Social Engineering

Social engineering is the art of manipulation. Instead of exploiting technical vulnerabilities, attackers exploit human ones — building trust, creating panic, or impersonating authority figures to get you to do something you otherwise wouldn't.

In the crypto space, this typically means convincing you to send your crypto assets to a wallet outside your control, share your credentials, or grant someone access to your account. What makes it particularly dangerous is that an attack can unfold over days, weeks, or even months before you realise anything is wrong.

Pretexting — The attacker creates a fabricated scenario to gain your trust, posing as an Ndax support agent, government official, or financial advisor.

Baiting — You're lured with something appealing — a free crypto offer, an exclusive investment opportunity, or a prize — in exchange for personal information.

Quid Pro Quo — The attacker offers a service in exchange for information, such as fake technical support that requests your login credentials to "fix" your account.

Relationship Building — The scammer invests real time establishing a genuine-feeling connection before introducing a request for money or access.

Authority Manipulation — The attacker impersonates a regulator, law enforcement, or senior Ndax staff to pressure you into acting quickly.

Scarcity and Urgency Tactics — Artificial deadlines or limited offers are manufactured to prevent you from thinking critically before acting.

• Someone you've never met in person quickly steers the conversation toward crypto or other type of investments
• An opportunity seems too good to be true, with promises of large or guaranteed returns
• Someone claiming to be from Ndax, a government agency, or law enforcement contacts you unexpectedly
• You're pressured to act quickly or told to keep the interaction secret
• A new contact asks detailed questions about your finances, crypto holdings, or account details
• You're asked to move funds to a "safer" wallet or "verified" account
• Someone offers to manage your investments or trade on your behalf

Example: You receive a message on Telegram from someone claiming to be an Ndax compliance officer. They say your account has been flagged and that you must transfer your funds to a temporary holding wallet within 24 hours to avoid suspension. The wallet belongs to the attacker.

No matter how convincing a message looks or how official someone sounds, Ndax will never:

• Contact you through Telegram, WhatsApp, social media DMs, or other unofficial channels
• Ask you to transfer funds to an external wallet for any reason
• Request your password, 2FA codes, recovery phrase, or private keys
• Pressure you to act immediately without time to verify
• Ask you to keep any communication confidential
• Ask you to install remote access softwares such as AnyDesk, TeamViewer etc.

If you're unsure whether a message is from Ndax, log in directly at ndax.io or contact support through the official website — never through links in the email.

• Slow down when someone creates urgency — legitimate organisations will always give you time to verify
• Contact Ndax directly through ndax.io before acting on any unsolicited request
• Never share credentials with anyone, regardless of who they claim to be
• Trust your instincts — if something feels off, pause and verify before proceeding

Stop all communication. Don't transfer any funds or share account information. Change your Ndax password if you've shared any details, confirm 2FA is active, and review your recent account activity. Contact Ndax support at ndax.io.

Stop all contact immediately. Do not send any funds, share information, or follow any further instructions from the person contacting you.

Change your Ndax password and any reused credentials. Confirm 2FA is active, review your recent account activity, and revoke any access you may have granted. If you transferred crypto from your Ndax account, contact [email protected] right away. Cryptocurrency transfers are generally irreversible, but your report may help us review the activity and protect other users.

If fiat funds, bank details, card information, or payment accounts were involved, notify the financial institution where the funds originated. Save all screenshots, conversation history, wallet addresses, transaction records, phone numbers, profile links, and URLs for reporting.
 

• Report to Ndax at [email protected] if your Ndax account was involved or crypto was transferred from your Ndax account
• Report to the CAFC at antifraudcentre.ca
• Report to the RCMP at reportcyberandfraud.canada.ca
• Notify the financial institution where the funds originated, such as your bank, card provider, or payment service provider
• Report fake profiles directly through the relevant social media, messaging, or dating platform