Crypto source of funds request: why exchanges ask and when it’s fake

Cryptocurrency exchanges may ask where your money came from before approving a transaction. Sometimes, it's a legitimate compliance check. Other times, scammers use the same language to steal your money or personal information. Here's how to recognize the difference and respond safely.

Key takeaways

• Legitimate crypto exchanges may request proof of source of funds to comply with anti-money-laundering regulations and verify how customers acquired their money or cryptocurrency
• Scammers impersonate exchanges or operate fake investment platforms, using supposed compliance checks to demand additional payments, sensitive documents or access to cryptocurrency wallets
• Requests for withdrawal taxes, verification deposits or payments to external wallet addresses are major warning signs, especially if someone claims your funds will remain frozen until you pay
• Verify the request directly through your exchange’s official website or app before uploading financial documents, transferring cryptocurrency or sharing personal information

Why do crypto exchanges ask for source of funds?

Source of funds (SOF) means the origin of the money or cryptocurrency involved in a transaction. Source of wealth describes how someone accumulated their assets overall. Both support anti-money-laundering (AML) checks and do not automatically imply wrongdoing.

Exchanges may request payslips, bank statements, tax records, inheritance documents or transaction histories from other exchanges. Kraken and Coinbase publish examples of accepted documents. A wallet transaction record shows how cryptocurrency moved, not necessarily how it was originally acquired. Ask whether unrelated sensitive information may be redacted.

How a fake crypto source of funds request works

On fraudulent trading platforms, apparent profits grow until someone requests a withdrawal. An alleged compliance officer then demands a verification deposit, AML clearance fee or tax payment in Bitcoin. The FBI documents this pattern, including small early withdrawals designed to establish trust. The displayed balance may be fictional, and paying more won't release it.

Other criminals impersonate genuine exchanges, linking to counterfeit sign-in or document-upload pages to collect financial details, passwords or wallet access. Some direct people to cryptocurrency kiosks using QR codes—a payment tactic documented by the FTC.

For more on invented withdrawal charges, see our guide to fake trading platform withdrawal fee scams.

What are the warning signs?

• An unexpected WhatsApp, Telegram or email request with no corresponding account notice
• A new deposit or withdrawal tax payable to an external cryptocurrency address
• Threats, secrecy or instructions not to contact official support
• Demands for a recovery phrase, private key, login code or remote device access

A withdrawal delay alone doesn't prove fraud. Legitimate exchanges can hold transactions for review, as Kraken's support documentation explains.

How to verify a crypto source of funds request

Visit the exchange directly through its official app or bookmarked website, never the supplied link. Ask verified support whether the request is genuine, why it arose and where documents should be uploaded. Compare the requirements with the exchange's published guidance.

UK users can check the FCA Firm Checker and EU users can consult ESMA's MiCA register. Neither listing guarantees investment safety.

Never transfer cryptocurrency to unlock a withdrawal or disclose wallet recovery phrases. Genuine tax obligations are handled through the appropriate tax authorities.

What if you've already sent documents or cryptocurrency?

Stop transfers and contact the genuine exchange and, if applicable, your bank. Preserve messages, URLs, wallet addresses, receipts and transaction IDs using our scam evidence checklist.

Change exposed passwords, review account sessions and scan devices if you have downloaded suspicious software. If a wallet recovery phrase has been disclosed, seek trusted wallet-provider guidance on moving remaining assets into a new wallet.

Report suspected fraud to local authorities. In the US, use the FBI's Internet Crime Complaint Center. Avoid paid recovery agents who promise guaranteed refunds, and follow our scam recovery timeline for additional steps.

How Bitdefender can help

Bitdefender Scamio can examine suspicious messages, links and QR codes; avoid submitting sensitive financial documents to it. Bitdefender Ultimate Security provides anti-phishing protection, while Bitdefender SecurePass helps generate and store unique passwords.

If personal information has been exposed, Bitdefender Digital Identity Protection monitors digital footprints and reported breaches. Bitdefender Security for Creators is relevant when criminals target creators' YouTube, Instagram or Facebook accounts to promote cryptocurrency scams.

These tools cannot verify investment balances or recover stolen cryptocurrency.

Conclusion

A crypto source of funds request can be routine. A demand for additional payments or wallet secrets is a serious red flag. Verify every request independently before responding.

Frequently asked questions (FAQs)

Is crypto a source of income?

Yes, cryptocurrency can represent income if you're paid in it or earn it through mining, staking or similar activities. Buying and holding cryptocurrency is not itself income. Selling or exchanging crypto can also create a taxable gain, depending on your country and circumstances. Income and investment gains may be taxed differently.

Why would someone ask to be paid in Bitcoin?

Bitcoin can be a legitimate payment method, including for international transactions. Criminals also favor it because payments are generally difficult to reverse. Be particularly suspicious when someone insists on Bitcoin to pay a fine, verify an account or release supposedly frozen profits. A crypto-only payment demand combined with urgency is a major warning sign.

Why is crypto a red flag?

Cryptocurrency itself is not proof of a scam. The warning arises from how it's being used: a stranger guarantees returns, pressures you to pay exclusively in cryptocurrency or claims another transfer will unlock your balance. These tactics resemble established financial scams, especially when the recipient or platform can’t be verified independently.

Do I have to report crypto income?

It depends on your tax residence and transactions. In the US, the IRS requires reporting of taxable digital-asset income and gains. UK rules can require reporting of crypto income and gains from disposals. EU countries apply national tax rules, so consult your local tax authority.