Impersonator posing as platform support / payouts
DMs from accounts that copy the platform's logo, naming and tone, claiming there is a payout problem, a tax form to sign, or an identity check - and a link to a phishing page.
Why this pattern works
Real platform support never DMs you out of the blue with a link to enter your password, never asks for your 2FA code, and never threatens immediate account suspension if you don't click within 24 hours. These campaigns spike around tax season and around payout dates.
Signs you are in this pattern
If two or more of these match what is happening, treat it as the scam.
Verbatim lines we have seen used
If you hear or read these, the script is running.
"Verify your account now or it will be closed.
"Sign this W-9 to release your pending payout.
"Click the link to recover your tokens.
What to do right now
Sequential, low-risk actions. Do them in order.
Never click links in unsolicited support DMs.
Open the platform directly and check your settings / payout tab.
Turn on 2FA via an authenticator app (not SMS) on the real account.
Report the impersonator account and the phishing URL to the platform.
Platforms involved in current reports
Aggregated from the reports we have processed in this review window.
Has this happened to you?
Confidential submission - encrypted at rest. We use anonymised patterns to alert others.