# The scams, and how each one actually works > Knowing that scams exist doesn’t protect you. Knowing the mechanism does. This walks through the main ways people lose NFTs and money — what the attacker is actually doing at each step, and the specific signal that gives it away before you sign anything. Source: https://thenftacademy.com/learn/nft-scams-and-red-flags Last updated: 2026-09-11 Site: The NFT Academy (https://thenftacademy.com) --- Being told "watch out for scams" is useless advice. Everyone knows scams exist, and people are still caught, because the warning doesn’t tell you what the attack actually looks like in the ten seconds before it succeeds. So this page is mechanical. For each attack: what the attacker is doing, why it works, and the one signal that gives it away. The common thread is worth stating at the top. **Almost none of these involve breaking anything.** The blockchain isn’t compromised, the wallet software isn’t broken, no password is cracked. In nearly every case, the victim authorises the loss. The attack is on judgement under time pressure, not on cryptography. ### 1. What is signature phishing? **The most common attack by a wide margin.** **How it works.** You reach a page — via a Discord message, a reply on social media, a sponsored search result, a fake airdrop notification. It looks like a marketplace, a mint page, or a wallet-verification step. It asks you to connect your wallet, then to sign something described as routine: "verify ownership", "connect", "claim". The signature isn’t routine. Depending on the variant, it grants `setApprovalForAll` over your collection, or it authorises an off-chain order that transfers a token to the attacker. Because you signed it, the transfer is entirely valid. Nothing was broken. **Why it works.** Signature requests are frequent and mostly harmless, so people stop reading them. The malicious one arrives inside a normal-looking flow at a moment when you’re focused on the thing you came to do. **The signal.** *A permission request wider than the action you’re performing.* You’re claiming a free item; why does it need approval over your entire collection? You’re connecting a wallet; why is there a signature at all? Legitimate actions request the narrowest permission that accomplishes them. **Defence.** Read every signature request. Reach sites by typing the URL. Keep valuable assets in a wallet that connects to nothing. ### 2. How do counterfeit collections work? **How it works.** Anyone can deploy a contract and copy a real collection’s name, artwork and description. The listing looks identical, because the images are the originals. It appears in search results. It’s priced attractively below the real floor. You buy it. You own a real token from a worthless contract. **Why it works.** Everything a buyer normally uses to judge, visuals, name, description, is trivially copyable. The one thing that isn’t copyable is the part nobody checks. **The signal.** *A price meaningfully below the collection’s usual range.* Genuine items do not sit far below floor in a liquid collection; someone would have taken them. A bargain here is the most reliable counterfeit indicator there’s. **Defence.** Check the contract address against the project’s own site or verified account. Not the marketplace’s badge — the contract address. Then check trading history and holder count: a real collection has both, a counterfeit has neither. ### 3. How do fake mint pages work? **How it works.** A project announces a mint. Attackers register similar domains and push them through paid search, compromised Discord accounts and reply spam — often minutes before the real mint, when everyone is watching for a link. The page is a copy of the real one. Connecting and minting sends funds to the attacker, and often requests approvals on the way. **Why it works.** Mints are time-pressured by design. Scarcity and countdowns exist precisely to make people move fast, and moving fast is when verification gets skipped. **The signal.** *Any urgency you didn’t create yourself.* "Only 50 left", "closes in three minutes", "you’ve been selected". Urgency is the attack surface. **Defence.** Get the mint URL from the project’s own site, in advance, and bookmark it. Never from a link in a message, however plausible the source. Compromised Discord admin accounts posting real-looking announcements is routine. ### 4. What is a rug pull? **How it works.** A project builds anticipation with a roadmap, mints, collects the proceeds, and then stops. Development ceases, socials go quiet, the team is unreachable. In the harder variants the contract itself contains a function letting the deployer drain funds or mint unlimited supply. **Why it works.** It’s indistinguishable from a legitimate project *before* the mint. Both have a Discord, a roadmap, and confident promises. The difference only becomes visible after the money has moved. **The signal.** *Anonymity plus heavy promises plus no verifiable track record.* Any one alone isn’t damning — plenty of legitimate builders are pseudonymous. All three together is the pattern. **Defence.** Look for a shipped history rather than a promised future. Has this team completed anything? Is the contract verified and readable? Is there a genuine product, or only a roadmap? And treat "utility coming soon" as what it’s: a promise with no enforcement mechanism. ### 5. What is wash trading? **How it works.** Someone trades an asset between wallets they control, generating volume and sale prices that aren’t real. The collection appears active and appreciating. Retail buyers arrive, buy at inflated prices from the operator, and hold something with no genuine market. **Why it works.** Volume and recent sale prices are exactly what most people use to judge whether a collection is alive. **The signal.** *Volume concentrated among few addresses, with prices that move in a suspiciously clean line.* Real markets are messy; manufactured ones often aren’t. **Defence.** Look at distinct holder count rather than volume. Check whether sales involve many different addresses. Be sceptical of any collection whose entire history is a few weeks old. ### 6. Why are NFT recovery services always a scam? **How it works.** You post about a problem. Within minutes, several accounts offer help. They direct you to a "support portal" that asks you to connect your wallet or enter your recovery phrase to "restore" it. The recovery variant is worse: it targets people who have *already* been robbed, offering to retrieve stolen assets for a fee. The assets aren’t retrievable. The fee is the point. **Why it works.** It arrives at a moment of stress and confusion, when someone needs help and is grateful to be offered it. **The signal.** *Unsolicited help.* Legitimate support doesn’t appear in your mentions within sixty seconds of a problem. And nobody can recover stolen assets — the ability to reverse a transaction doesn’t exist. **Defence.** Only ever contact support through the official site. Never enter a recovery phrase anywhere. Accept that stolen assets are gone; the alternative is losing more. ### 7. Why should you never touch an airdropped token? **How it works.** An unknown NFT appears in your wallet. Anyone can send you a token. Curiosity leads you to look it up; the linked site asks you to connect and sign to "claim" or "sell" it. The signature is the attack. **Why it works.** It exploits the reasonable instinct that something in your wallet is yours to investigate. **The signal.** *You didn’t ask for it and don’t recognise it.* **Defence.** Don’t interact with unsolicited tokens at all. Hide them. Don’t visit any site they reference. Holding one is harmless; interacting with it is the only risk. ### What habits prevent nearly all NFT scams? 1. **Type URLs, never click links.** Bookmark the sites you use. This alone defeats most phishing. 2. **Read every signature.** If the permission is wider than the action, stop. 3. **Separate your wallets.** The wallet that browses shouldn’t hold anything valuable. 4. **Be suspicious of urgency.** Every scam above uses time pressure. A legitimate opportunity survives you taking ten minutes to check. ### What is the single most important rule? **No legitimate service will ever ask for your recovery phrase.** Not to validate it, not to sync a wallet, not to claim anything, not to fix anything. There’s no exception. Every request is theft, without qualification. If you remember nothing else from this site, remember that sentence. Next: [storing NFTs safely](/learn/how-to-store-nfts-safely) covers the wallet setup that makes most of these attacks structurally unable to reach anything worth taking. ## Frequently asked questions ### What is the most common NFT scam? Signature phishing. The victim is brought to a convincing page and asked to sign what looks like a routine connection or verification. The signature actually authorises a transfer or grants blanket permission over their collection. No password is stolen and no wallet is broken into — the owner authorises it. ### Can someone steal an NFT just by having my wallet address? No. An address is public information, like an email address. Assets can only move with a signature from the private key. What an address does allow is targeting — an attacker who can see a valuable holding knows whom to send a convincing phishing message to. ### Is a verified badge on a marketplace enough? No. Verification helps but has been obtained fraudulently, and badge styling is easy to fake on a counterfeit site. The only definitive check is the contract address against the project’s own published source. ### What is a rug pull? A project that raises money on promises and then abandons them — team disappears, socials go quiet, promised development never happens. It isn’t usually a technical exploit; it’s a mint that was always going to end this way. The tell is almost always heavy promises with anonymity and no verifiable track record. ### I sent an NFT to the wrong address. Can I get it back? Almost certainly not. Transactions are final and there’s no authority that can reverse one. If the address belongs to someone reachable you can ask, and that’s the extent of it. This is why sending a small test transaction first is worth the extra minute.