The Two-Minute Check Before You Send Anyone Anything

After eighteen months of writing up cases, the same five questions would have stopped almost every one of them. They take about two minutes and require no expertise.

1. Did they contact me first?

If an unsolicited message started this, the probability of fraud is overwhelming.

Real exchanges do not send direct messages to customers. Real wallet developers do not reply to public questions from unverified accounts. Real investment opportunities do not arrive by message from someone you met three weeks ago.

This question alone eliminates fake support, most token promotions, and the entire category of relationship scams.

2. Is there a deadline?

Urgency exists to prevent checking. That is its only function in this context.

A genuine opportunity survives you taking a day to look into it. A genuine technical problem does not become unfixable in the next hour. An exchange does not close your account because you did not respond to a message within twenty minutes.

If a deadline is present, the correct response is to let it pass and see what happens. Nothing will.

3. Am I being asked for a recovery phrase, a private key, or a fee to release my own money?

Any of these three ends the conversation.

The phrase and key are absolute: no legitimate party ever needs them, in any situation, for any reason.

The fee is almost as reliable. Legitimate platforms deduct fees from withdrawals. They do not require an inbound payment before releasing funds. Tax is owed to a government, never to a platform, and never as a precondition for accessing your own balance.

4. Did I navigate here myself?

Links go where the sender chose, and displayed text has no relationship to the destination.

Type the address. Use a bookmark you created. If you arrived at a page through a message, a search advertisement or a QR code, treat it as hostile until you have verified the domain character by character.

Lookalike domains are the single most common delivery mechanism, and they are convincing because the page itself is usually a faithful copy.

5. Can I explain where the return comes from?

For anything promising a yield, this is the test.

A mechanism is an answer: fees paid by borrowers, protocol issuance to validators, market-making spread. Each can be verified.

An adjective is not an answer. “Arbitrage”, “our proprietary strategy”, “AI-driven trading” and “market neutral” describe nothing checkable.

If you cannot state where the money comes from in one sentence that another person could verify, you do not know what you are buying.

The sixth question, for larger amounts

Is this platform in a regulatory register?

Every major jurisdiction publishes a searchable list of authorised firms. It takes thirty seconds. A platform claiming to operate from a country where it does not appear in the register is either unlicensed or does not exist.

For anything beyond a trivial amount, restricting yourself to venues that appear in a register, such as platforms with a real complaints process, removes an entire class of risk at no cost to you.

Why a checklist rather than judgement

Because judgement fails under exactly the conditions these attacks create. They are designed by people who do this professionally, against a target who is anxious, hurried, or emotionally invested.

A checklist does not care how convincing the conversation was. It asks five questions and produces the same answer whether you are calm or not.

Print it. Keep it where you transact. The two minutes are the cheapest insurance available in this entire sector.