skip checks. And noise: the same event is reposted by countless accounts, genuine and otherwise mixed together, so identifying the original source is genuinely hard.

Which is why the defence isn't "learn to identify fake pages" — they keep getting better. It's changing how you arrive: whatever you see, go back to an entrance you already trust and confirm from there.

The Alpha confirmation and points-deduction rules cited here come from the Binance help centre page Binance Alpha Points FAQ (page marked updated 2026-07-10, checked October 2026). Rules change; go by what the page says when you open it.

Method one: the fake claim page

Visually near-identical, with a domain that differs by a character or two, or uses a similar-looking suffix. You connect a wallet, press claim, and what actually executes is a transfer or an approval.

Things that help:

• Read the domain character by character, not by overall impression. Common tricks: an inserted hyphen, one swapped letter, a different top-level domain.
• Notice what it wants from you. Claiming an exchange promotion normally happens inside the exchange app; it doesn't require connecting an on-chain wallet and signing.
• Notice whether it's rushing you. "9 minutes 58 seconds remaining" pressure design is uncommon on official activity pages.

Still, the reliable move is the same one: don't click, open the app and find the entry yourself. If the event exists, it's there. If it isn't there, the opportunity wasn't yours to begin with.

Method two: the signature request

The most expensive of the four, precisely because nothing gets debited at the time.

Signing means granting a contract permission over a token in your wallet. After an unlimited approval, the other party can move that token at any point they like: possibly right then, possibly three months later when you've long forgotten about it.

Doing Megadrop's Web3 quests, or choosing to trade Alpha tokens inside the wallet, means you carry one more layer of on-chain exposure than someone using only the exchange. The underlying difference between the two is in Web3 Wallet is not your exchange account.

Method three: the helpful stranger

Exchange notices arrive via in-app messages, announcements and push notifications. Staff do not start private conversations with you. No exceptions — hold that one line and an entire category disappears.

The usual script: you ask in a group why you didn't receive something, and within minutes a "support agent" messages you offering to look into it, then steers you towards a "verification page" or asks for a "sync code". That code is generally your seed phrase or a login verification code.

The boundary is unambiguous: nobody, for any reason, needs your seed phrase, private key or verification code. Real support won't ask; anyone asking isn't real support.

Method four: the token that appeared by itself

An unfamiliar token shows up in your wallet, apparently worth a decent amount. You go to sell it, and that's where it starts.

These contracts are frequently built with restrictions: buyable but not sellable, or requiring an approval before a sale, or redirecting the trade action to a phishing site. Making you money was never the design; moving you to the next step was.

The handling is trivial: treat it as though it isn't there. Hide it in your wallet, don't tap it, don't research it, don't try to sell. Sitting there it costs you nothing. Interacting is the only way it hurts you.

How they found you

"I don't hold enough for anyone to bother targeting me" contains a wrong assumption: nobody is targeting you. None of this is selection. The same message goes to tens of thousands of people, and it needs a few dozen of them to arrive at the wrong minute. You weren't picked. You were on a list.

The lists are assembled in ordinary ways:

• Group membership. Join a chat about a campaign and your handle sits in a roster that can be messaged one by one. Anyone who posted gets prioritised, because posting proves attention.
• Public wallet addresses. Chains are readable. Every address that took part in a given round appears together in the same batch of transactions, and scraping that batch produces a list of confirmed, active holders more accurate than anything for sale. It is also exactly how the free token in method four arrives at your address specifically.
• Comments and search traces. Ask "why didn't I receive mine" under a post and the question itself is the signal: you have an account, you're waiting on an outcome, and you're mildly frustrated right now.
• Leaked email lists. Some unrelated site is breached, your address enters circulation, and the "exchange notification" that lands next week was sent down that list.

Put together, these give an uncomfortable but useful conclusion. You can't remove yourself from the lists; that isn't available. What you can do is make being on them consequence-free. A fixed entrance, a separate wallet for events, no reading of unsolicited messages — the reason those three work is that they leave whatever arrives with nowhere to go next.

One habit worth adopting: don't post your own wallet address publicly, not even to show someone a transaction. It's not serious protection and it's easy to work around. It just keeps you off the laziest of those lists, at essentially zero cost, which seems like a reason to do it.

Why these are getting harder to spot

Because cloning a site now costs approximately nothing. Copy the whole front end, register a lookalike domain, add a certificate — an hour or two of work.

Two consequences worth adjusting for:

• "Looks professional" is no longer a signal. Padlock icon, polished layout, live chat widget — fakes have all of them.
• Domain similarity keeps rising. One letter changed, a hyphen added, a different suffix; at a glance they're indistinguishable.

So move the judgement earlier: not "does this page look genuine" but "how did I get to this page". Arrived from inside the app, you're fine. Arrived from a link someone sent, it's worth re-checking however convincing it looks.

That's why the rule at the top is stated so absolutely: it converts a problem that needs judgement into a habit that doesn't. Habits are more reliable than judgement, particularly when you're in a hurry.

How a search result becomes the trap

Most people's default move is to search the platform's name and click the first thing. That move is itself the exposure, and it has nothing to do with whether you can spot a fake page.

Two separate mechanisms put a fake in front of you:

1. Paid placement. The top entries are advertisements, marked with a small "Ad" or "Sponsored". Buying that slot does not require proving you own the brand, so the real site and a lookalike domain can both appear there — and the lookalike is willing to bid more. The display URL on that line can be made to resemble the real domain closely.
2. Pages built for oddly specific searches. "Binance withdrawal stuck what to do" is a sentence no serious publisher writes a page for. The people running these operations do. You searched a specific problem; the page you land on offers a "contact live support" button, and behind it is method three in full.

Together they explain something worth internalising: ranking first means somebody paid or worked to occupy that position. It does not mean official. And when you search, your attention is on the problem you're trying to solve, not on the address bar.

Two things to do instead. Save the official address as a bookmark and stop searching — and when you save it, don't type the domain from memory; open it once from inside the app you already have, through its help or share function, and bookmark whatever that opens. Typing a domain from memory and clicking a search result are the same category of risk. If you must search, skip every entry carrying an "Ad" or "Sponsored" label; crude as that sounds, it excludes the most expensive class of mistake.

A suggestion: on a phone, keep only the app and no exchange bookmarks in the mobile browser at all. Mis-taps are far more likely on a phone, and one fewer entrance is one fewer way to get it wrong. There's nothing clever about it — it just reduces your own opportunities to err.

Fake clients, and "pay this first"

Two more that don't fit the four methods above but show up just as often during a launch.

The fake client

It arrives as an "official app download" page, an identically named listing in a third-party app store, or a beta invitation link. Once installed the interface matches the real one, and whatever you type is relayed live to the other end. Some versions display a plausible fake balance after "login", so that nothing seems wrong for a while.

One rule covers it, and it requires no technical knowledge: install apps only from your phone's own official store, or update from within the app you already run. Any installer sent as a link, and anything that asks you to change a system setting before it will install, is refused. "Download it straight from the official site" doesn't help here — the question was always how you know the site is official.

Pay a fee to release it

The script is that the reward is already yours and only a "processing fee", "activation fee", "deposit" or "gas payment" stands between you and it. The amount is usually small, tens of dollars, because it needs you to think it's worth a try on the off chance.

It works by placing you in a position of already owning something, where walking away registers as a loss rather than as avoiding one.

What to say when someone asks you

Someone brings you a link and asks whether it's real. The most useful reply isn't an analysis of that link.

Because analysis can be wrong, and next time they still won't be able to do it themselves. Three sentences work better:

1. "Don't click that; open the app and see whether the event is there." Not there means it doesn't exist; there means go in through the app.
2. "No event ever needs your seed phrase, private key or verification code." That one sentence blocks the worst losses.
3. "If you're not sure, wait a day." Real events don't evaporate because you were slow; fake ones depend on the countdown.

And if you find they've already clicked and already signed: get them to revoke the approval and move the remaining assets first, before asking for the details. Time matters more than information at that point.

Four habits

1. Fixed entrances. Exchange and wallet both via app or bookmark, never from search results or someone's link.
2. Separate wallets. One wallet reserved for on-chain activities, holding only what that activity needs. Your main position never touches an event page.
3. Periodic approval cleanup. Every so often, review approvals with a block explorer's tool and revoke what you no longer need. For a BNB Chain address, BscScan's approval checker lists every contract that address has granted, and for how much.
4. Slow down. Every one of these depends on you being in a hurry. Thirty extra seconds spent going back to the official entrance is the most effective item on this list.

The second one especially. It caps your downside: even if you do get caught, what's lost is whatever was in the small wallet. The overhead of maintaining an extra wallet is negligible, and what it prevents is the worst-case outcome.

If it already happened

In this order, as fast as you can:

1. Revoke the approval. Use a block explorer's approval manager to remove that contract's permission. It costs a small fee and stops the bleeding.
2. Move what's left. To a brand new address, not another one you've used, because you don't know what else is compromised.
3. If an exchange account is involved: change the password, reset two-factor, and check whether anything has been added to the withdrawal allowlist or API keys.
4. Keep evidence. Transaction hashes, screenshots, message logs.

To be direct: assets sent on-chain are, in practice, not recoverable. Everything above is damage limitation, not retrieval. Which is exactly why the four habits are worth the effort. After the fact, there is very little available.