Quick answer: Never click a link in a migration email. Go to the exchange, check the URL letter by letter, and verify the notice through a second channel. Check the deadlines; urgency is a red flag. No legitimate exchange or regulator will ever ask for your seed phrase or private key. If you've already shared one, move your funds to a new wallet immediately.
Europe's Markets in Crypto-Assets regulation (MiCA) reached its final licensing deadline on July 1, 2026, and the disruption it caused turned into an opening for exchange migration fraud.
MiCA deadline:
| Metric | Figure |
|---|---|
| Crypto-asset service providers in the EU holding the licence to operate a trading platform | 20 |
| Unlicensed platforms forced to restrict or stop EU service | 1,700+ |
| Users potentially needing to move funds to a new provider | up to 10 million |
This isn't a problem tied to one regulation. Any time a platform requires migration the same scam resurfaces.
Here's how to tell a real notice from a fake one, and what to do if you've already been targeted.
Why "Migration Season" Is a Scammer's Favorite Season
When a platform announces that users need to withdraw money or re-verify their accounts, it creates a perfect mix of ingredients for fraud:
- Urgency. Deadlines push people to act fast and skip normal caution.
- Confusion. Users aren't sure what a legitimate notice is supposed to look like.
- A plausible reason to ask for sensitive data. "Verify your identity," "confirm your wallet," "re-link your account" all sound like normal steps during a real transition.
- A large, predictable target list. Scammers know who is affected, so these users are easier to convince.
Common Tactics Behind Fake Migration Requests
Spoofed emails and messages. Scammers copy the brand tone and formatting of real migration notices almost exactly, sending them from addresses that look close enough to the original at a glance.
Fake "regulator" outreach. Some scams go a step further and impersonate a financial authority, claiming your account needs "regulatory re-verification". A tactic designed to make refusal feel risky.
Requests for your seed phrase or private keys. This is the biggest red flag of all. No legitimate platform or regulator will ever need your seed phrase or private key to "migrate" or "verify" your account.
Fake support chats. Scammers set up chat widgets or Telegram accounts that look like official support, ready to "help" you through the migration – straight into their wallet. At ChangeNOW it is also quite a common story. And our support managers learned to act quickly:
"Most of the time this happens in our community chat on Telegram. Scammers just copy our support avatars and use our staff names to look legitimate. We can usually spot them quickly and remove them from the chat within a couple minutes, and we always follow up with a warning telling users not to share any information with anyone – especially in DMs, because that's where scammers move the conversation once they've made contact." – ChangeNOW Support Team
Lookalike websites. Fake platforms mimic a real exchange's login page, sometimes down to the pixel, using a domain that differs by one letter, a hyphen, or a different top-level extension.
How ChangeNOW fights Fake Sites
For us it is a problem happening 1-3 times a week.
When a fake site or channel is reported, the response is a defined process rather than a one-off effort:
"Usually it's either the scam victim or someone else who reports the site to us, by email or in chat. From there we check which registrar the domain is registered with and reach out to them directly. We file a formal report and attach evidence that the site is impersonating us, including screenshots the victim provided, and ask the registrar to take action on the domain." – ChangeNOW Compliance Team
And when someone has already lost funds to one of these lookalike sites, the honest answer is that recovery isn't always possible. The thing is, the money never reached the real exchange in the first place:
"Unfortunately we can't return the user's funds, because they never actually reached us, they went straight to the scammer's wallet. What we can do is explain to the user that they've been targeted by fraud and walk them through how to tell our official site apart from a scam site. On top of that, we report the fake site to the registrar ourselves and push to get it taken down." – ChangeNOW Compliance Team
If you are targeted, share the transaction details with us at support@changenow.io, and our compliance team will flag the scammer's wallet addresses so the funds can be traced and the scammers don't get to walk away from it.
This is precisely why the checklist below matters more than any after-the-fact recovery process: verifying a migration notice before acting is the only step that reliably prevents the loss in the first place.
A Checklist for Verifying Any Migration Request
Before you click a link or move a single coin, run through this list:
| ✓ | Checklist Item | What to Do |
|---|---|---|
| ✅ | Go direct, not through the message | Open the exchange's app or type its URL from a bookmark. Never click a link in an email or other notification. |
| ✅ | Check the URL character by character | Look for swapped letters, extra hyphens, or unfamiliar domain extensions. |
| ✅ | Cross-check through a second channel | Confirm the notice on the exchange's verified social media or official blog before acting on it. Reach out to the support team to be sure. |
| ✅ | Remember: nobody legitimate asks for your seed phrase or private key | Never. |
| ✅ | Slow down on urgency | Real deadlines are usually measured in weeks, not hours. Pressure to act immediately is a classic manipulation tactic. |
| ✅ | Watch out for unsolicited "help" | If someone reaches out first offering to walk you through a migration, treat it as a scam attempt by default. |
| ✅ | Diversify your funds | Use hardware or non-custodial wallets to diversify your funds. The fewer funds sitting in an account that could be the target of a "migration," the smaller your exposure. |
What to do if I've been targeted by Web3 migration scammers?
- Stop interacting with the site or chat immediately.
- Do not enter any additional information, even to "cancel" or "verify" the request.
- If you've shared a seed phrase or private key, move any remaining funds to a new, secure wallet right away.
- If you've shared payment or card details, contact your bank or payment provider. Block the card immediately.
- Report the incident to the exchange being impersonated so they can warn other users, as well as to your local authorities. We regularly share cases of successful crypto recovery. And they all show the same thing: the sooner you contact authorities and platforms, the higher your chances of getting help.
Fewer Migrations, Fewer Openings
The pattern holds regardless of what triggers a given migration: every account balance sitting on an exchange is a future moment when a "migration" request – real or fake – can be used against its owner.
That's one reason ChangeNOW gives users a choice instead of forcing one path. The core swap doesn't require creating an account or going through verification at all. Opening an account is optional and it's there for anyone who specifically wants to hold a balance and enjoy ChangeNOW's Pro custody option benefits.
Explore ChangeNOW Pro custodial solution
