{
  "title": "Crypto fake deposit, approval, and USDT scam pattern database",
  "description": "Structured patterns for fake deposit, token approval, permission trap, address poisoning, and fake record scams: what the victim sees, the on chain reality, and whether recovery is realistic. Maintained alongside the human readable database page.",
  "publisher": "CoinVast Research",
  "canonicalPage": "https://coinvast.io/articles/fake-deposit-and-approval-scams",
  "dataUrl": "https://coinvast.io/data/scam-patterns.json",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "CoinVast Research — https://coinvast.io/articles/fake-deposit-and-approval-scams",
  "contact": "info@coinvast.io",
  "lastFullCheck": "2026-07-17",
  "updatePolicy": "Updated when a new pattern appears or an existing one changes shape. Every entry is written for recognition and prevention.",
  "methodologyNote": "Descriptions draw on wallet vendor security documentation, chain analysis reporting, public incident coverage read July 2026, and CoinVast's own order records for the fake deposit case. Loss figures are as reported at the time and can be revised. Counterparty addresses are not republished.",
  "patterns": [
    {
      "id": 1,
      "name": "Fake token or flash USDT",
      "victimSees": "A large USDT balance appears in the wallet",
      "onChainReality": "A worthless lookalike token at a different contract with no liquidity, or a genuine but unconfirmed low fee transaction that is later reversed",
      "theActualTheft": "An activation fee, tax, or gas top up you are told to pay to unlock the balance",
      "recognitionTell": "Check the token contract against the official one and confirm real liquidity on a known venue; a balance priced nowhere is bait",
      "recoverable": "The displayed balance was never real; any fee paid is gone"
    },
    {
      "id": 2,
      "name": "Permission trap",
      "victimSees": "Real USDT sitting in a wallet whose keys you were given",
      "onChainReality": "The wallet's send permission was assigned to the scammer, so it can receive but never send",
      "theActualTheft": "The TRX or ETH gas you deposit to try to move the funds, which is then swept",
      "recognitionTell": "Never deposit gas into a wallet someone else gave you access to",
      "recoverable": "Gas you deposit is usually lost"
    },
    {
      "id": 3,
      "name": "Address poisoning",
      "victimSees": "A prior transaction to a familiar looking address in the history",
      "onChainReality": "A dust or zero value transfer planted a lookalike address, matching leading and trailing characters, for you to copy by mistake",
      "theActualTheft": "The full amount you send to the lookalike address",
      "recognitionTell": "Verify the entire address every time, and send a small test amount first for large transfers",
      "recoverable": "Funds are gone once the transaction confirms",
      "notableLosses": [
        { "date": "2025-12", "amount": "49,999,950 USDT", "note": "Trader copied a poisoned address from history; reported near 50 million dollars" },
        { "date": "2026-01", "amount": "about 500,000 USDT", "note": "Ethereum address poisoning, among the first reported of 2026" }
      ]
    },
    {
      "id": 4,
      "name": "Token approval phishing",
      "victimSees": "Tokens leaving the wallet with no send action by the owner",
      "onChainReality": "A signature the owner gave granted a contract permission to move a token, sometimes for an unlimited amount",
      "theActualTheft": "The approved token, taken by the attacker at will without needing the seed phrase",
      "recognitionTell": "An approval is not a login; read what a signature requests, avoid unlimited allowances, and revoke suspicious approvals through an approval checker",
      "recoverable": "Only what has not yet been taken, and only after revoking"
    },
    {
      "id": 5,
      "name": "Fake or reversible deposit to a service",
      "victimSees": "A deposit shown as sent to an exchange or swap service",
      "onChainReality": "The transaction is unconfirmed, underpaid, or otherwise reversible, sent hoping a payout goes out before it finalizes",
      "theActualTheft": "The service's payout, if it releases before the deposit is final",
      "recognitionTell": "Wait for full confirmation before treating a deposit as received; for a service, never pay out before finality and screening",
      "recoverable": "A service that waits for finality loses nothing",
      "firstHandCase": {
        "operator": "CoinVast",
        "date": "2026-06-20",
        "orderId": "87KDPVFA76",
        "claimedDeposit": "10,000 USDT on Tron",
        "requestedPayout": "about 0.153 BTC",
        "outcome": "Deposit stalled at 5 of 20 required confirmations and never finalized; payout was held; no funds left; order remains a stalled confirming entry"
      }
    },
    {
      "id": 6,
      "name": "Fake record or screenshot",
      "victimSees": "A convincing screenshot of a completed transfer or a pending entry",
      "onChainReality": "No real transaction exists, or one exists that is built never to confirm",
      "theActualTheft": "The goods, cash, or crypto you release on the strength of the fake proof",
      "recognitionTell": "Never act on a screenshot or a pending status; confirm the transaction yourself on a block explorer and wait for real confirmations",
      "recoverable": "Nothing was sent to you; release nothing"
    }
  ],
  "universalRules": [
    "On chain transactions are final; anything actually sent is almost always unrecoverable once confirmed",
    "The displayed balance is bait; the fee you are asked to pay is the theft",
    "Verify the full address before sending, every time",
    "Wait for network finality before trusting any incoming transfer",
    "Anyone charging an upfront fee to reverse a confirmed transaction is a follow on scam"
  ]
}