Airdrop Scams Start With a Message You Believe

An airdrop scam offers you free tokens and takes your wallet instead. The theft takes one click. Everything that makes that click happen occurs earlier, while you are deciding whether a message is real.

Updated 16 October 2026: every FBI and FTC figure and quote was checked against its original source on the day and is now linked, two quotes that could not be found at the source were replaced, the channel and tracker examples were checked again, and common questions are answered at the end.

Most warnings about this cover the click. Far fewer cover the hour before it. That hour is where the decision actually gets made, and it is the cheapest place to stop.

What an airdrop is when it is genuine

An airdrop is when a project sends free tokens straight to people’s wallets. A wallet is the app that holds your coins and signs for them. Projects do this to reward early users, or to advertise themselves to new ones.

Real ones exist, and that is the whole problem. The word carries an honest meaning, so it does not sound like a warning when somebody dishonest uses it.

The FBI made this point directly in a 3 June 2025 notice about airdrop fraud on Hedera, a cryptocurrency network. It said the airdrop feature was “originally created by the Hedera Hashgraph network for marketing purposes”, and criminals then exploited it. The tool is ordinary. What gets done with it is not.

The click is the last step, not the scam

Here is the ending first, so the rest of this can be about the part that matters.

You arrive at a page offering tokens. To claim them, it asks you to connect your wallet, or to type in your recovery words. Recovery words are the short list of words that restores a wallet, and anyone holding them owns everything inside it.

The FBI notice describes this step precisely. The connection “often requires the user to input their login and security information, including seed phrases”. After that the wallet gets emptied.

Read it as a sequence rather than as a single event. By the time you are looking at that page, you have already made three or four smaller decisions. Every one of them was easier to get right than the one that followed it.

Where the money actually goes

This is not really a crypto problem, and the public numbers say so plainly.

The US Federal Trade Commission publishes what people report losing, sorted by how the scam reached them. Its April 2026 summary found that in 2025, nearly 30% of people who reported losing money to a scam said it started on social media. Reported losses along that route reached $2.1 billion.

That was roughly eight times the 2020 figure. The agency carries two caveats of its own worth repeating: reports were not collected during the 2025 government shutdown, and most scams are never reported to anybody at all. So this is a floor rather than a total.

The crypto-specific picture matches. The FBI’s 2025 Internet Crime Report puts cryptocurrency investment fraud at the top of American losses for the year, at $7.2 billion reported. It describes the approach in one sentence: scammers “typically initiate contact through text messages, social media sites, advertisements, or dating applications and then quickly move the conversation to a messaging platform”. Contact in public, then a private room.

That last move matters more than it looks. A public reply can be seen, doubted and reported by other people who are watching. A private message has no witnesses at all.

None of that means these platforms are bad. It means reaching millions of people costs a scammer close to nothing. The same FTC summary states it plainly: “At very little cost, scammers can reach billions of people from anywhere in the world.”

So the skilled, expensive part of the attack is not technical at all. It is persuasion, and it happens in public where anyone can watch it.

The four moves that do the real work

Nearly every fake airdrop is built from some mix of four things. None of them need any technical ability.

The lookalike address. A web address one character away from the real one. A swapped letter, an extra word, a different ending. Skimmed left to right it reads correctly, and reading it slowly is the entire defence.

The reply underneath the real post. A genuine account posts something. Within seconds, accounts wearing its name and picture reply beneath it with a claim link. The reply borrows the credibility of the post it is attached to, which was the point of attaching it there.

The handle that is almost the handle. An added underscore, a doubled letter, a capital I standing in for a lowercase L. Side by side you would catch it every time. You are almost never shown them side by side.

The clock. A closing window, a countdown, a limited allocation. The FTC’s guidance on prize scams names the pressure as part of the method: “Scammers pressure you to act now to get a prize, or to hurry up and pay or give them information.” Its advice is short: “Don’t be rushed.”

The $CATE community has its own example. Sites have appeared offering a “$POORGOAT airdrop” with an allocation supposedly waiting to be claimed. This site first documented one on 9 August 2026, and it was still online when last checked on 16 August 2026. There is no evidence that any of them are connected to PoorGoat, and they carry the familiar signs. They are described here and deliberately not linked.

Why “the official account linked it” proves less than it sounds

This is the part most guides skip, and it is the one worth keeping.

A link from an official source is a claim about one moment in time. Accounts get suspended. Profile fields go stale. Descriptions carry on pointing at things that were replaced weeks ago.

A real example sits close to this site’s subject. The official $CATE Telegram channel’s description spent part of August 2026 still advertising a website and an X account that had both been replaced. Nobody was being deceptive. A field was filled in once and not revisited. By 16 August 2026 it carried the current pair, and it still did when checked again on 16 October 2026.

There is a stranger version of this. Two large coin trackers publish different official links for this same coin. On 16 October 2026, DexScreener listed the project’s website and channels, while GeckoTerminal listed an Instagram story and a single post by the account that first created the coin. Both are being honest, because they read from different places. The community takeover explainer shows where each one gets its links.

The FTC’s own breakdown shows how much of this happens on screens somebody else runs. In 2025, a website or app and social media together started almost six in ten of the loss reports it could sort by how the scam first made contact.

Nothing about that stale field was an attack, and that is exactly why it is worth showing. If an ordinary forgotten setting can point you somewhere wrong, an attacker does not need to break anything to achieve the same result.

The project’s official education site, CATE Academy, states its own position in two lines: “We will never DM you.” “We will never ask you to connect a wallet.” An unexpected message is the tell, whatever name is sitting on top of it.

What actually protects you

The defence is unglamorous, and it involves inspecting nothing technical whatsoever.

Go to the address you already have, rather than the one in the message. The FTC’s guidance on phishing puts it in a sentence: contact the company “using a phone number or website you know is real”, not “the information in the email”. That one habit defeats all four moves above at once, because every one of them depends on you following a link somebody handed you.

Then treat unexpected offers as attacks by default. The FBI’s advice has the same shape. If you did not sign up for a rewards programme and an offer of free tokens turns up, it says to “verify the offer is from the cryptocurrency provider before accepting and/or providing any information”.

Nothing is lost by checking. A real airdrop is still there in ten minutes, and a real project will not mind you arriving through your own bookmark. The only offer that cannot survive a short pause is the one that was never real.

Slow down when a message tells you not to. Urgency is a claim like any other, and it is the one claim in a scam that is reliably false.

One last warning, because it catches people twice. The same FBI notice advises being “cautious of individuals or companies claiming they can assist in recovering funds lost in scams, as this may be an additional scam”. People who have been drained get targeted again by the offer to undo it.

The click is the cheapest part of this to defend against, because by then there is nothing left to decide. Everything expensive happens earlier, in ordinary moments that never feel like security decisions while they are happening.

If you want the machinery underneath the click, it is next door. How wallets actually get drained covers what you approve when you sign, and how to check what you have already approved. What a seed phrase is explains why those words are the entire account. What a rug pull is covers the losses that come from inside a project rather than from outside it.

Free is the oldest hook there is. Ignoring one has never cost anybody anything.

Common questions about airdrop scams