Bybit scams: what is always fake, and how to check the rest
Checked on against five Bybit help pages and its Authenticity Check page. See the sources. Ahead is a Bybit affiliate: how we make money.
Short answer
If someone contacts you first and says they’re from Bybit, treat it as a scam until you’ve checked. Bybit says it will never ask you to transfer assets to an unknown deposit address or ask for your wallet recovery phrase.1
Check any email address, phone number or link on Bybit’s Authenticity Check page before you act on it.2
On this page
Requests that are always a scam
- “Send your coins to this address to verify your account.” Or to unlock it, upgrade it or keep it safe. Bybit says it never asks you to transfer assets to an unknown deposit address.1
- “Tell me your recovery phrase.” Bybit says it never asks for that either.1
- “I’ve paid. Release the crypto and the money will arrive.” On P2P, Bybit’s rule is not to release until you see the funds in your own account, and never to rely on a screenshot.4
Our own rule goes one step further than Bybit’s wording: don’t give a password, a verification code or a photo of your ID to anyone who messages you, whoever they say they are.
How scammers reach you
| Route | What Bybit says about it |
|---|---|
| Emails and texts | They aim to provoke rash decisions. A sender’s address can be forged to look real1 |
| Links | Shortened links can hide the real address. Don’t click unknown third-party links1 |
| Attachments | Files with double extensions look harmless and run malicious code1 |
| People posing as Bybit staff | On “any website, email, social media, or messaging app”1 |
| Telegram and WhatsApp during a P2P trade | Scammers move the conversation off Bybit. Its rule: “Use Bybit’s chat only — never use Telegram, WhatsApp, or other apps.”4 |
| Giveaways | Avoid suspicious links and Telegram or WhatsApp offers4 |
How to check whether something is really Bybit
- Open Bybit’s Authenticity Check page. Bybit also links it from the website footer and from the live chat icon in the app.1
- Type in the phone number, email address or link you were given, and select Search.2
- If it isn’t recognised, stop there. You can report it from the same page.1
One limit: because a sender can be forged, Bybit warns that a result from the checker doesn’t necessarily mean the message was truly sent from its official mailbox.1 That gap is what the anti-phishing code covers.
Set an anti-phishing code
It’s a code only you know. Once set, it “will be displayed in all official emails and SMS messages from Bybit”.3 Bybit calls a missing or incorrect code a strong indicator of a fraudulent message.1
- Log in and select Account.3
- Select Anti-phishing Code. Or open Security and select Settings under Anti-phishing Code.
- Type the code you want and select Confirm.
- Complete the security verification and select Confirm again.
Settings that limit the damage
| Setting | What it does |
|---|---|
| Google two-factor authentication | Adds a second verification step to your account. Set up in step 4 |
| Passkey | Verifies you with the biometrics stored on your device |
| Fund Password | A separate password, required for security verification and withdrawal requests |
| New Address Withdrawal Lock | Stops a newly added withdrawal address from being used for 24 hours |
| Trusted devices | Lets you review the devices allowed into your account and remove one you don’t recognise |
Switch these on while you have no withdrawal planned. Bybit pauses withdrawals for 24 hours after some of them change, including switching the address lock on or off, changing a Fund Password, removing a passkey, and disabling Google Authenticator.6
If you think you’ve been scammed
- Report the contact on the Authenticity Check page, or reach Bybit support through live chat or its web form.1
- If stolen assets have flowed into Bybit, use the Report Stolen Funds option.1
- For a phishing email, save the message as an .eml file and send it to support.1
- For a P2P order, file an appeal from the order page as soon as possible and upload your evidence.4 How P2P appeals work.
Our advice: change your password from a device you trust. Expect the 24-hour withdrawal pause that follows.6
Questions people ask
How do I know if a message is really from Bybit?
Check the sender’s email address, phone number or link on Bybit’s Authenticity Check page,2 and set an anti-phishing code so that official Bybit emails and texts carry it.3
Will Bybit ever ask for my recovery phrase?
No. Bybit says it will never ask for your wallet recovery phrase, or ask you to transfer assets to an unknown deposit address.1
What is the Bybit anti-phishing code?
A code you choose that Bybit then displays in its official emails and SMS messages.3 Bybit calls a missing or incorrect code a strong indicator of a fraudulent message.1
How do I report a Bybit scam?
Use the Report option on the Authenticity Check page, or contact support through live chat or the web form. If stolen assets have flowed into Bybit, use Report Stolen Funds.1
What we couldn’t confirm
- Whether Bybit staff ever contact users first. The pages we read don’t say, which is why our rule is to check every time.
- A list of Bybit’s official email addresses. Its phishing guide doesn’t give one; it points to the Authenticity Check instead.
- Fake apps. The pages we read don’t cover them. If you’re unsure about a download link, run it through the Authenticity Check.
Still inside your first 14 days?
Signed up in the last 14 days without a code? You can still add an affiliate code, as in step 2. This is ours.
Open Bybit sign-up with our link
Bybit pays us a commission from the trading fees it collects. It adds nothing to yours. Not for residents of the United States, Canada, the United Kingdom, the European Economic Area, Singapore, Hong Kong, mainland China, Malaysia, Türkiye or other restricted places: full list. Crypto contracts can lose your entire margin. Not financial advice.