Fake AML Checker Scam Exposed: How Wallet Checks Turn Into Crypto Theft

A wallet check sounds like a sensible precaution before moving crypto. The page promises a quick answer, and the security language feels reassuringly familiar.

Then another prompt appears. Before you follow it, take a closer look at what the website is asking your wallet to do.

Overview

A security check becomes the excuse for wallet access

The fake AML checker scam uses a protective-sounding task to draw people toward a dangerous authorization. AML means anti-money laundering, not permission to spend your assets.

A public wallet address can be checked without handing over control of that wallet. Reading information and authorizing an action are different jobs.

This distinction matters more than the logo above the form. A website describing itself as a compliance service still needs to justify every request it makes.

The real AMLBot is being impersonated

AMLBot warns about cloned platforms and says its screening does not require connecting your wallet. The legitimate business is not the attacker.

A familiar name copied into an unfamiliar web address does not carry that business’s authority. Neither does a matching color scheme or a realistic-looking dashboard.

Be particularly suspicious when the supposed check starts asking for:

• Permission for an unfamiliar contract to spend tokens.
• A payment to clear a warning or unlock a result.
• Your recovery phrase, private key, or wallet password.
• Repeated confirmations without a clear explanation of their effects.

The next action depends on what you actually approved

Opening a page, connecting an account, approving token access, and sending funds are not interchangeable events. They leave different things to investigate.

Start with the last action you remember. Did you only select an account, or did another screen ask you to sign, approve, or send?

You do not need to guess from the website’s final message. Your wallet’s activity and the relevant blockchain records are better places to establish what happened.

Why a Public Address Is Not a Recovery Phrase

Think of the question you meant to ask: does this address have a concerning transaction history? That is a question about records, not spending authority.

A public address identifies an account on a network. Sharing it for a lookup does not, by itself, disclose the secret that controls that account.

It can still reveal financial information associated with the address. Public does not mean anonymous, especially when you link that address to your name or conversation.

Your recovery phrase is different. It is a secret that can restore wallet access. An individual account’s private key is also sensitive, not a compliance identifier.

Ethereum’s wallet-security guidance explains that these secrets must never be shared. A person offering help does not acquire an exception.

If a form asks you to import a wallet to inspect its history, stop. You wanted a report, not to give someone the means to act.

Keeping these categories separate also prevents unnecessary panic. Someone knowing your address is not the same situation as someone knowing your recovery phrase.

How the Fake AML Checker Scam Works

Step 1: Borrowed branding makes the check look routine

The page presents itself as a place to verify crypto funds. Some copies use AMLBot branding; others adopt generic AML-checking names.

The setting does much of the persuasion. Instead of offering an unbelievable prize, it offers reassurance about money the visitor already owns.

That changes the visitor’s expectations. A person who would reject a random investment offer may patiently follow instructions that appear designed to reduce risk.

A professional layout can make the process feel established before any meaningful evidence has been supplied. The page’s appearance becomes a substitute for checking its origin.

Step 2: The site learns which wallet is in front of it

A public address or wallet connection can tell the operator which account to target. Malwarebytes documented fake checkers that used this information to tailor a request.

A basic connection is not a transfer. The dangerous assumption is that every later request belongs to the same harmless lookup.

The user may think they are continuing one task. In reality, the next prompt can ask for a different kind of authority altogether.

This is where a familiar workflow becomes useful to the impersonator. Recognizing your own wallet application can make an unfamiliar website seem safer than it is.

Step 3: A progress screen gives the visitor a reason to continue

One documented version staged progress messages, a supposed need to top up funds, and a reassuring low-risk result. Those displays did not establish a genuine analysis.

The interruption creates unfinished business. The visitor has already begun the check and now sees a small obstacle between them and an answer.

A fee request framed as a technical requirement can feel less suspicious than an outright demand for money. It still needs an independent explanation.

Nothing about an animated status bar proves the operator has done the work it describes. Waiting longer does not turn a display into verification.

Step 4: A wallet prompt substitutes permission for checking

The crucial change happens when the visitor is asked to authorize something. The page’s promise concerns information; the wallet request may concern control.

For example, a token-spending permission gives a specified spender authority over the permitted tokens. That is not the same thing as inspecting a public transaction record.

The label on the webpage cannot rewrite the effect of the request. A button called verification can still lead to an authorization you did not intend.

An approval can matter even before assets move. Permission and its later use are separate events, so an unchanged balance is not sufficient reassurance.

Step 5: The attacker can use the permission to move tokens

Once a malicious spender has a valid token allowance, it can move the covered tokens without requesting a fresh signature for each transfer.

The scope is the allowance actually granted, not every unrelated asset. A basic connection alone does not provide that spending authority.

The permission may be used after the visitor leaves. A reassuring result can distract them from that continuing exposure.

It does not mean every visitor loses funds. The draining stage depends on the authorization granted and whether the attacker successfully uses it.

What an Approval Actually Allows

Not every token approval is fraudulent. Uniswap explains that approvals are used for legitimate swaps and liquidity actions.

The question is whether the permission belongs to an action you intended, with a service you independently verified. A security-sounding page cannot answer that for you.

The token, spender, and amount belong together

When reviewing an allowance, identify the asset, the contract permitted to spend it, and the permitted amount. Do not rely on a friendly name alone.

A hypothetical example helps: you intend to inspect one address, but a request authorizes an unfamiliar spender to use a token balance. Those purposes do not match.

Even a small allowance needs a reason. Reducing a suspicious request from unlimited to a smaller amount does not make the destination trustworthy.

Likewise, one token allowance is not proof that every unrelated asset can be taken. The exact permission determines its scope.

Network and asset type change the review

The ENS approval guide notes that permissions are network-specific. A review on one chain does not cover your activity on every other chain.

Keep the account and network together when recording what happened. The same-looking address can otherwise lead you to inspect the wrong activity.

NFT permissions also deserve attention. A collection-wide authorization is broader than permission concerning one item, so check the actual scope rather than assuming from the artwork.

Signature requests should not be waved through

If you signed something you could not interpret, do not file it mentally under harmless checking. Save the available details and ask your wallet provider for guidance.

Do not accept another signature from the suspicious site to explain or undo the first one. The explanation and the action need to come from independently verified support.

A wallet’s warning is a reason to stop and understand the request, not an obstacle to dismiss because the website promises you are safe.

Checking the Website Without Returning to the Trap

AMLBot’s own warning directs users to its official channels. Navigate independently from its main website instead of asking the questionable page to authenticate itself.

If a stranger insists that you must use their particular link, that pressure is part of the problem. You do not owe them a wallet connection.

In its August 2026 report, Malwarebytes identified these domains:

• amlbot-clear[.]com
• audittrust[.]shop
• bitget-aml[.]com
• search-aml[.]net
• swapstoken[.]app

These are warning indicators, not links to visit. A different address can carry the same scheme, and a familiar name in a domain proves little.

Do not run a paid test to decide whether a checker is genuine. Sending a small amount can create a loss without resolving who controls the page.

If an exchange genuinely requires information from you, open its official app or website separately. Ask about that requirement there, not through the sender’s supplied contact.

What to Do if You Have Fallen Victim to This Scam

1. Stop approving requests and record your last action.

   Close the suspicious page. Write down whether you connected an account, confirmed a permission, sent a payment, or entered a secret.

   Record what you remember before repeated prompts blur together. Use screenshots of ordinary transaction details, never screenshots containing your recovery phrase or private key.

   You can add missing details later. The immediate priority is to stop a confusing process from producing more authorizations.

2. If you only connected, remove the site’s connection.

   In MetaMask, open the menu, choose Permissions, select the suspicious app, and disconnect it. Other wallets provide their own connected-app controls.

   MetaMask’s disconnect instructions explicitly distinguish this from revoking approvals. Continue to the next action if you authorized token access.

   Simply seeing the website, without authorizing anything or disclosing a secret, is not evidence that your crypto has been stolen.

3. Review and revoke suspicious token permissions.

   Start from your wallet provider’s documentation. MetaMask lists approval-review options, including the relevant network’s block explorer.

   Confirm the account, network, token, and approved spender. Locate the permission associated with the encounter rather than treating every legitimate past approval as an attack.

   Use the verified tool’s revocation procedure and confirm completion. A submitted request that has not completed is not the same as a permission successfully removed.

   On-chain revocation involves a network transaction and may require gas. That is different from paying the fake checker’s demanded clearance or release fee.

   If the request is unclear, pause for official support. Do not let a stranger guide you into a replacement approval.

4. Check whether funds actually moved.

   Review recent activity through the wallet and its appropriate block explorer. Note the transaction status, asset, amount, destination, network, and transaction hash.

   Separate your own outgoing payment from an approval and any later token movement. This makes a support report clearer than simply saying the wallet was hacked.

   Uniswap’s guide also explains that revoking permission is different from disconnecting. Neither action reverses a transfer that has already completed.

5. Treat disclosed recovery secrets as a different emergency.

   If you entered your recovery phrase or private key, do not assume a password change repairs that exposure. The secret itself must be treated as compromised.

   Follow your provider’s compromised-wallet procedure to establish a genuinely new wallet and protect remaining assets, not merely rename the affected account.

   MetaMask warns against adding more funds for gas when a sweeper may be taking incoming deposits. Seek official guidance rather than repeatedly feeding the address.

   Never give the new recovery phrase to a person offering to help. Keep the replacement wallet’s setup separate from the conversation that caused the exposure.

6. Contact the exchange or provider involved through its real support route.

   If you sent funds through an exchange, supply the relevant transaction details promptly. Ask what reporting or account-protection steps apply to that specific transaction.

   A provider may have useful records or procedures, but contacting support does not guarantee a freeze, reversal, or refund.

   Do not continue discussing the case through a contact supplied by the impersonator. Locate support independently, even when a message claims someone is already handling it.

7. Preserve useful evidence and report the scheme.

   The FBI’s cryptocurrency reporting page asks for addresses, transaction hashes, amounts, asset types, dates, and the platforms used to communicate.

   Keep the website address and messages too. Distinguish what you personally did from what the site claimed, including any promised report or fee.

   Report to your local cybercrime or police service where appropriate. You can report attempted fraud even if you stopped before losing money.

8. Reject anyone promising a guaranteed recovery for another payment.

   A second approach can sound more convincing because it mentions the first loss. Knowledge of your situation is not proof of authority or ability.

   Do not send a recovery deposit, disclose secrets, or connect to another checker supplied in a private message.

   Keep helping yourself through verified reporting and support channels. You do not need to purchase a stranger’s promise before asking for legitimate assistance.

A Calm Way to Describe the Incident to Support

You do not have to master every blockchain term before asking for help. A short, factual timeline is more useful than trying to diagnose the whole scheme.

For example: I opened this address, selected this account on this network, and confirmed this request at roughly this time. Here is the transaction hash.

That is a suggested reporting format, not a quotation from a victim. Replace it with what actually happened, and leave unknown details marked unknown.

If there is no transaction hash because you only connected, say that. Do not invent an outgoing payment to make the report sound more serious.

Keep a private copy of your support reference and the details you submitted. Avoid posting a complete financial history publicly while seeking an explanation.

Most importantly, leave recovery secrets out of the report. Ordinary evidence about a transaction is different from a credential that could enable another loss.

Frequently Asked Questions

Is the real AMLBot a scam?

This warning concerns impersonators, not the legitimate AMLBot service. Its own safety notice warns about cloned platforms and says wallet connection is not required for screening.

Can someone drain my wallet just because I connected it?

A basic connection alone is not permission to transfer your crypto. Check whether you also signed, approved access, sent funds, or disclosed a secret.

Does disconnecting cancel a token approval?

No. A connection and an on-chain allowance are different. Review the affected network’s approvals and follow a verified revocation process when needed.

Does a clean AML report mean my assets are safe?

No. A risk label is not evidence that your wallet permissions are safe. Review what you authorized, not just the result shown by the page.

Can revoking an approval recover crypto already sent?

Revocation removes the relevant spending permission going forward. It does not reverse completed transfers or guarantee recovery of missing assets.

Should I pay a small fee to finish the check?

Do not pay the suspicious page to clear an error or release a result. Verify the service independently before making any further financial decision.

The Bottom Line

Do not connect, sign, or send crypto through a checker that disguises wallet access as a safety requirement. A familiar logo does not justify that permission.

If you already responded, match the remedy to the exposure: disconnect the site, address suspicious approvals, and follow compromised-wallet guidance if secrets were disclosed.

Preserve transaction details and seek verified support promptly. Do not turn one loss into another by paying an unsolicited recovery offer.