An unexpected token or a free-crypto promotion can look like a welcome opportunity. The risk often appears in the next step: send money to claim the reward, enter a recovery phrase or approve an unfamiliar request in your wallet.
Before interacting, establish where the offer came from and what the requested action actually permits. A displayed token balance or a familiar celebrity image does not answer either question.
Key takeaways
Receiving an unknown token does not prove that it has real value.
A promise to return more crypto after you send some first is a major warning sign.
Connecting, signing and approving are different actions; review the permissions, not just the button label.
Fake tokens and unexpected balances
Anyone evaluating a token should distinguish its name, its display value and the ability to trade it legitimately. A token can imitate a familiar project's branding. A wallet may show a number that does not reflect an amount you could actually receive by selling it.
Do not follow a token's embedded website link just because it appeared in your wallet. An unfamiliar asset is not an instruction to interact. Leave it alone while checking the project through independently found official information.
Moneysmart highlights suspicious wallet tokens and signing requests among crypto scam risks. The danger is in deception and unsafe interaction; simply receiving a token does not automatically give another person your recovery phrase.
Fake airdrops and giveaways
An airdrop is a token distribution. Scammers imitate one to attract people to a claim page. They may impersonate a project's account, reuse a company's logo or post a link through an account that has been compromised.
A giveaway may promise to double whatever you send to an address. A celebrity image, livestream or set of replies claiming success does not establish that anyone will return your payment. Video and audio can also be manipulated.
Check an offer on the project's official channels accessed independently. Do not let the claim page supply all the evidence for its own authenticity. A countdown or an apparently limited allocation is not a reason to skip the check.
Know what the wallet is asking you to do
Connect
Connecting a wallet commonly lets a website see the public address and request further actions. It does not, by itself, hand over the recovery phrase. However, an unfamiliar connection can expose information and lead to deceptive requests. Do not connect simply to find out whether an offer is genuine.
Sign
A signature can serve different purposes. Some confirm a message; others can authorise asset-related permissions or later actions. A request described as free verification is not necessarily harmless. Understand the effect before signing, even if no immediate payment or network fee appears.
Approve
A token approval can allow a smart contract to spend a particular asset from your wallet. The amount or scope may be broader than the small reward you expected. A smart contract is a program on a blockchain; its permissions still need scrutiny.
These distinctions are explained in MetaMask's guide to decentralised applications and wallet permissions. Read the actual wallet prompt and your provider's documentation rather than accepting the website's summary.
Do not sign a request you cannot interpret. Cancel and obtain clarification through an independently verified source. Never give a website your recovery phrase to claim tokens or repair a failed claim.
A fictional example
This scenario is invented and does not describe a CoinByte customer.
Mia notices an unfamiliar token in her self-custody wallet. A linked page says she can exchange it for a valuable reward. The page uses a familiar project's colours and a countdown.
After Mia connects, the wallet asks her to approve spending of an asset she already owns. That asset is unrelated to the supposed reward. She cancels the request and checks the project's official information independently.
The decision depends on the permission requested, not how attractive the displayed token appears. Mia does not need to authorise spending to establish whether an airdrop is genuine.
If you already interacted
Record what you did: opened a page, connected, signed, approved or disclosed a secret. These actions have different consequences, so give support an accurate account rather than describing all of them as clicking a link.
Disconnecting a website does not automatically cancel existing token approvals. Use your wallet provider's official guidance to review and, where appropriate, revoke permissions. See MetaMask's explanation of disconnecting versus revoking.
If a recovery phrase or private key was exposed, treat that as a separate compromise requiring official wallet guidance. Revoking a token approval does not replace exposed keys. Do not send more funds to a possibly compromised wallet because someone offers to fix it.
CoinByte accounts and external wallets
These connection and signing risks mainly concern wallets that interact directly with blockchain applications. Do not assume an unexpected wallet claim is part of CoinByte account management.
If someone says CoinByte is running a promotion, verify it through the official website or app. If a CoinByte account or transfer is involved in a suspected scam, contact its published support channel. Use Crypto Wallet Scams for address and recovery-phrase guidance and the post-scam action guide if funds or account access may be affected.
Scam & FraudWhat to Do If You Think You've Been ScammedIf you think you may have been caught in a crypto scam, act quickly. You do not need to be certain before asking for help. The immediate priority is to prevent further payments and protect any affected accounts or devices. Take these steps firstStop sending money or cryptocurrency and stop following
Scam & FraudHow to Verify a Crypto Platform, App or Investment OpportunityBefore sending money, check the business, the person contacting you and the particular offer. They are separate questions. A real company can be impersonated, and a genuine app can be used to buy crypto that is then sent to a scammer. This checklist helps you identify gaps before making a payment. It
Scam & FraudRecovery Scams: When Getting Your Money Back Becomes Another ScamAfter losing money, an offer to retrieve it can be difficult to ignore. Someone may say they traced your crypto, found it in a frozen wallet or can recover it using specialist tools. The apparent solution can be another attempt to obtain money or account access. You can seek help without accepting an