Support impersonation is unusually effective for one reason: it does not have to persuade you that something is wrong. You already believe that. It only has to be the thing that appears when you go looking.
The test is direction, not content
Contact between a platform and a user runs one way: you start it, from inside the official app or site, and support answers within that channel.
There is no legitimate process in which support adds you on a messaging app, replies to you in a group, or calls from an unfamiliar number to say your account has a problem. Once you know that, you never have to assess how professional someone sounds, and sounding professional is the part they are good at.
The four routes it arrives by
Route one: search results. Someone searching for a support number or live chat is already in trouble and short on patience. The top slot can be purchased. This overlaps with everything in confirming a real app and a real site.
There is a detail here that catches people. These pages are often deliberately plain — a phone number, a chat button, a line about 24/7 availability. Plainness is the design, because an elaborate page invites scrutiny while a bare one reads as utilitarian.
Route two: the "official" account in a community. A group or forum where an account carrying the right name and avatar offers to help. Community spaces rarely verify this, and the account only needs to be convincing for one conversation.
Route three — the one almost nobody notices: you asked publicly, and the answer arrived privately. You post a question about a stuck withdrawal or a restricted account. Within a short time, a private message arrives from someone offering to sort it out.
Why this route deserves its own warning
You were not selected at random. You self-identified: as someone with an account, with a specific problem, in a specific state of mind. That is a better qualification than any list could provide, which is why the reply often arrives within minutes.
The practical rule: asking for help publicly is fine; accepting help that arrives privately in response is not. If you post a question, decide in advance that you will ignore every direct message it produces.
Route four: targeted contact from leaked data. Sometimes the approach already includes details, which platform you use, a partial email, occasionally a real transaction. Those details come from data exposed somewhere else, and their function is to skip the part where you decide whether this is real. Knowing something about you is not evidence of legitimacy; it is evidence that information about you circulated.
The limits real support never crosses
Any one of these settles it
- It never contacts you first through a private message, a social app, or an unknown number.
- It never asks for a one-time code. The platform sent that code; it does not need you to read it back.
- It never asks for a password or seed phrase. It cannot see the first and has no relationship to the second.
- It never asks you to move funds to a "safe account". No such thing exists. If a platform judges an account risky, it restricts the account — it does not ask you to send assets away.
- It never asks you to install remote access software or share your screen. Support happens in their systems, not on your desktop.
- It never collects payment through a personal channel. Fees are deducted inside your account, not sent to someone.
Screen sharing deserves a note of its own, because it quietly cancels every other rule. Once someone can see your screen, they see the codes as they arrive, and "never tell anyone your code" stops meaning anything. The complete boundary list is in six things a legitimate platform never does.
Why it lands even on careful people
Because it arrives at the moment your attention is already spent on something else. A stuck withdrawal, a restricted account, a failed verification — you are troubleshooting, and someone appears offering to resolve exactly that.
The framing is also inverted relative to most scams. You are not being sold anything; you are being helped. Refusing help feels unreasonable, and that discomfort is doing real work.
The counter is procedural rather than emotional: you do not have to refuse anybody. You just close the conversation and go ask the same question inside the official app. If the issue is real you will see it there. If you cannot see it there, there was no issue. Nothing is lost either way, which is what makes this the right default.
Fix the entry point once
Everything above collapses into one habit. Bookmark the official support entry point while nothing is wrong, and use only that.
Five minutes, one time
- Open the official app and find the support or help section. Note where it is.
- On the official site, bookmark the help centre page, not a search result for it.
- Note the app store developer name from the official listing.
- Decide now that you will never phone a number found by searching.
To check a specific page or contact against these points, the official source checklist makes them tickable. To match what someone has actually said to you against known structures, use the script matcher. Both run in your browser and send nothing anywhere.