Encryption protects the message's delivery path; a request for money needs independent verification.
End-to-end encryption can protect message content from intermediaries, but it does not guarantee the sender is telling the truth. A scammer can also send encrypted messages from their own account. To assess a fake administrator, a bogus prize or a cryptocurrency offer, you need to examine the account's identity and its request separately from the security of the message's delivery path.
Three common patterns and how to respond
| Message received | What you need to check | Safer action |
|---|---|---|
| “I'm the group administrator; send this amount right now” | Someone may have copied an administrator's name and picture | Check the administrator list and confirm through a previously known contact method |
| “You've won; pay a fee to receive your prize” | Paying to release a prize is a warning sign of a scam | Do not pay; find the organizer independently |
| “Guaranteed returns; you only have a few minutes” | Time pressure and promises of certain returns interfere with careful checking | Do not send money or wallet information; investigate the claim independently |
These are signals to stop and check. An official appearance, a large membership or endorsements from several other accounts do not, on their own, establish legitimacy.
How can you check for a fake administrator?
Display names and account pictures can be imitated. Check the username and identifier carefully, but remember that even a genuine account may have been taken over. If a request is unusual, contact the person through another channel you already know rather than replying in the same conversation.
For example, if the administrator of a work group privately asks you to transfer money, confirm the request using a registered organizational phone number or channel, not a new number supplied by that same account. Do not send sensitive information to “prove your membership.”
A safety number or key fingerprint can help verify the cryptographic connection with your contact. But matching keys does not prove their financial offer is legitimate or their device is free of malware.
Why shouldn't you send money or login codes to receive a prize?
The US Federal Trade Commission's guidance on fake prizes identifies demands for payment to receive a prize and requests for financial information as major warning signs. The message may appear to be about a contest, a prize draw, a gift or account support.
Do not send login codes, passwords or recovery phrases in chat. If someone asks you to visit a website to “activate your prize,” open the organizer's official address yourself through a known route. An HTTPS padlock or an “encrypted” label on the page does not prove the organizer is genuine.
How do pump-and-dump schemes and cryptocurrency offers differ from fake prizes?
In a pump-and-dump scheme, coordinated promotion can drive up demand for an asset and its price so the operators can sell their own holdings. In a fake investment, there may be no real trading at all, with a dashboard displaying fabricated profits. These are not the same phenomenon, but both can exploit group excitement and time pressure.
The FTC's official guidance on cryptocurrency scams warns about promises of guaranteed returns, impersonation and requests to transfer cryptocurrency. This article is not advice to buy or sell assets; its purpose is to help you assess a suspicious request.
Avoid connecting a wallet or signing a transaction you do not understand. Never enter your recovery phrase for an administrator, support agent or airdrop. Additional payments to “release profits” or “recover lost money” may be a continuation of the same scam.
What does end-to-end encryption help with, and what doesn't it solve?
Proper encryption, together with key authentication, is designed to protect message confidentiality and integrity against people outside the conversation. But an authorized group member can read the text and may lie, send malicious links or copy messages. Post-compromise security is not a fraud detection system or an automatic way to revoke an attacker's access.
Likewise, a protocol such as SRP, which does not send the password directly during login, does not stop you from entering that same password on a fake page. Protecting login and recognizing deception are two separate problems.
According to Livara's published security boundaries, public channels are not the same as private chats. Content reporting can be useful, but neither being public nor having reporting tools makes scams impossible.
What should I do if I've sent information or money?
- Stop further communication and payments; do not pay another fee to “resolve the problem.”
- Keep messages, the account identifier, the website address and the transaction receipt for reporting; do not publish them publicly.
- If you shared login information, use a trusted device to visit the official website, change your password and review your sessions and recovery methods.
- If you made a payment, contact the relevant bank or payment service promptly. A refund is not guaranteed, especially with cryptocurrency.
- Report and block the account and message using the messaging service's official tools. For a legal report, seek help from the relevant official authority where you live.
Quick questions
Is a verification badge or a large membership enough?
No. Independently check the specific request, the person's identity and the payment destination; no visual sign replaces those checks.
If the safety number is correct, is the request for money legitimate?
No. Key verification concerns the other party in an encrypted connection, not the truth of their financial claim or the security of their device.
Do I need to click the link to find out whether it's fake?
No. To investigate a suspicious request, first visit the service through an official, known route. An attractive preview or a domain name that resembles the real one is not evidence of legitimacy.
