Airdrop scams succeed by combining a plausible reward with a rushed decision. The victim may see an unsolicited token, a promoted search result, a reply beneath an official post, or a direct message claiming that a claim window is closing. The page looks familiar, the wallet connects normally, and the transaction is presented as a verification step. The defense is a repeatable checklist that tests identity, domain, transaction intent, and exposure before any signature is approved.
Red flag one: the reward arrives before the explanation
Public addresses can receive tokens and NFTs from anyone. A scammer can send an asset whose name says “visit this site to claim,” making the wallet itself look like an official communication channel. It is not. Token names, images, and metadata are user-controlled content. Hide unsolicited assets and research the project independently. Do not click the embedded URL, scan its QR code, or search the exact promotional phrase without checking the results carefully.
A legitimate distribution should have a primary announcement that explains eligibility, dates, network, asset contract, and claim method. If the only evidence is the item in your wallet, a screenshot in a group chat, or an influencer’s referral link, assume the claim is unverified. The burden is on the campaign to establish authenticity; the wallet holder does not need to prove innocence by connecting.
Red flag two: a look-alike domain
Attackers register domains that swap letters, add hyphens, use a different top-level domain, or replace characters with similar Unicode symbols. They may clone the legitimate site and purchase ads so the fake page appears above the real one. Search engines and social platforms are discovery tools, not authenticity guarantees.
Build a trusted route before a claim launches. Bookmark the project’s official homepage and documentation. On claim day, navigate from that bookmark to the announcement and then to the claim interface. Compare the full hostname and certificate information. A padlock only means the connection is encrypted; it does not mean the operator is legitimate. Avoid links in replies, sponsored posts, direct messages, and calendar invitations.
Red flag three: the site asks for a secret
No airdrop claim requires a recovery phrase, private key, wallet backup file, exchange password, two-factor code, or remote-control session. Those items grant account access; they are not identity-verification data. A prompt that asks users to “synchronize,” “restore,” “rectify,” or “validate” a wallet by entering its phrase is credential theft.
Close the page without entering anything. If a secret was entered, treat the wallet as compromised even if no funds have moved yet. Create a new wallet on a trusted device, move assets when safe, and rotate related credentials. Do not reuse the exposed phrase. Be skeptical of anyone who contacts you afterward offering recovery services for an upfront payment.
Red flag four: the transaction does not match the button
A button labeled “Claim” can trigger a token approval, NFT operator permission, permit signature, asset transfer, or contract call that moves funds. The label is web content; the wallet request is the actual authorization. Read the simulation and decoded transaction. Identify every asset that can leave the wallet, every spender, and every approval limit.
Unlimited approvals deserve special attention. They may be common in established applications, but they are unnecessary for many one-time claims. Reject a claim that asks to approve unrelated tokens or collections. On networks where signatures can authorize later transfers, inspect typed data and permit messages as carefully as an onchain transaction. When the wallet cannot decode the request, do not guess.
Red flag five: urgency plus secrecy
Scammers create artificial scarcity: “five minutes left,” “claim before the public,” or “do not share this private link.” Real campaigns can have deadlines, but their terms should be publicly verifiable. Urgency is especially dangerous when paired with a request to disable security tools, switch off transaction simulation, or move the conversation into a private chat.
Pause and verify. A missed reward is a limited loss; a drained wallet can affect every asset and identity connected to it. Legitimate project teams benefit from users reading instructions and reporting suspicious copies. They do not need participants to hide the process from other community members.
Red flag six: impersonated support
Support impersonators often reply within seconds after a user posts about a failed transaction. The account may copy the project’s name, avatar, and biography. It may direct the user to a “ticket” site or ask for a signature to inspect the wallet. Official support should be reachable from the project’s own domain and should never need a seed phrase.
Do not trust follower count or account age alone. Compromised established accounts are used in crypto scams. Check the exact handle, verification context, links from the official site, and prior announcement history. When in doubt, stop communicating and open a new support session through a bookmarked route.
Limit the blast radius before connecting
- Use a dedicated wallet with only the assets needed for the task.
- Move long-term holdings and valuable NFTs to a separate wallet.
- Use a clean browser profile with minimal extensions.
- Verify the network, contract, and domain before every signature.
- Set finite approval limits and revoke permissions after use.
- Keep device, wallet, browser, and hardware-wallet firmware updated.
Wallet separation is not permission to take reckless risks. It is a containment measure. A malicious site can still steal the assets in the experimental wallet and may collect data that links accounts. Use the site’s complete wallet-safety workflow to combine isolation with verification and recordkeeping.
What to do after a suspicious signature
Disconnecting the site only ends the browser session. It does not cancel approvals or transfers already authorized onchain. Open the transaction in a trusted block explorer and identify what changed. Revoke approvals from a known interface, move unaffected assets to a fresh wallet, and monitor the compromised address. Change passwords and two-factor settings for connected email, exchange, and social accounts.
Preserve evidence before clearing browser data: the URL, transaction hash, screenshots, wallet messages, account handles, timestamps, and any funds sent. Report the domain to the wallet provider, hosting company, search platform, and relevant authorities. Do not post private account details publicly. Recovery scammers watch incident reports and may claim they can reverse transactions or hack the thief; that is usually a second fraud attempt.
The 60-second pre-sign checklist
Ask: Did I reach this page from an official, previously verified domain? Is the campaign documented outside the claim page? Does the wallet request match the stated action? Are the network and contracts correct? Is any unrelated asset approved or transferred? Am I being asked for a secret, payment, or remote access? What is the maximum amount this wallet can lose? Can I stop and verify without missing something essential?
If one answer is unclear, reject the request. Good security is not a feeling that the page looks professional. It is evidence that the issuer, domain, contract, and transaction agree with one another. A checklist creates enough friction to interrupt the emotional sequence that a drainer site is designed to exploit.
Conclusion
Fake airdrops are effective because they imitate normal web3 actions. The wallet opens, the transaction appears, and the user is told that speed matters. Your defense is to make normal behavior more deliberate: enter through trusted routes, treat unsolicited assets as hostile content, read every authorization, isolate experimental funds, and respond methodically to suspicious activity. No reward is worth surrendering a seed phrase or signing a transaction you cannot explain.
