I was charged through Crossmint after a phishing scam or fake website

Last updated: September 21, 2026

If you entered your card details on a website you now believe was fake, and Crossmint charges appeared shortly afterwards, you have been targeted by a phishing scam. Crossmint did not create that website, but we want to help you limit the damage.

How this scam works

  1. You receive a convincing message, often about a real booking, delivery or account you have (for example a hotel reservation, a parcel, or a marketplace order).
  2. The link takes you to a copy of the real website that asks you to "confirm" your card, sometimes including a bank verification step.
  3. The scammer uses the details you entered to buy coins or stablecoins through an app that uses Crossmint for card payments. The coins land in a wallet the scammer controls.

Because the scammer completed the bank verification step with the codes you entered, the purchase looked legitimate to both the bank and Crossmint at the time.

What to do right now

  1. Call your bank immediately. Report the charges as fraud, ask them to block the card and issue a new one, and ask them to open a dispute (chargeback) for each charge. Your bank is responsible for the investigation and any refund.
  2. Change the password of the account that was impersonated (hotel, booking site, email) and turn on two-factor authentication.
  3. File a police report in your country. Banks and Crossmint can share transaction data with the police on request.
  4. Report it to Crossmint using the form below, with all the details listed.

Report it to us

Submit a support ticket here. Please send everything you have in your first message. Crossmint processes payments for many apps, and we can only locate a payment from the details you give us: an incomplete report means we have to write back and ask, which delays your case by days.

  • The link (URL) of the fake website and screenshots of the messages you received.
  • A screenshot of every charge from your bank or card app showing the exact date and time, amount and currency, and the statement description exactly as it appears (for example CROSSMINT* 1234). List all charges you are asking about, not just one.
  • The last 4 digits of the card and whether it is stored in Apple Pay or Google Pay (their receipts show a different card number than your physical card; that is normal).
  • Any email address, Apple ID or Google account that may have been used to sign up in the app.
  • Your Crossmint receipt email(s), if any, including the order ID on each one.
  • The app or website where the purchase was made, if you know it.
  • Your police report number, if you have one, and the dispute reference from your bank.
  • Contact details of your bank's fraud team, if they need to reach us.

Please never send your full card number, security code, passwords, one-time codes, private keys or recovery phrase. Everything else that could help the investigation is welcome.

What Crossmint will do

  • Confirm whether the charges came through Crossmint.
  • Review the account that made the purchases and the wallet that received the coins.
  • Keep the order records available for your bank or the police when they contact us.

We cannot reverse the purchase itself: coins are delivered on a public blockchain and Crossmint has no access to the scammer's wallet. Any refund comes through your bank's dispute process.

Please allow up to 10 business days for your bank to remove a pending hold. A hold for a payment that did not complete is released by your bank, on its own schedule (most release it within 3–10 business days). Crossmint cannot remove it, cancel it or speed it up: there is no captured payment on our side to refund. If it is still there after 10 business days, contact your bank; if your bank needs it, we can confirm in writing that nothing was captured.

How to avoid it next time

  • Never enter card details from a link in a message; open the website yourself.
  • A real bank verification step names the merchant. If it says "Crossmint" and you are not buying coins or tokens, stop.
  • Hotels and booking sites never ask you to re-confirm a card through a chat link.

Related Articles