Fake AML checkers: the scam that asks you to connect your wallet

Fake AML checkers are scam websites that pose as crypto anti-money-laundering services. They ask you to connect your wallet "to run the check", then trick you into approving a transaction that gives them your tokens. A real AML check needs only the public address. If a site asks you to connect a wallet, approve, sign or pay a fee, it is not an AML check.

Security company Malwarebytes described the scheme in August 2026. The same template appears under many names and logos, often copying the look of well-known AML services.

How the scam works

1. You get a link. Often a trading partner asks you to "prove your funds are clean" on a specific site. Other links come from ads, social media posts or search results.
2. The site looks professional. It copies the logo, layout and wording of a real AML service.
3. You pick a coin and press "Check wallet". Instead of asking for an address, the site asks you to connect your wallet.
4. A fake check runs. A progress bar shows messages like "Checking wallet history" and "Verifying compliance".
5. Something "goes wrong". An error asks you to top up a small fee or confirm a transaction to continue.
6. You approve. The request is really a permission for the scammer to move your tokens, or a direct transfer to them.
7. You get a clean report. The site shows "Clean, low risk" and even offers a downloadable report, whether or not anything was checked.

Why "connect your wallet" is the red flag

Connecting a wallet tells the site your address and what you hold. That alone does not move funds, but it lets the site prepare a transaction tailored to your wallet and put it in front of you.

The dangerous step is the approval. On Ethereum, TRON and similar networks, a token approval lets another address spend your tokens, sometimes without any limit. One wrong click on "Approve" and the scammer can take your USDT later, without asking again.

An AML check is a lookup. It reads public data about an address. It never needs your signature.

A real check starts with an address field, not a Connect wallet button.

Real AML check or fake?

Already connected or approved? What to do now

• You only connected. Disconnect the site in your wallet's list of connected sites. Do not approve anything it asks for later.
• You approved a token. Revoke the approval as soon as possible. Use your wallet's permissions screen or an approval checker for your network, such as Revoke.cash for Ethereum and other EVM networks. Revoking costs a small network fee.
• You signed something you did not understand. Check your recent activity on a block explorer. If anything moved, send your remaining funds to a new wallet.
• You entered your seed phrase. Treat the wallet as lost. Create a new wallet with a new seed phrase and move everything at once.
• You downloaded a "report". Do not open it. Delete it and run a malware scan.

Then report the site to your wallet provider and, in the U.S., to the FBI at ic3.gov. Be wary of anyone who offers to recover the funds for a fee.

How to check a wallet safely

Use a tool you found yourself, not one a counterparty sent you. Paste the address. Read the result. That is all a real check involves. Our guide explains how a crypto wallet AML check works and how to read the score.

Web3 Copilot is built this way:

• No wallet connection, no signatures, no seed phrase. The extension only reads public blockchain data for the address you check.
• Install it only from the Chrome Web Store. Use the link on this site. Check that the publisher and the name match.
• No fees in crypto. Web3 Copilot is free. It will never ask you to send crypto to unlock a report.
• Honest results. The AML and sanctions card shows each source separately and says what was not checked, so a missing check never looks clean.

For other common tricks, see how to check if a crypto address is a scam.