Bad grammar, odd formatting, a suspicious link. Every one of those signals has stopped working, and two of them now point the wrong way. Here is what phishing actually looks like this year, why checking the URL is no longer enough on its own, and the one thing attackers still cannot forge. Part of Know the Scam by SimpleSwap.
Consider how the most effective crypto phishing of 2026 reaches its victims.
You want to use a DEX. You search for it, the first result appears, you click it, and you land on a site that looks exactly right. Everything about that sequence feels safe because at no point did you click a link somebody sent you. You navigated there yourself.
That is the entire attack. Security researchers at SEAL have tracked threat actors running fake ads every week for more than a year, impersonating Uniswap, PancakeSwap, Morpho, Hyperliquid, CoW Swap, and Ledger. In a seventeen-day window in March 2026 alone, at least $1,274,259 was stolen. Uniswap was the most impersonated brand, accounting for 41% of detected malicious sites.
The clever part is the plumbing. Rather than pointing an ad directly at a malicious page, attackers route it through a page hosted on a Google-owned domain such as sites.google.com, which carries enough reputational weight to pass automated review. The ad is checked. The destination is not.
Why the old advice no longer works
For fifteen years, the standard advice was to look at the message. Spelling errors, awkward phrasing, generic greetings, a sender address that is slightly off. That advice is now actively misleading because it teaches people to trust a test that no longer detects anything.
The evidence for that is worth citing carefully, because this part of the industry is full of numbers with no method behind them. The most frequently quoted figure — that 82.6% of phishing emails now contain AI-generated content — comes from KnowBe4's 2025 threat trends report, which covers September 2024 to February 2025. Several security researchers have noted that it circulates without a fully transparent methodology, so treat it as a directional signal rather than a measurement.
The finding that does hold up is experimental. In a controlled study by Heiding, Schneier, and colleagues, fully AI-automated spear phishing achieved a 54% click-through rate, compared with 12% for generic phishing, matching the click-through rate of emails written by human experts. The sample was modest, with 101 participants across four groups, but the direction is clear: the machine now writes as convincingly as a skilled human, at a fraction of the cost.
Meanwhile, phishing kits sell for under $100 on criminal marketplaces, complete with templates, credential-harvesting pages and evasion tooling. Somebody with no technical ability can run a campaign that reads better than most corporate email.
So: no typos, correct branding, a believable tone, and details from whatever breach you were in. The message is no longer the obvious giveaway, which makes phishing the hardest crypto scam to teach people to spot, because the thing we told them to watch no longer gives the game away.
The technique that beats two-factor authentication
This is the part worth understanding properly, because it changes what "check the URL" protects you from.
Classic phishing shows you a fake login page. Adversary-in-the-middle phishing does something more elegant: the attacker runs a live proxy between you and the real service. You type your password into what is functionally the genuine login flow. Your two-factor code works because it is being relayed to the real site in real time. You get logged in. Everything succeeds.
What the attacker takes is not your password but your session token, the credential your browser holds that says you have already authenticated. With it, they no longer need your password or second factor.
This is now the center of gravity. In its Q1 2026 email threat report, Microsoft found credential phishing rose from 89% of payload-based attacks in January to 94% in March, while traditional malware delivery fell to 5 or 6%. The modern phishing economy runs on stolen logins and the session tokens attached to them, not on viruses.
Two-factor authentication remains worth having, but it is no longer a defense against this particular attack, and the line that matters is no longer between SMS and authenticator apps. A six-digit code from an app is as reliable as one from a text message, because anything you can read and retype can be passed to the real site while you are still looking at the fake one. Microsoft draws the same split in its own documentation, separating traditional MFA from phishing-resistant methods: passkeys and FIDO2 security keys, which are cryptographically bound to the domain on which they were registered and remain silent about any copy of it.
Where does it arrive from now?
Email is still the volume channel, but the interesting growth is elsewhere.
Search ads and SEO poisoning. Covered above, and the most dangerous because the victim's own initiative is what delivers them.
Physical letters. The surprise of 2026. Printed mail on branded letterhead, impersonating hardware wallet companies, announcing a mandatory authentication update, with a QR code leading to a cloned setup page that asks for the recovery phrase. Addresses for these campaigns come from exactly the kind of vendor breach we wrote about last week.
Calendar and cloud abuse. Google's own June 2026 advisory describes fake renewal notices injected directly into Calendar invites and phishing pages hidden inside "invisible pages" in cloud documents to bypass reputation-based filtering.
Voice. AI voice cloning needs a few seconds of audio, and spoofed caller ID does the rest. A call from support asking you to read back a code is now trivially cheap to produce.
Fake security prompts. A recurring construction is the security upgrade that is itself the attack: a notice about mandatory verification, a 2FA improvement, a wallet migration, each leading to a cloned interface that asks for the recovery phrase in the name of protecting it. The pretext is the inversion, and it works because it borrows the language of the advice people have already been given.
What is phishing actually after
Three different targets, and telling them apart determines the defense.
Your recovery phrase. The oldest and final version of this crypto scam. Cloned wallet interfaces prompt you to "restore," "verify," or "re-sync," and a phrase given up that way is a total, irreversible loss. What makes this one hard to teach is that a legitimate version of the screen exists: restoring or importing a self-custody wallet does mean typing the phrase into the wallet software, and MetaMask documents exactly that flow. The difference is not what the screen asks for, but who started the process. A restore you began yourself in software you installed is normal, and a prompt that arrived by any other route is an attack. Nobody outside your own wallet ever needs the phrase, least of all an exchange or a support agent.
Your login and session. The AiTM case above is aimed at exchange accounts rather than wallets.
Your signature. Not credentials at all, but an approval that lets a contract move your tokens later. We covered that mechanic in its own entry, and it is why a "sign this message" prompt deserves the same level of suspicion as a password field.
The one thing that cannot be forged
Here is where this lands, and it is oddly reassuring.
Attackers can now generate a perfect copy, clone any interface pixel-for-pixel, buy the top search result, proxy the real login page, and relay your second factor. Every signal you were trained to inspect has fallen.
What they cannot do is control how you arrived.
What actually holds up
Bookmarks, not search. Reach every crypto service through a bookmark you created once from a hand-typed address. This defeats search ads, SEO poisoning, and typosquatting in a single habit, and it requires no judgment in the moment.
Never act on inbound contact. Email, call, letter, calendar invite, DM. If something claims to need attention, go to the service through your own bookmark and check there.
Treat security warnings as the likeliest bait. Urgency plus a security pretext is the standard construction. Real providers do not announce mandatory upgrades that begin with your recovery phrase.
Use a second factor that cannot be relayed. Passkeys and FIDO2 security keys are tied to the real domain and refuse to authenticate against a proxy. Codes are the weak link here, whether they arrive via SMS or an authenticator app, so treat an app-based code as an improvement over SMS rather than as protection against this attack.
Type a seed phrase only into a restore you started. Open the wallet software you installed, choose to import or recover, then enter it. If the screen found you rather than the other way round, it is an attack, however right it looks.
Distrust QR codes on paper. A code in a letter is a link you cannot inspect before you follow it.
Where this meets your swap
Phishing is the pattern most likely to involve our name without involving us at all, which is why we would rather set out the rules than reassure you.
We will never message you first. Nobody here will ever ask for your recovery phrase, because a swap does not require one and never will. We do not announce mandatory security upgrades by email, letter, or calendar invite. And a standard exchange does not ask you to connect a wallet or sign anything.
Our only official domain is simpleswap.io. Anyone asking whether SimpleSwap is safe to use should start there, because most of what gets reported to us as a problem with the service turns out to be a page that was never ours. Type the address by hand once, bookmark it, and use the bookmark from then on. That habit is worth more than anything else on this page.
What comes next
Each entry above gets its own breakdown in "Know the Scam by SimpleSwap." Next up: clipboard hijackers, honeypot tokens, rug pulls, fake support, fake airdrops, drainer dApps, and recovery scams.
Follow #KnowTheScam to catch every new one as it drops.
This article is for educational purposes only and is not financial or security advice. SimpleSwap's only official domain is simpleswap.io.
