When people talk about the risks of cryptocurrency, price volatility usually gets top billing.
And understandably so! Digital assets can move sharply in either direction, sometimes over very short periods. Anyone considering crypto needs to account for that volatility alongside their objectives, time horizon, liquidity needs and tolerance for loss.
But there’s another category of crypto risk that has nothing to do with whether bitcoin price rises or falls today or tomorrow.
What if the “investment” itself isn’t real?
Recent, high-profile cases offer an uncomfortable reminder that investors can lose money, not because a cryptocurrency performed badly, but because they were dealing with fraud. A scammer, a fake platform or someone pretending to be a legitimate financial professional.
Today, we’ll separate those risks from crypto’s market risk – because they call for a very different kind of due diligence.
A $20 million balance – and an urgent $1.1 million question
Consider this recent story reported by MarketWatch columnist Quentin Fottrell (syndicated without paywall here).
A reader told Fottrell they were introduced to an executive president of a major New York investment bank. Subsequently, he deposited about $1.1 million into a cryptocurrency-trading platform at the executive’s suggestion.
Over time, the balance rose to roughly $20 million over just four months. So far, so good!
But there were warning signs.
According to the investor, the “executive” only communicated through WhatsApp. And advised the investor exactly what trades to make and when. The “advisor” told the investor what to do – making all of the transaction decisions.
All the time he urged secrecy, claiming disclosure could create “FINRA problems.” FINRA, the Financial Industry Regulatory Authority, is basically the organization that registers and polices brokers and dealers.
Perhaps the biggest red flag of all, though? The investment came with assurances about returns.
Now the investor is completely unable to withdraw the balance (let alone the initial deposit). He’s starting to believe the balance displayed on the screen isn’t just wrong. It may not represent recoverable assets at all.
He contacted the FBI’s Internet Crime Complaint Center, but the FBI said there wasn’t sufficient information to pursue a criminal complaint. He’s contacted lawyers, but apparently the website is based outside the U.S. which greatly complicates any legal options. No lawyers were willing to attempt recovery of the assets.
Before we go on, let’s not reduce a case like this to “he should’ve known better.” Successful investment scams work precisely because criminals devote considerable effort to credibility. They may impersonate (or steal the identity of) real financial professionals. Creating convincing websites and account dashboards isn’t difficult – a simple WordPress template can provide all the necessary software. Pro tip: Always be on the lookout for filler text like lorem ipsum dolor sit amet or benefit #1 here – this is a very clear sign of an unfinished, unprofessional website at best.
Competent scammers cultivate trust over time. They show fabricated profits and fake testimonials designed to encourage increasingly large deposits over time, as their target’s confidence grows..
The Federal Trade Commission says scammers may approach people through social media, WhatsApp or online advertising and then display fake evidence that an investment is succeeding. In 2025 alone, Americans reported more than $7.9 billion in losses to investment scams. The typical individual loss exceeded $10,000. Not a life-changing amount for most of us – in the case we started with, though? A $1.1 million loss would be simply impossible for most Americans, and catastrophic for everyone I know personally who has that kind of money.
Listen: The point isn’t that WhatsApp is inherently suspicious. Or that every investment platform you’ve never heard of is fraudulent.
That combination of red flags – an unsolicited relationship, secrecy, unverifiable credentials, guaranteed returns and uncertainty about where the assets are being held – deserves your serious scrutiny and absolute skepticism.
Due diligence is an investor’s best defense against scams. Speaking of which…
A social-media ad isn’t due diligence
Another recent case raises a related issue.
A recently-proposed class action lawsuit against Meta/Facebook and Instagram in federal court claims that cryptocurrency advertisements directed investors toward fraudulent investment schemes.
The case is new, and the allegations haven’t been proven. Plaintiffs allege that Meta/Facebook knew about fraudulent advertisements on its social media platforms. And that its advertising algorithms directed those ads toward users likely to engage with them. (Regardless of whether Meta knew they were promoting scams, we all know that modern ad networks direct advertisements toward users likely to engage with them. That’s just how advertising works!)
Now, Meta faced other litigation involving allegedly fraudulent advertisements and said publicly (and recently) that it’s stopped more than 159 million scam ads – along with nearly 11 million accounts associated with criminal scam centers. This particular case is about “a pump-and-dump scheme involving shares of a Chinese penny stock,” so it’s not specifically about crypto. It’s a similar sort of fraud, though.
Because scammers go where the people and the money are, the battle between media platforms and criminal advertisers is still ongoing…
Frankly, I’m shocked that Meta took down159 million scam ads! I did a little searching and learned Meta processes about 5 million new ads every day. At that scale, it’s easy to imagine a lot of things slip through the cracks…
This isn’t an elaborate caveat emptor (buyer beware) warning. Whatever ultimately happens in this particular lawsuit, there’s a broader point worth remembering:
An advertisement on a trusted platform does not verify the investment.
That applies well beyond crypto.
A polished, professional ad that leads to a well-designed website or an impressive-looking app might seem legit and trustworthy. Producing this kind of digital infrastructure used to require a big budget or an expert advertising agency… Not anymore. Especially in the age of advanced AI, anyone with an internet connection can build a fake first-rate online appearance in a day or two.
Any time you find yourself thinking, Well Facebook wouldn’t let just anybody advertise… I want you to remember one number: 5 million. FIVE million ads a day inundate Meta’s review staff and algorithms. How difficult is it to maintain any kind of quality control at that kind of volume? Especially when the business incentives lean toward accepting the ad. Because every ad Meta’s reviewers reject costs the company money.
Do you think Meta’s staff review every single advertiser’s offer? That they know the people behind the ad, or their business model? I doubt it. Don’t assume any platform, whether it’s Facebook or CNN or The Wall Street Journal, is doing your due diligence for you.
Crypto can add complications beyond those of more familiar types of financial fraud. Recovering money from any financial scam is difficult, according to the Government Accounting Office.
In the Federal Reserve’s 2025 household survey, different types of financial scams have very different outcomes. Overall non-credit-card fraud recovery rate: A little less than half (44%).
When we break down fraud by type, the unrecoverable rates look like this:
- Cryptocurrency: 65%
- Peer-to-peer services: 52%
- Bank wire or electronic transfer: nearly 40%
- Debit card: 31%
Why are crypto fraud losses so much more difficult to recover? The FBI notes that criminals can rapidly move cryptocurrency through other wallets, into other cryptocurrencies and overseas, making stolen funds incredibly challenging to track and seize.
This isn’t the same risk as bitcoin dropping 20% in a couple of days.
If you’re a regular reader, you already know how much I love to remind you that, in investing, risk and reward are joined at the hip. While there’s no such thing as a risk-free reward, scammers are always eager to offer the unwary the opposite: Reward-free risk.
This risk isn’t just about the asset, although the asset does matter. It’s more about who you’re dealing with, how the transaction happens and, importantly, where your money or assets actually go.
So how can we evaluate opportunities and separate the wheat from the chaff? Here’s what I recommend…
Five questions worth asking before money moves
There’s no single checklist that can eliminate investment fraud. Scammers are creative, the financial services industry is always changing and regulators are adapting all the time.
Even so, there are some basic questions that can help you identify red flags before money changes hands.
1. Can you independently verify who you’re dealing with?
Don’t rely only on a name, profile photo, email signature or biography supplied by the person contacting you. A LinkedIn page isn’t enough!
Check the company and the individual through independent sources. Verify professional qualifications or licenses directly. Here’s what the SEC says about vetting your investment professional.
2. A promise of unusually high or risk-free returns?
ALL investments involve risk, period. If they didn’t involve risk, they wouldn’t be investments!
Guarantees are not automatically suspicious – some legitimate financial products include contractual or government-backed guarantees. But promises of large, consistent profits with little or no risk are a longstanding fraud warning sign.
The FTC and SEC both urge skepticism when an investment promoter minimizes risk while promising outsized returns.
The FTC specifically warns consumers to be suspicious of investment promoters who minimize risk or promise large returns – as does the SEC.
3. Do you understand where your money is going?
Before transferring funds, you should be able to identify the company receiving them, what role that company plays and how they’ll acquire and hold your assets.
A balance on an app or website is not, by itself, proof that assets exist.
4. Who has custody of the assets?
This question becomes particularly important with cryptocurrency.
Investors choosing third-party custody should understand who holds the assets or private keys, how access is controlled, what security measures are in place and what would happen if a service provider failed.
Self-custody creates a different set of responsibilities, including protecting private keys and recovery information. Neither approach removes risk; they distribute responsibility differently.
5. What protections exist – and what don’t they protect against?
Ask about security practices, transaction authorization, insurance arrangements and the limits or exclusions attached to any coverage.
Just as important, distinguish those protections from investment performance. Security measures may address certain risks involving custody, theft or unauthorized access. They cannot prevent the market value of a cryptocurrency from declining.
Market risk and operational risk are different problems
That distinction matters.
- If someone purchases bitcoin and its market price falls, that is investment risk
- If someone sends money to a fake trading platform and the displayed bitcoin balance never existed, that is fraud
- If digital assets are stolen because access credentials are compromised, that is primarily a custody or security risk
All can result in losses, but they are not interchangeable – and reducing one does not eliminate the others.
For people considering cryptocurrency as part of their retirement savings, that means due diligence should extend beyond the question of what asset to own.
It should also include who administers the account, who executes transactions, who holds the assets and how those assets are protected.
How a Digital IRA handles those challenges
A Digital IRA is a type of self-directed retirement account. The account owner makes the investment decisions, while other service providers perform specific administrative, trading and custody functions.
At BitIRA, for example:
- Custody: We primarily work with Equity Trust Company for custody and administration
- Transactions: Your crypto transactions take place oh Galaxy Digital’s enterprise-grade platform
- Storage: We use Ledger Enterprise technology, including multi-signature authorization designed to avoid relying on a single authorization point
- Insurance: “End-to-end” insurance protects BitIRA customers’ assets – whether in transit or in storage, assets are insured against hacking, embezzlement, theft, physical loss, damage or destruction
Learn more about BitIRA’s custody and security here – and see for yourself why BitIRA has been called “The World’s Most Secure Digital Currency IRA.”
Now, none of those safeguards can make cryptocurrency risk-free. They answer a different question: If you decide to diversify with digital assets in a retirement account, what people, processes and protections do you have against operational risk?
That’s a question worth asking before – not after – money changes hands. One last point: Scammers hate it when you ask questions like this! They count on victims feeling distracted by the promise of quick and easy wealth. The more questions you ask, the less likely you are to fall for a scam (and scammers know it).
If you’d like to learn more about the benefits of digital asset diversification in your retirement savings, check out the free Crypto IRA Guide. You’ll learn more about cryptocurrencies and how Digital IRAs work. And if you’ve completed your due diligence and are ready to get started, you can open a Digital IRA with BitIRA online, any time, day or night, in less than 10 minutes.
