Scam watch: the fake Binance email that asks you to 'review' your account

A fake Binance email is doing the rounds with the subject "Account Information Review — Action Requested". It borrows Binance's layout, logos and risk warning. Binance did not send it and is not involved. It is a phishing email built to steal crypto exchange logins.

What the email looks like

The sender's name reads "Biance", with the "n" missing. The address behind it is on a random .com domain that has nothing to do with Binance.

The message is short. It says a "Security Department" has found that your account details "have remained unchanged for an extended period" and now need a review. It warns that delays "may affect your ability to continue using certain account services". Then comes a "Review and Update" button.

Underneath sits text copied from real Binance emails, including a note to "be aware of phishing sites". The copyright line still says 2025.

Two details make it look convincing. The pictures load from Binance's own image server, so the logos are real. And the email passes DKIM, one of the basic checks mail systems run. That check only proves the email came from the throwaway domain that signed it. It says nothing about Binance.

How the scam works

1. The email goes to a long list of addresses, Binance users or not.
2. Every link in it, even the "Terms of Use" and "Privacy policy" links in the footer, leads to the same unrelated web address ending in .live. Nothing points to binance.com.
3. Links like this lead to a copy of the Binance sign-in screen, which asks for an email address and password.
4. Kits like this often ask for the 2-step code next. Security firm Lookout studied one crypto phishing kit that targeted Binance and Coinbase users. The criminals were most likely trying each stolen login on the real site straight away, then showing the victim whichever code page the real site asked for, such as a text message code or an authenticator app code. That way the one-time code is used before it runs out.
5. Once they are in, they try to move the money out.

How the scammers make money

They empty the account. Crypto moves fast, and a crypto withdrawal cannot be called back the way a card payment can. The thieves send the coins to wallets they control and pass them through other services to hide the trail before cashing out. Blockchain analysis firm Chainalysis counted 158,000 cases of personal wallet theft in 2025, hitting at least 80,000 different victims.

They sell the account. An exchange account that has already passed identity checks is worth money on its own, because the buyer gets a ready-verified account in someone else's name. The 2023 Dark Web Price Index from Privacy Affairs, as reported by Protos, listed a verified Binance account at $410, up from $250 the year before.

They come back for a second bite. People who lose money are often contacted again by "recovery" firms that promise to get it back for an upfront fee. The FCA warns that the people behind the first scam may run the recovery scam too, or sell the victim's details to others who do.

How to spot it

• The name says "Biance", not Binance.
• The sender's address is not a binance.com address.
• The button does not go to binance.com. Hover over it on a computer, or press and hold on a phone, to see where it really goes.
• Vague pressure with no real reason.
• The copyright year is out of date.
• There is no anti-phishing code. Binance lets users set a personal code that appears in every genuine Binance email. An email without it is likely fake.
• Binance Verify, a search tool on the Binance website, checks whether an email address or link really belongs to Binance. Binance says a pass is not a full guarantee, as sender addresses can be faked.

How to protect your business

This matters for any business that holds crypto, takes crypto payments or has staff with exchange accounts.

• Never sign in from a link in an email. Open the app, or type binance.com yourself. Any real request will show up there.
• Turn on the anti-phishing code for every exchange account the business uses.
• Use the strongest 2-step sign-in on offer. A passkey or security key is tied to the real website, so a fake page cannot reuse it the way it can reuse a typed code.
• If the exchange lets you limit withdrawals to approved wallet addresses, switch that on.
• Check the account's API keys. Delete any that are not in use, and do not give withdrawal rights to keys that do not need them.
• Keep business crypto in accounts that only named people control.
• Show your team what this email looks like, and forward suspicious emails to [email protected], the National Cyber Security Centre's reporting service.

If you clicked, replied or paid

1. If you typed your password: open the Binance app or website yourself, change the password, and reset your 2-step sign-in. Change it anywhere else you used it, starting with your email.
2. If you think someone got in: disable the account straight away. In the Binance app this is under Account Info, Security, Manage Account, Disable Account. Then contact Binance Support through the app or website, and check recent log-ins, devices, withdrawals and API keys.
3. If money or coins have gone: write down the times, amounts and transaction IDs. Report it at reportfraud.police.uk, the national fraud reporting service for England, Wales and Northern Ireland, or to Police Scotland if you are in Scotland. If you also paid by card or bank transfer, contact your bank at once.
4. Ignore anyone offering to get your crypto back for a fee. Check any firm on the FCA register before dealing with it. The FCA says it would never suggest that people pay to recover lost money.
5. Report the email. Forward it to [email protected], then delete it.

If an email cannot even spell the company's name, close it and sign in the long way.