How do you buy crypto safely for the first time?

Treat a match as a minimum, not a seal of approval. FinCEN says inclusion on its site is "not a recommendation, certification of legitimacy, or endorsement," and that it doesn't verify what registrants submit. The CFTC adds that registration alone won't protect you from fraud, but most scams involve unregistered firms.

Also look at how the firm holds customer assets. A proof of reserves report helps, though it can't prove an exchange is solvent. Rules differ outside the US, so check your own country's regulator.

Step 2: Verify your identity and lock down the account

A regulated exchange will ask for your legal name, address, date of birth and a photo ID. This is KYC, short for know your customer, and it's part of anti-money-laundering rules. A platform that lets you deposit large sums with no checks at all is a warning sign, not a convenience.

Before you deposit anything:

1. Type the address yourself or use the official app from your phone's app store. Don't follow links in ads, texts or emails.
2. Use a unique, long password stored in a password manager.
3. Turn on two-factor authentication with an authenticator app or a hardware security key. Text-message codes are weaker because of SIM swapping.
4. Turn on withdrawal address allowlisting if the exchange offers it, so new addresses need extra approval.

Real support staff never need your password or two-factor codes, so anyone who asks for them is not support.

Step 3: Understand the full cost before you buy

The price you pay has more parts than the advertised fee. A spread is the gap between the price you pay and the market price, and some "zero-fee" buys build the cost into it. Funding method, order type and withdrawal fees all add to the total.

Here is a worked example with illustrative numbers, not any real platform's fees. You want to spend $500 on bitcoin when the market price is $100,000.

The "no fee" option costs more here. Ask the platform to show the amount of crypto you'll receive before you confirm. That number is the only honest comparison.

Then look at the exit. Some platforms charge a flat fee to withdraw coins, and moving them on-chain also costs a network fee, explained in what gas fees are. Buying with dollars isn't usually a taxable event in the US, but selling, swapping or spending later can be, as covered in how crypto is taxed in the United States.

How do you spot a scam before it costs you?

Most red flags are about pressure and promises, not technology. The CFTC's list of scam trading site signs includes:

• Someone you met online introduced it. The CFTC says that if a stranger leads you to a platform you've never heard of, "chances are it's a fraud."
• Returns grow with your deposit. "Investment plans" promising 50%, 100% or more are a ploy. There are no guaranteed returns in crypto.
• It won't accept a bank transfer. Scammers often walk victims through buying crypto on a real exchange first, then ask them to send it to the fake site.
• The website is newer than its story. A domain registered weeks ago that claims years in business is a fake.
• No address or phone line. Fake platforms often offer only chat, email or a messaging app number.

Two more patterns are worth naming. Crypto ATM scams reported $389 million in losses in 2025, and $257 million of that came from people aged 60 and over, according to the FBI report. If anyone tells you to pay a bill, a fine or the "government" through a crypto ATM, it's a scam. Recovery scams target people who already lost money, promising to get it back for a fee. Those reported $1.4 billion in losses, though the FBI notes that figure may include the earlier losses.

What protections do you not have?

Crypto at an exchange isn't protected like money in a bank or a brokerage account. Knowing the gaps tells you how much to keep there.

• No FDIC insurance. The FDIC says deposit insurance does not cover crypto assets and doesn't protect against the failure of any non-bank, including crypto exchanges and wallet providers.
• No SIPC coverage for most coins. SIPC does not protect any crypto asset that doesn't qualify as a security.
• No chargebacks on-chain. Card and bank payments have fraud processes. Blockchain transfers are final once confirmed.

Which agency polices which part of the market is covered in who regulates crypto in the US.

Step 4: Decide whether to move to self-custody

Leaving coins on an exchange is custodial: the company holds the private keys and you hold a promise. Self-custody means your own wallet holds the keys, so no company failure can freeze your coins, but every mistake is yours. The full comparison is in custodial vs. self-custody wallets.

If you move coins out, do it in this order:

1. Set up the wallet and back up the recovery phrase on paper, offline. Never type it into a website or share it, as explained in how to keep a seed phrase safe.
2. Copy your receiving address from the wallet, not from an old message or your transaction history.
3. Pick the right network. The exchange will ask which network to send on. It must match what your wallet expects, or the funds can be lost.
4. Send a small test amount first. Confirm it arrives, then send the rest.
5. Check the whole address, not just the first and last characters. Look-alike addresses are a known trick, described in address poisoning.

For larger amounts, a hardware wallet keeps keys off your everyday computer. Once you're using a wallet, read up on wallet drainers before you connect it to any app.

A short checklist before your first buy

Run through this before you send money anywhere:

1. I found the platform myself, not through someone who contacted me.
2. I checked its federal and state registrations.
3. My account has a unique password and app-based two-factor authentication.
4. I know how many coins I'll receive after the spread and fees.
5. I'm only spending money I could lose entirely.
6. I know where I'll keep the coins and how to back up the keys.

If something feels rushed, stop. Report suspected fraud to the FBI at IC3.gov, the CFTC or the SEC. More guides are in our security hub, and our Bitcoin hub explains the original cryptocurrency. Rules and protections vary by country and state, so ask a qualified professional about your situation.

Key takeaways

1. Crypto investment fraud was the largest loss category in the FBI's 2025 report, so never use a platform someone else steered you to.
2. Check a platform's FinCEN and state registrations, but treat them as a minimum, not an endorsement.
3. Compare the amount of crypto you receive, because spreads can make a "no fee" purchase cost more.
4. Crypto at an exchange has no FDIC insurance and usually no SIPC protection.
5. When moving to self-custody, back up the recovery phrase offline, match the network and send a test amount first.

Sources

• FBI: 2025 IC3 annual report
• CFTC: 10 signs of a scam crypto or forex trading website
• FinCEN: MSB registration website
• NYDFS: virtual currency businesses
• FDIC: deposit insurance and crypto companies
• SIPC: what SIPC protects

What's the difference between a coin and a token?

A coin is the native asset of its own blockchain and pays that network's fees, like BTC or ETH. A token is created by code on an existing chain, like USDC on Ethereum. Learn how each works, why tokens need gas, and what issuer powers to check.

#basics#tokens