It starts with a simple phone call. On the other end of the line is someone who sounds “official”—calm, professional, and claiming to be from customer support.
They warn you about urgent “security updates” and guide you to change your API (application programming interface) settings. What feels like a routine safety check quickly turns dangerous.
Using spoofed numbers or voice-over-IP technology, scammers reach out with urgent warnings: “Your Binance account may be at risk. We need to adjust your API settings immediately to secure your funds.”
This is a new breed of phone impersonation scams sweeping through the crypto space in 2025. The scheme exploits one of the strongest weapons criminals can wield: misplaced trust. By posing as trusted representatives, they bypass natural skepticism and trick users into opening the gates themselves.
For many users, this story could sound believable. Binance is known for its focus on security, so the request makes sense. Trusting the caller’s authority, victims log in to their app or website and follow the instructions step by step, unknowingly opening the door to their funds for attackers.
Within hours, those small API adjustments yield major consequences. The scammers exploit the new permissions to initiate withdrawals, siphoning crypto straight into wallets they control.
API – a powerful tool designed for automated trading and account management. By manipulating victims into expanding API permissions, such as enabling withdrawal functions, attackers gain near-total control because these changes appear to come directly from the user’s own device, and they slip past initial security checks. On the surface, everything looks normal. In reality, the account is already compromised.
Binance’s risk experts are tracking this evolving threat closely, but awareness is your first and strongest defense. Here’s how to shield yourself from this and similar threats:
Activate Two-Factor Authentication (2FA): Enable 2FA or a hardware key to add an extra layer of security. This ensures that even if your API is compromised, withdrawals require additional verification.
Implement Passkey for Enhanced Security: Take it a step further by setting up Passkey, a phishing-resistant authentication method, to further strengthen your 2FA.
Verify All Communications: Never adjust API settings based on unsolicited calls or messages.
Secure Your API Settings:Review your API permissions. Restrict withdrawal access unless necessary, and rotate keys regularly to minimize exposure
Monitor Account Activity: Check your transaction history and device logins daily. Set up email or SMS alerts for withdrawals to catch unauthorized activity early.
Report Suspicious Calls: If you receive a questionable call, hang up immediately, note the number, and report it to our support team with details.
Use a Dedicated Device: Consider using a separate device or browser profile for Binance activities to reduce the risk of cross-contamination from other online interactions.
Pro Tip: If you’ve adjusted your API after a suspicious call, change your password, disconnect your device from the internet, and contact Binance support to revoke all API keys immediately.
Once again, the rise of fake support calls underscores a crucial truth: your vigilance is the strongest shield you have. By staying alert.