Scammers are running professional-looking “AML checker” websites that pretend to screen crypto wallets for suspicious activity, but are designed to trick people into connecting their wallet and approving a malicious transaction. Many impersonate a legitimate service (AMLBot) and use fake progress bars, errors, and “Clean, Low Risk” results to look trustworthy. The scam ultimately relies on the victim approving something they didn’t expect or understand.
Scammers built professional looking websites that pose as AML (anti-money laundering) checkers for crypto wallets. Many of these sites copy the branding, layout, and language of AMLBot, a legitimate screening service, to appear trustworthy. Visitors are invited to choose their cryptocurrency, click a Check Wallet button, and connect their wallet to see results. Rather than performing a genuine compliance check, the site is built to get the victim to approve a transaction that the scammers have crafted, which can drain funds once approved.
To make the process feel legitimate, these sites use progress bar animations with messages like Checking wallet history and Verifying compliance. Regardless of what happens during the process, the sites return a reassuring Clean, Low Risk result and often offer a downloadable report. Some variants add a fake error partway through, claiming the wallet needs a small top-up to cover a fee before the check can finish, pressuring the victim into sending crypto or approving further access.
This scam works because it borrows the visual and procedural trust signals of real compliance tools: familiar branding, progress indicators, and official sounding language. Users who are accustomed to legitimate KYC or AML checks may not question a request to connect a wallet, especially when the workflow looks polished. The reassuring Clean, Low Risk outcome regardless of input reduces suspicion at the exact moment users should be most cautious.
Teams that use crypto wallets, including finance, treasury, and payments staff, should treat wallet-connection requests from screening tools as a hard stop. A real basic wallet check only requires a public address, not a connected wallet or a signed transaction. Employees should be trained to never approve a transaction they do not understand, and to know the recovery steps if they do interact with a suspicious site: disconnect the site, revoke token permissions, or move assets to a new wallet if a recovery phrase or private key was ever shared.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They mimic legitimate AML screening services and push victims to connect their wallet, then trick them into approving a transaction crafted by the scammers rather than performing a real check.
If the site asks you to connect your wallet or approve a transaction instead of simply entering a public address, treat that as a warning sign since a basic wallet check only needs the public address.
Disconnect the site from your wallet and revoke any token permissions it may have obtained; if you shared a recovery phrase or private key, treat the wallet as compromised and move assets to a new one.
Some variants display a fake error claiming the wallet needs a small top-up to cover a fee, which is a pressure tactic designed to get victims to send funds or approve unauthorized access.
You land on an AMLBot look‑alike site that says: “Choose your cryptocurrency, click Check Wallet, and connect your wallet to get your results.” Looks legit, right? But this fake AML checker is built to drain your wallet. The moment you connect, it pushes a transaction you weren’t expecting, then shows a slick progress bar: “Checking wallet history… Verifying compliance…” before flashing a comforting “Clean, Low Risk” result. Here’s the tell: a real basic check only needs your public address. It never needs you to connect your wallet, approve anything, or pay a little 'top‑up fee' after some fake error to finish the scan or download a report. If any 'AML checker' asks you to connect your wallet or approve a transaction, stop right there, close the tab, and don’t approve anything you don’t fully understand.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
Researchers described an Android Trojan (“RatHat”) that starts with scam texts or malicious ads and tricks people into installing a fake app from a bogus download page. After installation, it pressures victims to grant Accessibility permissions using fake excuses or incentives, then uses those…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
