Researched and last reviewed September 2026 · Written by the GiftMeCrypto research desk
There is no legitimate promo code that pays meaningful crypto for nothing. Five patterns cover essentially all of the fraud, and one structural test catches all five: money never has to move toward you for you to receive money. Design quality stopped being a signal years ago; the money direction has not.
- Pattern 1
- The fake balance
- Pattern 2
- The celebrity code
- Pattern 3
- The doubler or fixed-return miner
- Pattern 4
- The withdrawal-fee squeeze
- Pattern 5
- The support impostor
- The test
- Is an inbound payment being requested?
The one rule
This single test is more reliable than any blocklist, because blocklists go stale within a week and the structure of the fraud does not change. Every pattern below eventually asks for an inbound payment.
The five patterns
1. The fake balance
A site displays a credited balance and a withdraw button. The number is frequently oddly specific — $327.41 rather than $300 — because specificity reads as authentic. Pressing withdraw triggers a request for a network fee, an activation deposit or a verification payment.
There is no balance. It is a label rendered on a page, and the entire site exists to produce that one moment. Victims frequently pay more than once as the demands escalate: the first fee "failed", a second is needed, then a "tax" on the release.
2. The celebrity code
A well-known name — a technology founder, a broadcaster, a bank — attached to a giveaway requiring a code or a small qualifying transfer. The name is doing all the work; underneath, it is pattern one.
No public figure has ever run a crypto giveaway requiring a promo code or an upfront payment. Where these appear as livestreams or "official announcements", they are impersonation, and the volume is high enough that platform moderation never fully catches up.
3. The doubler and the fixed-return miner
"Send 0.1 BTC, receive 0.2 BTC." "Cloud mining, 3% daily, promo code included." Both are the same arrangement: early participants may be paid from later deposits until the operator stops.
There is no machinery and no market that produces a fixed daily percentage. A guaranteed return, quoted in a fixed percentage, in a volatile asset class, is a contradiction — and it is the easiest of the five to identify from the claim alone.
4. The withdrawal-fee squeeze on a plausible platform
More sophisticated and more expensive. A functional-looking exchange accepts a deposit, displays plausible trades and a growing balance, and then blocks the first withdrawal pending a "tax payment", "compliance fee" or "anti-money-laundering deposit".
5. The support impostor
You post about a problem in a public forum, group or comment thread. Within minutes a "support agent" contacts you privately with a link, a form, or a request for your seed phrase, password or voucher code.
No genuine support team initiates private contact, and none of them ever needs your seed phrase. This pattern catches experienced people specifically because it arrives at the moment they are frustrated and looking for help.
How to recognise them fast
| Signal | Reliability | Note |
|---|---|---|
| An inbound payment is requested before a payout | Conclusive | Stop immediately |
| A guaranteed fixed percentage return | Conclusive | No market produces this |
| A celebrity name attached to a giveaway | Conclusive | Always impersonation |
| Unsolicited private contact from "support" | Conclusive | Real support does not do this |
| No company name or jurisdiction anywhere | Strong | Check the regulator's register |
| Countdown timers and urgency | Suggestive | Common but not exclusive to fraud |
| Poor design or spelling | Unreliable | The good ones look professional now |
Swipe sideways →
Note the last row. Design quality was a useful signal a decade ago and is not one now. The top four rows are structural and cannot be designed away.
If it already happened
- Stop sending, immediately Whatever the explanation for the next payment, it is the same mechanism. The escalating-fee sequence is the standard second act.
- Report it to your national fraud reporting service Using a number or address you look up yourself, not one provided by anyone involved.
- Report it to any legitimate platform in the chain If funds moved through a real exchange, tell them promptly — occasionally they can freeze onward movement.
- Preserve the evidence Screenshots, transaction hashes, domains, message threads and any names used.
- Refuse every recovery offer This is the most important step. Anyone contacting you afterwards claiming they can recover the funds is running the second-stage scam, and it targets the same victim precisely because they have already demonstrated willingness to pay.
We cannot help recover funds and neither can anybody who says they can — see what we cannot help with.
I keep a folder of screenshots from these sites and the thing that strikes me is how good the cheap ones have become. Clean design, plausible order books, live chat that answers in under a minute, testimonials with photographs. Judging by appearance stopped working years ago.
What has not changed in all that time is the money direction. Every single one of them eventually asks for an inbound payment, because that is the only way the business model works. That is the only test I use now, and it has never failed. If you take one thing from this page, take the structural tell rather than a blocklist.