9 types of fake USDT scams and the tell that kills each one

“Flash USDT” is the famous one, but it is a single species in a large family. Nine variants are actively circulating. Each attacks a different assumption, and each has exactly one tell that kills it.

1. Counterfeit token contract — the classic flash USDT

A token contract is deployed with the name Tether USD and symbol USDT, for about two dollars on BNB Chain. The attacker mints themselves a trillion and sends you some. Your wallet displays “USDT” because it reads the name straight from the contract.

2. Zero-value transfer and address poisoning

The attacker generates a wallet whose address begins and ends with the same characters as one you regularly send to, then pushes a zero-value or dust transfer into your history so their lookalike appears in your recent transactions. Later, you copy the address from your own history and send real funds to them.

3. The unconfirmed or dropped transaction

A transaction is broadcast with a gas price far too low to be included. For a few minutes it shows as “pending” — enough for a screenshot, enough to pressure you into releasing goods or fiat. Then it is dropped from the mempool and vanishes as if it never existed.

4. The modified wallet app

A repackaged wallet APK, distributed via Telegram or an APK-mirror site, patched so the balance screen renders a hardcoded number. The user genuinely believes they hold 50,000 USDT. Nothing was ever on-chain.

5. The spoofed RPC endpoint

A “support agent” walks the victim through adding a custom network — a helpful-sounding “faster node”. That RPC URL is attacker-controlled and returns fabricated balance and transaction responses. Every screen in the wallet lies consistently.

6. The cloned block explorer

A pixel-perfect copy of a real explorer on a typo domain. The counterparty sends you a link to “verify” their payment, and the clone renders whatever transaction they invented as fully confirmed, with the correct USDT contract shown.

7. The honeypot token

A token whose transfer function contains a hidden condition — only allowlisted addresses can send. You can receive it, and your wallet shows a real balance with a real price. You can never move it. Some variants allow one small successful transfer to build confidence before locking you out.

8. AML and unlock-fee fraud

After a “deposit” arrives, a message claims your funds are frozen pending AML verification, or that a gas fee is needed to unlock them. You pay. Nothing releases. A second, larger fee is demanded. It targets people who already believe they hold a large balance — usually victims of variants 1 or 4.

9. Fake OTC desks and wrong-network bait

An “OTC desk” or “premium buyer” offers a rate 8–12% above market. Once you are engaged they either take the first transfer and disappear, or claim your funds “went to the wrong chain” and require a recovery fee.

The one rule underneath all nine

Every variant depends on you trusting a representation of a payment — a name, a screenshot, an app screen, a webpage, a promise — instead of the payment itself. Verify the settled on-chain fact from a source the counterparty does not control, and the entire family stops working.