A fake exchange website looks like a real exchange or swap service, takes your deposit and then either never pays out or shows a balance you can never withdraw. Before sending coins to any new site, check four things: the exact domain, how you got there, whether the rate is believable, and whether a small test order completes. Most fake sites fail at least one of these in under a minute.
Three kinds of fake exchange
| Type | What you see | Where it ends |
|---|---|---|
| Clone of a real service | Same design and name, look-alike domain | Deposit goes to the scammer; no payout |
| Too-good-rate swap | A rate 5–20% better than the market | Deposit is taken, order “stuck” forever |
| Fake trading platform | Growing balance, “profits”, a personal manager | Withdrawal needs a “tax” or “verification fee” — paid again and again |
The third type is usually part of a long investment fraud described in pig butchering scams. The first two target people searching for a quick swap.
The domain is the main check
Clones work only if you do not notice the address bar. Typical tricks: an extra letter or hyphen (kot-cash.io, kotcash.app), a different top-level domain, a real name in a subdomain (kot.cash.example-swap.com), or Unicode letters that look Latin (an IDN homograph, shown as xn--… in punycode). A padlock (HTTPS) proves only that the connection is encrypted, not who owns the site — phishing sites get certificates in minutes.
- Type the address yourself or use a bookmark you saved from a trusted source.
- Paste any link you received into the phishing link checker: it decodes punycode, compares with popular crypto domains and flags look-alikes.
- Be suspicious of search ads for exchange names. Scroll to the organic result or type the domain.
- KOT.CASH lives at kot.cash; the mobile version is m.kot.cash. Any other domain using the name is not us.
Is the rate believable?
Swap services earn a small margin over the market price; KOT.CASH shows its float rate with a 1% fee and a fixed rate with 1.5%, plus the payout network fee. A site that promises to give you more than the market price has no way to pay for it except with your deposit. Compare the quote with the live market using the crypto converter or put several quotes into the exchange rate markup calculator: a quote that comes out more than a few percent above market should end the visit.
Signals on the site itself
- No company details, terms, AML policy or privacy policy — or copied ones mentioning another brand.
- Support only via a Telegram username, and an aggressive chat that “guides” you through depositing.
- Deposit address shown before you enter a payout address, or the same deposit address for every user and coin.
- Requests for a seed phrase or to connect a wallet just to swap. A swap needs only your payout address.
- Withdrawals that require paying a fee to a separate address first. Real services deduct fees from the amount.
- A domain registered weeks ago (WHOIS lookups show the creation date), while the site claims years of history.
Reviews and monitoring sites
Exchange monitoring sites and independent forums help, with care. Scam sites buy fake reviews and create their own “rating” pages, so a site that only appears on its own review pages tells you little. Look for a long history in places the operator does not control, complaints that describe the same withdrawal fee pattern, and whether the service is listed by well-known monitors under the same domain you are visiting.
The test order
- Make the smallest order the service allows — on KOT.CASH the widget shows the minimum for each pair.
- Check that the order page shows a unique deposit address, the amount, the rate, the payout address you entered and a status.
- Send, wait for the payout and check the payout hash in a block explorer — see how to check a transaction hash.
- Only then send a larger amount, again copying the deposit address from the new order page.
Also save the domain you used successfully as a bookmark right after the first good order. Next time you open it from the bookmark, not from search results, and a look-alike never gets a chance.
If you sent funds to a fake site
- Stop sending. Do not pay any “unlock”, “tax” or “verification” fee.
- Collect the domain, screenshots, the deposit address and transaction hashes.
- Report the domain to the registrar and hosting provider (WHOIS shows them), to Google Safe Browsing and to the police — IC3 in the US, Action Fraud in the UK.
- If the funds were stablecoins or went to a known exchange, write to the issuer and that exchange with the police reference.
FAQ
Does HTTPS mean a crypto site is safe?
No. HTTPS only encrypts the connection. Phishing sites have valid certificates too. Check the exact domain.
How can I tell a clone from the real site?
By the domain. Type it yourself, decode punycode and compare letter by letter, or use a phishing link checker.
Why is a better-than-market rate a red flag?
A service cannot pay more than the market without losing money; the only source for that difference is your deposit.
What is KOT.CASH’s official domain?
kot.cash, with the mobile version at m.kot.cash.
The site asks for a fee before withdrawal. Should I pay?
No. That is the classic sign of a fake platform; the fee will be followed by another.