Is a crypto exchange asking me to re-verify my identity by email a scam?
Phishing emails impersonating crypto exchanges with KYC (know your customer) verification requests are very common. Always log in to the exchange directly — never upload documents via an email link.
Last reviewed: 1 August 2026
Explanation
KYC phishing targets crypto exchange users who are accustomed to periodic identity verification requirements. A fraudulent email claims your account will be restricted unless you resubmit your identity documents through a link. The link leads to a fake exchange login page or document-upload portal. Uploading your identity documents to a fake site results in identity theft — your documents may be used to open accounts in your name, commit financial fraud, or be sold. Real KYC requests from exchanges appear inside your account dashboard after you log in directly. If an exchange genuinely needs updated verification, the request will be visible in your account and any document upload will happen through the exchange's secured platform — not via a link in an unsolicited email.
Identity documents are the real prize here. A scanned passport or driving licence paired with a selfie is enough to pass verification checks at other financial services, which means a successful KYC phish can turn into accounts opened in your name months later. That delayed harm is why this scam is more serious than ordinary password phishing.
Build one habit and this whole category fails: never act on account warnings through the message that delivered them. Open the exchange's app or type its address yourself. If nothing in your dashboard asks for verification, the email was fraudulent — and if something genuinely does, you will have completed it through the real site.
Common red flags
- Email asks you to upload ID documents via a link rather than inside your account
- Link goes to a domain that differs from the exchange's known address
- Email threatens account suspension within 24-48 hours
- Sender email address is not from the exchange's official domain
What to do now
- Do not click the link or upload any documents
- Log in directly to the exchange and check your account for genuine verification alerts
- If you uploaded documents, report identity fraud to your national fraud service
- Place a fraud alert on your credit file if documents were compromised
Frequently asked questions
Do exchanges ever email KYC requests?
Some exchanges send notification emails about upcoming verification requirements, but genuine requests direct you to log in to your account on their official site — they never include a document upload link directly in the email.
What can criminals do with my ID documents?
Stolen identity documents are used to open bank and crypto accounts, apply for credit, and pass verification at services you have never used. They also circulate for resale, so problems can surface long after the original phishing email.