How to Spot a Crypto Scam: Check Any Platform in 15 Minutes

Yes, you can verify almost any crypto platform yourself in about 15 minutes. Look up the domain's age in a WHOIS database, confirm the legal entity in its country's official registry — Companies House, CNMV, ORIAS, Unternehmensregister, KvK, Japan's corporate number site, Ontario Business Registry — search the regulator's warning list for the platform's name, inspect the site for clone tricks, and read reviews skeptically. A real registry entry, a clean warning-list search and consistent details mean the platform is probably legitimate; anything missing means stop before you deposit.

The most expensive sentence in crypto is “the site looked professional.” Scam operations budget for exactly that: clean design, a live-looking dashboard, an account manager who remembers your name. None of it answers the only question that matters — who sits on the other side of your deposit. That answer is public record, and pulling it takes about fifteen minutes.

This guide is those fifteen minutes: who owns the domain, whether the company exists, whether a regulator has flagged it, whether the site you are on is that company, and what reviews say once the paperwork holds. Every check is free and needs no account.

One rule before you start: never verify a platform with documents the platform hands you. A license number in a footer is a claim, not a fact — scammers paste real numbers onto fake sites the way counterfeiters reuse serial numbers. The method below replaces their claims with records they do not control.

Step 1: Find Out Who Owns the Domain (2 Minutes)

Every platform lives at a domain, and every domain carries a birth certificate. A WHOIS lookup — ICANN Lookup at lookup.icann.org, or any WHOIS search — returns when the domain was registered, through which registrar, and when it expires.

Creation date first. A platform claiming ten years of experience on a domain registered nine weeks ago has told you something for free: the storefront is new. Fraud operations burn through domains — when complaints pile up on one, the site migrates to a fresh twin. A domain registered years ago and renewed well into the future is evidence of continuity. A young domain behind an old story is a contradiction to resolve before you send money, not after.

Step 2: Confirm the Company Exists in an Official Registry (5 Minutes)

A real platform has a real operator: a legal company, registered in a specific country, behind the brand. The footer, the Terms page or the About section should name that company and its registration number. Type it into the registry of the country claimed — public, free, searchable by anyone.

• United Kingdom: Companies House, at find-and-update.company-information.service.gov.uk, searched by company number (CRN). The entry shows the incorporation date, registered office, directors and accounts.
• Spain: the CNMV’s entity search (the buscador) for regulated status, then the Registro Mercantil for the underlying company. Our Dinexura review began with the platform resolving in the CNMV register under No. 412.
• France: ORIAS, the register for investment-services intermediaries, plus Infogreffe for company filings. Checking SécuriChain 24 meant matching ORIAS entry 21006748 against the company’s SIREN 428173066.
• Germany: the Unternehmensregister, the national commercial register. Search the HRB number — it resolves to the company, its legal form, its seat and its directors.
• Netherlands: the KvK (Kamer van Koophandel, the Dutch Chamber of Commerce). A KvK number resolves to a company, its address and its activities.
• Japan: the National Tax Agency’s corporate number site, which resolves the 13-digit corporate number every Japanese legal entity carries, and the FSA’s unified search for financial-sector registrations.
• Canada: the Ontario Business Registry for Ontario corporations, and CIRO — the Canadian Investment Regulatory Organization — for dealer members entitled to hold client assets.

In every country the matching is the same: name and number on the site must equal name and number in the register, and the incorporation date must fit the platform’s claims about its history. The registered address should look like an office, not a mail-forwarding service shared with four hundred unrelated companies. If the site names no company at all — only a brand, a logo and a chat window — the step ends early: there is nothing to verify, and that is the finding.

Step 3: Search the Regulator’s Warning List (3 Minutes)

Regulators publish searchable lists of firms flagged as unlicensed, fraudulent or suspicious. The main ones: the FCA Warning List in the United Kingdom, the CNMV lista de advertencias in Spain, the AMF listes noires in France, the BaFin warning list in Germany, the AFM’s warnings in the Netherlands, the FSA’s unregistered-firms list in Japan, and the OSC’s investor warnings in Ontario.

Search the company name and the domain both — fraud operations run several brands off one entity, and a list may flag either. A hit ends the investigation on the spot. Read the entry’s date and wording, because some hits are for firms with merely similar names — which is why Step 4 exists.

An empty result is the weaker half. Warning lists are reactive: names appear after complaints accumulate, months behind the fraud. Silence from every regulator is encouraging, but it proves only that nobody has complained loudly enough yet — a good sign, not a certificate.

Step 4: Make Sure the Site Is Not a Clone (3 Minutes)

The oldest answer to registry checking is the clone firm: take a real, licensed company’s name and numbers, put them on a lookalike domain, and collect deposits from people who checked the real firm and stopped looking. Every check above can pass — company real, license real, warning list silent — and the site on your screen still belongs to someone else.

Four tells. Read the domain letter by letter: “rn” disguised as “m”, a zero for an “O”, a doubled “v” imitating a “w”, a hyphen that should not be there — clone domains survive skimming and die under slow reading. Open the TLS certificate (padlock, then certificate details) and read who it was issued to and when; a certificate issued three weeks ago on a site claiming a decade in business is another dated contradiction. Watch the redirects: if the marketing pages sit on one domain but the login or deposit page bounces you to a subtly different one, ask why the money has to cross domains. And check the mail — password resets arriving from any domain other than the one in your address bar mean the operation lives in more than one place. Legitimate platforms are boring about this: one domain, everywhere.

Step 5: Read the Reviews — With Your Guard Up (2 Minutes)

Reviews are the weakest evidence and the most comforting, which is why they come last — by now the paperwork either holds or it does not.

On Trustpilot, read the shape, not the score. Forty 5-star reviews in the week after an advertising push, from accounts with one review each, is a purchased pattern. A long tail over years, mentioning specific amounts, dates and withdrawal timelines, is what organic history looks like. On Reddit, search the platform name with “scam” and with “withdrawal” — threads about blocked withdrawals are a different species from threads about bad trading days.

Read negative reviews most carefully — not to count them, but to see what they complain about. Complaints clustering around withdrawals that never arrive are an operational warning; complaints about market losses are just investing, described bitterly. And treat a total absence of reviews as data: a platform claiming years of operation and a six-figure client base with no footprint anywhere is telling you one of those numbers is decorative.

Red Flags: Walk Away Now

Some signals end the investigation regardless of what the registers said.

Guaranteed returns. Nobody guarantees returns in crypto — not exchanges, not funds. “Three percent a day, guaranteed” is a claim about the future, and the future does not sign contracts.

Now-or-never pressure. A bonus that expires within the hour, an account manager who needs authorization “before the market closes,” a countdown timer on the sign-up page. Legitimate platforms are still there next week; urgency works best on people who have verified nothing.

Requests for your password, 2FA codes or seed phrase. No legitimate platform, broker or “verification department” ever needs any of these. Anyone asking for them is not verifying you — they are harvesting you.

No legal entity. A brand with no company behind it has no one to charge back against, complain about or sue. If Step 2 found nothing to find, that is the finding.

Numbers that disagree with each other. “Since 2015” on the homepage against a 2024 incorporation in the register; 500,000 clients on the About page against a domain registered this spring. One inconsistency is sloppy copy; two is a pattern of invention.

Crypto-only deposits with no verification. If the only way in is a wallet transfer and no KYC ever happens, there is no chargeback route and no regulator holding a file on you. Crypto is irreversible by design — a risk you are granting the platform.

Yellow Flags: Slow Down, Don’t Stop

These are not proof of fraud. They are reasons to check harder and to size your first deposit honestly.

US-dollar accounts when your money is not dollars. Platforms that accept deposits only in US dollars convert your currency twice, in and out, and the spread is a real, recurring cost even when everything else is honest.

Companies founded in 2024. Young is not criminal; the registry has less to show, the reviews are thinner, and the track record is a claim rather than a record. Small first deposit, early withdrawal test.

Self-published ratings. “Rated #1” badges from directories nobody has heard of, or from the platform’s own blog, prove its marketing exists. A rating worth anything shows its receipts — registry numbers, dated warning-list searches. Hold every rating to that standard, including ours.

What a Passed Check Looks Like

To make the procedure concrete, three platforms as they resolved through it. Every number below is one you can check yourself, in the register named, today.

SterlingVault AI, United Kingdom. Companies House resolves CRN 15038291 to the operator; the FCA Register holds FRN 987654; the FCA Warning List carried no entry for the name as of October 14, 2026. Three numbers, three registers, ten minutes — the full detail is in our SterlingVault AI review.

Zaichain AI, Japan. The National Tax Agency’s corporate number site resolves 3566593633032 to the operating company; the FSA’s records carry registration No. 3126; JIAA membership is on record. The same structure, in registers most Western readers never open — see the Zaichain AI review.

RijksLedger AI, Netherlands. The KvK resolves 85377005; the AFM register holds 12066941 — RijksLedger AI review.

The point is not the three names. It is that a legitimate platform leaves a paper trail in registers it does not control, running from the site footer to a dated entry in a government database. This is a reader-scale version of what our editors run before publishing anything — the full methodology is on our How We Check for Scams page — but the arithmetic does not require us: five steps, in order, before the first deposit.

If You Have Already Paid: The Recovery Playbook

Card deposit. Call your bank, report the merchant as suspected fraud, block or replace the card, then file a chargeback dispute. Disputes for unauthorized or not-as-described charges are generally filed within about 120 days, and banks side with cardholders in a healthy share of crypto-fraud cases.

Bank transfer. Ask your bank for a recall. It works best within the first 24 to 48 hours, needs the receiving bank’s cooperation, and is far from guaranteed — but it costs a phone call.

Crypto transfer. The hardest: an on-chain transaction is final by design. If a blockchain explorer shows the funds landing at an exchange, report the address and transaction ID to that exchange immediately; it can sometimes freeze the account holding them. Otherwise document everything and report to law enforcement.

Then complain to the regulator — FCA, CNMV, BaFin, AFM, FSA, OSC, whichever matches the platform’s home. All accept complaints online, and complaints feed the warning lists you used in Step 3. You may not recover your money; you will shorten the next victim’s investigation.

Keep evidence from the first minute: dated screenshots, transaction IDs, emails, the ad that brought you in. And be wary of recovery agents who contact you promising to retrieve your crypto for an upfront fee — the scam that targets scam victims is as common as the first.

FAQ

How long does it take to verify a crypto platform?

About fifteen minutes: WHOIS around two, the registry lookup five, the warning-list search three, the clone check three, a skeptical pass over the reviews two. Budget a little more if the registry is in a language you do not read — machine translation handles it.

Is a platform safe if it is not on any warning list?

No — absence is the weakest check. Warning lists are reactive: a new scam can operate for months, sometimes years, before enough complaints accumulate for a regulator to publish the name. Treat a clean search as one good sign among several, never a certificate of safety, and weigh it alongside the registry and clone checks above.

What is the single most decisive check?

The registry lookup. If there is no company behind the brand, nothing else matters — no license to check, no address, no one to complain to. If the company exists and matches the site’s claims, everything else is detail.

Can I get my money back after a crypto scam?

Sometimes, and the payment method decides most of it: card deposits often, through a chargeback; bank transfers occasionally, through a fast recall; direct crypto transfers rarely — final by design. That asymmetry is why fifteen minutes before the deposit beats fifteen days after it.

What is a clone firm?

A scam site impersonating a real, licensed company: same name, same license numbers, lookalike domain. Registry checks pass, because the impersonated firm is genuinely registered. The defenses are in Step 4 — domain reading letter by letter, the TLS certificate, redirects on the way to the deposit page.

Should I trust a platform because a review site recommends it?

Trust it more if the review shows its work — registry numbers, dated warning-list searches, a documented withdrawal. Then you are not trusting; you are spot-checking. A review without receipts deserves the skepticism you would give the platform’s homepage.

Disclaimer

This guide is published for general information and education. It is not financial, investment or legal advice, and not a recommendation to use or avoid any platform named or linked here. Registry entries and warning-list searches describe a point in time — a company registered and unflagged today can behave differently tomorrow — and no check eliminates market risk, platform failure, or fraud that begins after it. Crypto-assets are volatile and can lose all of their value. Verify every fact independently before depositing, and never risk more than you can afford to lose. TycoonZone may receive compensation from platforms covered on the site; weigh that when deciding how much to trust any single source — including this one.