94 million. That's the dollar value Canadians reported losing in cryptocurrency payments between Jan. 1 and Sept. 30, according to the Canadian Anti-Fraud Centre. The figure captures why practical, ordered precautions matter before anyone opens an account or sends crypto. This guide turns official advice from Canadian policing, banks and consumer advisers into eight clear steps you can follow to recognise scams, harden practices and report incidents.

1. Understand the scale and the scam patterns

94 million sets the baseline for why this matters: losses in Canada have reached tens of millions within single reporting windows, and that trend mirrors a larger global rise in crypto-related crime. Police and national agencies report the same recurring attack patterns, which makes a pattern-based defence possible.

Start by recognising the two operational categories that most guidance uses. The first group are scams that trick you into sending funds, including classic investment-style pitches promising fast, guaranteed returns, and the modern variations such as "rug pulls" where token teams drain liquidity after attracting investors. The second group are attacks that steal identity or access so attackers can drain accounts, using phishing, fake support pages or malware to harvest private keys and seed phrases.

Worked example: a new connection on a social app asks you to join a ‘private investment channel’ that promises 10x returns. That's an investment-style pitch designed to get you to send crypto, possibly into a fraudulent exchange or a token that will later be rug pulled.

2. Run four pre-account verification checks

Treat promises of high or guaranteed returns as immediate red flags. No legitimate crypto investment guarantees fast gains with no risk. A major retail bank guidance page tells Canadians to be sceptical of guarantees and to treat unsolicited offers with caution.

Second, be sceptical of unsolicited contact, whether by direct message, email, phone or a new dating-site connection. Many long cons begin as friendly outreach and build trust over weeks or months before a pitch, a pattern sometimes called pig butchering in law-enforcement descriptions.

Third, avoid intermediaries who claim they will invest for you. One national advisory explicitly notes there's no regulated "crypto-investment broker" in Canada. You should have direct access to the account used for holdings so you can track balances and withdrawals yourself.

Fourth, do independent background checks: confirm company registration, search for third-party reviews, and verify social and web identities against verified corporate channels. If a provider can't show verifiable registrations or independent audit reports, treat the offer as high risk.

Worked example: before moving a deposit to a new exchange, check whether the company registration matches the website details, find independent posts on reputable forums or news sites about the platform, and confirm the official support email through the platform’s published contact page.

3. Lock down your technical hygiene

Do not store seed phrases or private keys in email, cloud backups or screenshots. Those storage methods are routinely compromised through phishing, account takeovers and cloud breaches.

Use hardware wallets or cold storage for holdings you intend to keep long term, and keep only a small operational balance on custodial platforms when necessary. Always enable two-factor authentication on exchange and wallet accounts, and prefer an authentication app or hardware token over SMS when you can. Verify URLs and mobile apps carefully, because fraudsters create convincing clones in app stores and phishing pages that mimic legitimate login flows.

Before sending any crypto, copy the destination address twice and confirm it by an out-of-band channel when the recipient is a person or a known service. If a platform or contact pressures you to move funds quickly or asks you to verify identity via an unusual message, pause and validate using the platform’s publicly listed support channels.

Mastheads

Worked example: keep your long-term holdings in a hardware wallet whose seed phrase is written on paper and locked in a safe. Use a separate, smaller hot wallet for daily transfers. If a friend requests a transfer, send a text or call to confirm the copied address before you click send.

4. Use custody, transaction controls and monitoring that match the risk

Individuals with holdings above a comfortable personal threshold should consider cold storage or splitting assets across multiple custody methods to reduce single-point failure. For small businesses that accept or hold crypto, adopt controls that resemble standard anti-money-laundering and fraud practices: identity verification on counterparties, whitelisting of withdrawal addresses, multi-signature wallets for treasury movement, and transaction monitoring to spot unusual outbound flows.

Business operators should choose providers with documented track records and published security practices. Bank and consumer-advice pages recommend confirming that a platform has formal procedures for customer support and withdrawals, and that it publishes security audits or custodial arrangements.

Worked example: a small merchant that accepts crypto keeps operating funds on a custodial exchange with strict withdrawal whitelists and moves larger reserves into a multi-signature cold wallet that requires two executive approvals for large transfers.

5. Test suspicious investment offers before you send money

Ask for verifiable proof of identity for the person or company claiming returns, request documentation of custody arrangements for any asset the seller claims to control, and insist on a cooling-off period before any transfer. Independently verify token projects by checking code repositories, team credentials and smart-contract audits when relevant. Treat initial coin offerings and unvetted token launches as extremely high risk because the environment is prone to manipulation and rug pulls.

Where sources differ on emphasis, bank-oriented guidance stresses choosing established institutions and verifying platform track records, while technology-focused advisories place greater weight on cold-storage and technical controls for private keys. If you must prioritise, prevent irreversible transfers to unknown parties and protect seed phrases aggressively.

Worked example: an acquaintance pushes a new token sale. You ask for links to the token’s source code and audit report, check the team’s professional profiles, and refuse to send any funds for at least 72 hours so you can confirm independent validation.

6. If you are targeted or become a victim, preserve evidence and report

Preserve everything you can: screenshots of chats, email headers, transaction IDs and wallet addresses. These items create investigative leads and make cross-border cooperation more likely to succeed. Investigators emphasise preservation because tracing requires exact identifiers and timestamps.

Contact the Canadian Anti-Fraud Centre through its public reporting channels to file an incident report and to get guidance on next steps. Don't comply with anyone claiming to be from the Anti-Fraud Centre who asks for money; the agency has published alerts that it doesn't contact individuals to request funds. Also report the incident to local police and to the fraud or cybersecurity teams of any platform involved.

Ontario Provincial Police Det.-Const. John Armit, who specialises in anti-rackets work, summed the practical limits plainly: "once you send your crypto, it's virtually gone." Project Atlas, a provincial investigative initiative, coordinates responses to cryptocurrency investment fraud, and has identified victims in multiple countries and thousands of wallet addresses tied to cases. Those facts explain why rapid reporting and preserved evidence matter even where recoveries are difficult.

Worked example: after noticing unauthorised transfers, you save transaction IDs, export account statements, take screenshots of suspicious messages, and submit a report to the Canadian Anti-Fraud Centre. You then file a local police report and contact the exchange’s support team with the same documentation.

7. Build habits that limit a single slip from becoming catastrophic

Treat crypto transfers like cash: once sent they're irreversible. Introduce friction at decision points so attackers can't rely on pressure and speed. Use address whitelists where possible, keep two separate wallets for routine spending and long-term holdings, and schedule periodic reviews of recovery phrases and access credentials.

Update and patch devices used for crypto access, and separate financial activity from general web browsing and social media. Financial-advice guidance for Canadians emphasises that most successful scams use social engineering, so slowing down and introducing cooling-off steps is a practical defence.

Worked example: make a rule to wait 48 hours after any investment pitch before initiating transfers, and require a second person to validate withdrawal addresses for transfers above a set amount.

8. If you advise or solicit investments, follow consumer-protection practices

If you work in financial advice or accept investor funds, don't promise guaranteed returns and disclose any conflicts of interest. Keep records of communications and proof that clients had opportunities to verify information. Regulated advisers and financial institutions should point clients to formal complaint and dispute channels so problems can be escalated through official processes.

These steps protect clients and reduce the chance that a misunderstanding becomes a large fraud. They also make it easier for platforms, banks and law enforcement to assess and respond to claims when they arise.

Worked example: an adviser sends clients a clear disclosure that investment returns aren't guaranteed, provides links to independent verification for each proposed platform, and retains signed confirmations that clients had time to validate the offer.

Related Articles

Preserve screenshots, transaction IDs and email headers, then report suspected fraud to the Canadian Anti-Fraud Centre using its public report-fraud channel and notify local police and any affected platforms.

This article was created with AI assistance.