Buying crypto is the easy part. Keeping it safe is where many beginners run into trouble. The good news: a few simple habits dramatically reduce your risk of losing your investment to hackers, scammers, or simple mistakes.
Here’s a plain-English checklist of the most important steps to protect your crypto.
1. Use a reputable exchange and keep it locked down
For most beginners, keeping crypto on a well-known exchange like Coinbase is the simplest option. These platforms have strong security teams and insurance on cash balances.
What you must do on any exchange:
Use a strong, unique password — don’t reuse passwords from other accounts.
Turn on two-factor authentication (2FA) — this means entering a code from your phone every time you log in. Even if someone steals your password, they can’t get in without your phone.
Use the authenticator app option, not text message (SMS) 2FA — SMS can be intercepted.
2. Never share your login details or recovery phrase
This is the single most important rule in crypto security:
No legitimate company will ever ask for your password or recovery phrase.
If you ever receive an email, phone call, or message asking for these — it’s a scam, full stop. Coinbase, your bank, and any real company will never need this information from you.
3. Be suspicious of unsolicited contact
Crypto scams targeting seniors often start with:
An unexpected call from someone claiming to be from Coinbase or your bank
A social media message from someone offering investment advice
A romantic interest online who eventually brings up crypto
An email warning your account has been compromised (with a link to click)
When in doubt, hang up and call the company directly using the number on their official website.
4. Write down your recovery phrase — and store it offline
If you use a crypto wallet (separate from an exchange), you’ll be given a “recovery phrase” — usually 12 or 24 random words. This phrase is the master key to your crypto.
Write it on paper — not in a document on your computer or phone.
Store it somewhere safe — like a fireproof box or alongside your important documents.
Never photograph it or email it to yourself — that creates a digital copy that can be stolen.
5. Verify before you send
Crypto transactions are irreversible. Once sent, the money is gone. Before sending crypto to anyone:
Double-check the wallet address — even one wrong character sends it to the wrong place forever.
Start with a small test transaction when sending a large amount for the first time.
Confirm the recipient via a separate communication channel if you’re unsure.
Quick security checklist
☑ Strong, unique password on your exchange account
☑ Two-factor authentication enabled (authenticator app, not SMS)
☑ Recovery phrase written on paper and stored safely (if using a wallet)
☑ Email address for your exchange account is secured with 2FA
☑ No one else knows your password or recovery phrase
☑ You’re skeptical of any unsolicited contact about your crypto
Bottom line
Most crypto theft happens because of human error — clicking a phishing link, sharing a recovery phrase, or falling for a social engineering scam. The technology itself is secure. Following these basics puts you ahead of the vast majority of beginners when it comes to protecting your investment.
If Bitcoin is the digital version of gold, Ethereum is more like a digital platform you can build things on. It’s the second-largest cryptocurrency — and understanding the difference between the two can help you make smarter decisions as a beginner.
Start with what you already know: Bitcoin
Bitcoin does one thing very well: it lets people send money to each other without a bank. That’s it. It’s designed to be simple, secure, and hard to change.
Ethereum does all of that, but it also lets developers build apps on top of it. Think of Bitcoin as a calculator — it does one job very well. Ethereum is more like a smartphone — it does many things, and other people can create new apps for it.
What is Ether (ETH)?
The currency of the Ethereum network is called Ether, and its ticker symbol is ETH. When people say they “bought Ethereum,” they usually mean they bought Ether — the coin you can purchase on exchanges like Coinbase.
Ether is used to pay for transactions and services on the Ethereum network. It’s also traded as an investment, just like Bitcoin.
What can Ethereum actually do?
Here are a few real things built on Ethereum:
Smart contracts: Agreements that execute automatically when conditions are met — no lawyer or bank needed.
NFTs: Digital ownership certificates (you may have heard of digital art selling for large sums — that’s usually built on Ethereum).
Decentralized finance (DeFi): Financial services like lending and borrowing that operate without banks.
As a beginner, you don’t need to use any of these features. Most people simply buy and hold ETH as an investment.
Should I buy Ethereum or Bitcoin?
This is one of the most common questions beginners ask. Here’s a simple way to think about it:
Bitcoin is older, simpler, and often compared to digital gold. Many investors treat it as a long-term store of value.
Ethereum is more versatile, but also somewhat more complex. It has a larger development community and more active use cases.
Both are volatile — meaning their prices go up and down significantly.
Many beginners start with a small amount of Bitcoin, then explore Ethereum once they’re comfortable. There’s no wrong answer as long as you only invest what you can afford to lose.
How do I buy Ethereum?
The process is nearly identical to buying Bitcoin. You’ll need an account on an exchange like Coinbase, verify your identity, add funds, and then search for ETH. You can buy a small fraction — you don’t need to buy a full Ether.
Bottom line
Ethereum is the second-largest cryptocurrency and a legitimate part of many beginners’ portfolios. You don’t need to understand all of its technical features to invest in it — just know that ETH is its currency, Coinbase makes it easy to buy, and it behaves similarly to Bitcoin in terms of how you purchase and store it.
You’ve probably heard the word “blockchain” thrown around when people talk about Bitcoin or crypto. But what does it actually mean — and do you really need to understand it to use crypto?
The short answer: you don’t need to understand blockchain deeply to buy or use crypto, any more than you need to understand how the internet works to send an email. But a basic understanding can help you feel more confident.
Think of it like a shared notebook
Imagine a notebook that records every transaction ever made with Bitcoin. Now imagine that instead of one person holding that notebook, thousands of computers around the world each hold an identical copy.
Every time someone sends Bitcoin to someone else, that transaction gets written in the notebook — on every single copy, at the same time. No one person controls it. No bank can change the entries. No government can delete them.
That shared notebook is the blockchain.
Why is it called a “blockchain”?
Transactions are grouped together into “blocks.” Each new block gets attached (or “chained”) to the one before it, creating a chain of blocks going all the way back to the very first Bitcoin transaction in 2009.
Because each block is linked to the one before it, you can’t change a past transaction without changing every block after it — and convincing thousands of computers worldwide to accept that change. In practice, this makes the blockchain nearly impossible to tamper with.
What does this mean for you as a beginner?
For everyday crypto users, the blockchain mostly works in the background. Here’s what it means practically:
Transactions are permanent. Once you send crypto, it’s recorded on the blockchain and cannot be reversed. Always double-check who you’re sending to.
Everything is public. Anyone can look up any transaction on the blockchain. Your name isn’t attached — but your wallet address is visible.
No middleman needed. You can send crypto directly to anyone in the world without a bank processing the transaction.
Is blockchain the same as Bitcoin?
No. Bitcoin was the first use of blockchain technology, but it’s not the only one. Ethereum has its own blockchain. So does every other major cryptocurrency. Think of blockchain as the technology, and Bitcoin as one application built on top of it.
Bottom line
You don’t need to master blockchain to get started with crypto. But knowing it exists — and understanding that it’s a shared, tamper-resistant record of transactions — helps explain why crypto doesn’t need a bank to function. The blockchain is the bank, in a sense. Just a very different kind.
If you have just realised you have been scammed, start here and do not stop to read the rest of this page first: if you are 60 or older, call the National Elder Fraud Hotline on 833-372-8311 (Monday–Friday, 10am–6pm Eastern). They assign you a case manager who stays with you and will help you file the reports below. You do not need to have your details in order before you call.
Everyone else: work through the first four steps below today. Speed genuinely matters, and this page explains exactly why.
⏱️ The First Few Hours
Do these in order. Steps 1 and 2 are the only ones with a realistic chance of stopping money from leaving.
1. Stop paying. Completely.
If anyone is asking for one more payment to “unlock” your funds, cover a “tax,” pay a “fee,” or make a “final deposit to release” your money — that is the scam continuing. There is no unlock. Every additional payment is simply more money gone.
2. Call your bank and ask for a recall
If any part of this involved a wire transfer or a bank payment, this is your single most time-sensitive action. The FBI’s guidance is explicit:
Contact your bank and other financial institutions to safeguard your accounts. If wire transfers were sent, request a recall and a hold harmless letter from your financial institutions.
Ask for two things by name: a recall of the funds, and a hold harmless letter. The FBI notes that doing this quickly “may reduce or eliminate your financial losses.”
Why the rush? The FBI runs something called the Financial Fraud Kill Chain — a process that works with banks to freeze fraudulent transfers before they settle and get moved on. In 2025 it froze $679 million of $1.16 billion in attempted theft, a 58% success rate. But it only works if the report arrives while the money is still traceable. (IC3 2025 Annual Report, pp. 18–19.)
3. Report it to the exchange, in writing
Contact whichever platform you used and report the transaction as fraudulent. Be realistic about what this achieves: an exchange cannot reverse a completed transfer. What it can sometimes do is flag or freeze the receiving account internally — and it creates a dated record that helps later.
⚠️ Find the support contact by typing the exchange’s address into your browser yourself. Do not search for a support phone number — fake ones are one of the most common follow-up scams.
4. Save everything before you delete anything
The urge to delete the app and put it behind you is completely understandable. Please screenshot first. Investigators specifically ask for:
Transaction IDs (hashes) and wallet addresses — the FBI calls transaction details “the most important information you can provide”
Amounts, which cryptocurrency, and exact dates and times
Every message, email and text — screenshot the conversation before deleting the app
The names, phone numbers, email addresses and usernames the scammer used
Every website or app they told you to install, including screenshots of any fake “account balance”
If an older adult is being financially exploited, including by a caregiver or relative.
Eldercare Locator: 800-677-1116, Mon–Fri 9am–8pm ET
Local police
Banks and insurers frequently require a police report number.
Non-emergency line. Call 911 if anyone is in danger.
Note: if the FTC’s reporting form is temporarily unavailable when you visit, file with IC3 instead — it is the more important of the two for crypto — and try the FTC again later.
Also protect what hasn’t been taken yet
Change your passwords — and if you reused that password anywhere else, change it there too.
If they had remote access to your computer, update your security software and run a full scan.
If you gave out your Social Security number, go to identitytheft.gov.
Please read this section even if you skip everything else. Being scammed once makes you a target for being scammed again, and the follow-up is often worse than the original.
After fraudsters steal victims’ money, they also profit from the victims’ information—either by hanging onto it for a few months and coming back to run another scam or by selling it on the dark web.
The CFTC adds that “the majority of fraud victims are victimized more than once,” and that prior victims are targeted more often than people who have never been scammed.
How it works: someone contacts you claiming they can trace and retrieve your stolen crypto. They charge an up-front fee. Then they either disappear, or produce a worthless “tracing report” and ask for more money. Many claim to be law enforcement, lawyers, or blockchain investigators.
Three rules that will protect you
“Law enforcement does not charge victims a fee for investigating crimes.” That is the FBI’s own sentence, from its warning about crypto recovery schemes. Anyone official asking for payment is not official.
The IC3 will never contact you directly. Verbatim: “The IC3 will never directly communicate with individuals via phone, email, social media, phone apps, or public forums” and “will not ask for payment to recover lost funds.” Between December 2023 and February 2025 the FBI logged over 100 reports of scammers impersonating the IC3 itself.
Private companies cannot seize cryptocurrency. The FBI: “Private sector recovery companies cannot issue seizure orders to recover cryptocurrency.” No exceptions, however sophisticated the website looks.
One tactic worth knowing because it is so effective: scammers create fake personas who join online support groups for fraud victims, pose as fellow victims, and then recommend a “recovery expert” who supposedly helped them. If you join a support group after being scammed — and many people do — be sceptical of anyone who arrives with a recommendation. (FBI IC3 PSA, April 2025.)
Red flags, from the CFTC’s own list
You are asked to pay before any service is performed
There is no US physical address, or no phone number — and you are pushed onto Telegram or WhatsApp
They already know a suspicious amount about the money you lost
They use a web-based email address rather than an official domain
You are told the fee cannot come out of the recovered money, and is a “tax,” “retainer,” or “donation”
Cut-and-pasted logos, or grammatical errors in official-looking documents
How to check whether an official is real: genuine US government email addresses and websites end in .gov or .fed.us. Government agencies will never demand immediate payment and will never ask you to pay by wire, gift card, prepaid card, or cryptocurrency. If you are unsure, hang up and call the agency back on a number you find yourself on its official website.
But do not ignore genuine mail. When funds really are recovered, victims are usually notified by post. The CFTC’s advice: verify it independently through the agency’s or court’s own website — “It’s good to take precautions, but don’t ignore the letter. It could also be real.”
💬 An Honest Word About Getting It Back
You deserve a straight answer rather than false hope.
Cryptocurrency transfers are, in the FBI’s word, irrevocable — they cannot be reversed. The FTC puts it plainly: “Once you pay with cryptocurrency, you can only get your money back if the person you paid sends it back.” Once funds reach exchanges in other countries, the FBI notes it faces “significant challenges” following them.
So: if the money went out as crypto, the realistic chance of recovery is low. That is the truth, and anyone telling you otherwise while asking for a fee is telling you what you want to hear in order to take more.
Report it anyway. Three reasons it is still worth the hour it takes:
If a bank transfer was involved and you move fast, the kill chain genuinely does freeze money — 58% of the time in 2025.
Your report feeds investigations that stop the same operation reaching someone else. The FBI’s Operation Level Up has notified more than 8,000 people who were being defrauded at that moment, reducing losses by over $500 million.
Where assets are seized, restitution does reach victims — but only those who filed.
It Is Not Your Fault
One last thing, because shame is the reason most of this goes unreported.
In 2025, Americans aged 60 and over filed 201,266 complaints with the FBI and reported losing more than $7.7 billion — more than any other age group, averaging $38,500 each. Over 12,000 of them lost more than $100,000. (IC3 2025 Annual Report.)
These are not careless people. They are targeted by organised operations that do this professionally, full-time, with scripts refined on thousands of others. Being deceived by a professional deceiver is not a character failing.
Tell someone you trust, and make the call. 833-372-8311.
All figures and quotations on this page are sourced to the FBI’s Internet Crime Complaint Center, the FTC, and the CFTC, and were verified in July 2026. If you find anything here out of date, please tell us and we will correct it.