A Calm Triage Routine for Suspicious Exchange Messages and Support Requests

Impersonators copy exchange logos, tone and even real staff names, so a message can look convincing while being completely fake. The problem is not that you are careless; it is that the message arrives when you are busy, worried or excited, and it asks you to act fast. This guide sets out a calm triage routine you can run in a few minutes before you click, reply or move any funds. The idea is simple: never verify a message inside the channel that delivered it. Instead, pause, open the exchange's own help centre or app directly, and confirm from there whether the request is real. The routine below works for emails, SMS, social media direct messages, Telegram or WhatsApp groups, and unsolicited support chats. You will also note what to record, when to stop completely, and which mistakes people make most often. Keep in mind that no exchange will ever need your password, your two-factor authentication codes or your seed phrase to help you, and that a real support team does not mind waiting while you check.

Start with a deliberate pause and a written note

Before you read the message a second time, write down four things in a plain note: the sender's displayed name, the exact channel it arrived on, the time it arrived, and the single action it wants you to take. This takes under a minute and pulls you out of the emotional pull of the message. Most fraudulent requests depend on urgency, so the act of writing slows you down enough to think clearly.

Then ask one question: did I contact this exchange first, or did this message arrive on its own? If you never opened a support ticket, a message claiming to continue an existing case is a strong warning sign. If you did open a ticket, keep the reference number from the exchange's own help centre and compare it with anything you receive. A genuine follow-up should match a case you can see in your own account area.

Do not reply, tap links, scan QR codes or call numbers in the message while you are still triaging. Nothing about this step requires you to engage with the sender. If the message pressures you to act within minutes, treat that pressure itself as the first red flag and continue the routine at your own pace.

Verify only through the exchange's own help centre

Open the exchange's official help centre by typing the address yourself or by using an app you already have installed, and search for the topic the message mentions, such as a login problem, a withdrawal hold, a verification request or a fee query. If the issue is real, the help centre will describe the same situation and the same next steps. If you cannot find anything resembling the message, that absence is meaningful evidence.

Where the message quotes a policy, a fee, a limit or a deadline, do not accept the number from the message. Check the relevant official page, such as the fee page for trading costs, and record what it actually says next to the claim you received. Numbers are one of the easiest things for an impersonator to invent, and they are also easy for you to confirm from the source.

Treat every interface detail as something to verify rather than something you already know. Menu names, ticket forms and verification screens change over time, so a message that describes a layout you have never seen is not proof of anything either way. Describe what you see in your own account, in your own words, in your note.

Check your account state instead of arguing with the sender

Log in to the exchange directly, using your own bookmark or app, and look at the areas the message refers to: security settings, active sessions, verification status, pending withdrawals and open support tickets. If the message claims your account is restricted, compromised or under review, your own account pages are the place that would show it. A claim that cannot be seen anywhere in your account deserves heavy scepticism.

While you are there, review your security settings. Confirm that two-factor authentication is enabled on the method you expect, that your registered contact details are still yours, and that no unfamiliar device or session is active. If something genuinely looks wrong, change your password from inside the account, revoke sessions you do not recognise, and then contact support through the help centre rather than through the message.

Keep a short log of what you checked and when. A simple line such as the date, the page you opened and what it showed is enough. This log helps you spot repeated impersonation attempts, and it gives you accurate facts if you later need to raise a ticket through official channels.

Decide, record and stop cleanly

After checking, make one of three decisions and write it down. If everything matches the official help centre and your own account pages, you can proceed through the official channel only. If nothing matches, ignore, report and delete the message without replying. If you are still unsure, do nothing at all and revisit it later; leaving a suspicious message unanswered costs you nothing.

Set clear stop conditions in advance so you do not have to decide under pressure. Stop immediately if anyone asks for your password, your two-factor codes, your seed phrase, a remote screen-sharing session, or a transfer to an address or account you have not verified independently. Stop as well if you are asked to keep the conversation secret or to move to another chat app.

Common mistakes worth naming: replying to ask whether the sender is real, which confirms your contact details are active; clicking a link to check where it goes; trusting a caller ID, profile photo or badge; and treating a message that quotes correct public information as proof of identity. None of these confirm anything. The only confirmation that counts comes from the exchange's own help centre and your own logged-in account.

Risk boundary: Malaysia Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Write down the sender name, channel, time and requested action before doing anything else.
• Verify the claim by searching the exchange's official help centre, not by replying to the message.
• Log in directly through your own bookmark or app and check security settings, sessions and any open tickets.
• Record what the official page actually says and compare it with any figure or deadline quoted in the message.
• Stop at once if anyone asks for your password, two-factor codes, seed phrase, screen sharing or a transfer to an unverified address.
• If you need help, open a ticket from the help centre and keep the reference number in your own notes.