How Scammers Use Google Forms to Steal Cryptocurrency, and How to Stay Safe

Key takeaways

• The Google Form itself is real. The scam is the story around it: a fake reward, a fake exchange and a request for money or wallet access.
• Because the email link comes from Google, it can pass spam filters and looks trustworthy. A trusted domain does not make a message trustworthy.
• No genuine exchange asks you to pay a fee to receive a reward, or asks for your seed phrase or private key.
• Report to cybercrime.gov.in, and for financial loss call 1930 quickly. Crypto transfers are difficult to reverse.
• Sample code, if shown in articles, is for understanding only. Defenders can disable abused features, but users should rely on behaviour rules.

How does the Google Forms crypto scam work?

Security researchers and news outlets reported in 2025 that scammers were abusing Google Forms to run crypto-themed phishing. A typical flow:

1. You receive an email that appears to come from a crypto exchange or wallet service. It says you have a large pending reward, for example more than one Bitcoin, and asks you to confirm details through a link.
2. The link opens a real Google Form hosted on a Google domain, so it looks legitimate and the email can pass spam filters.
3. The form collects information such as your email and wallet address, or sends you on to a "withdrawal portal".
4. The portal asks for a small "network fee", gas fee or "verification deposit" before it can release the reward.
5. You pay, and the money is gone. In other variants, the page tricks you into connecting a wallet or revealing a recovery phrase.

Reports said attackers also used scripting features in the form and external servers to collect data, and hid their back end behind a content delivery network. The specific technical details vary between campaigns and should be checked in primary reports before you rely on them. This article does not reproduce any attack code.

Why does the scam pass email filters?

Mail filters give weight to sender reputation and link domains. A message that links to a Google domain, or that is sent through Google's own systems, starts with a good reputation. The scam relies on that trust. The message content (urgency, reward, claim now) is what gives it away.

What are the red flags?

• A reward you did not earn, or an unexpected "pending transfer".
• Pressure to act fast, with a deadline.
• A request to pay a fee, deposit or tax to release funds.
• A form that asks for a seed phrase, private key or wallet password. No real service needs these.
• A sender address or reply-to that does not match the exchange.
• A form hosted on a general-purpose service, not on the company's own domain.

How can you protect yourself?

1. Do not click reward links. Open your exchange app or type its address yourself and check your account there.
2. Never share your seed phrase or private key. Treat it like the keys to a safe.
3. Use a hardware wallet and enable multi-factor authentication on exchange accounts.
4. Check the sender's full address and the real destination of links before clicking.
5. Report phishing to your email provider and to Google using the "Report abuse" link on the form.
6. Keep browsers and devices updated and use reputable security software.

What should you do if you already filled in the form?

1. If you only gave an email and wallet address: watch for follow-up scams and change passwords if you reused any.
2. If you shared a seed phrase or connected a wallet: move remaining funds to a new wallet created on a clean device immediately and revoke token approvals.
3. If you paid a fee: keep the transaction ID, wallet addresses and screenshots. Report to the exchange used.
4. Report in India: file a complaint on cybercrime.gov.in. For financial loss, call the 1930 helpline as soon as possible. Speed matters.

What can organisations do?

Train staff on reward and invoice scams, restrict who can create forms or receive external ones where you manage Google Workspace, mark external email clearly, block known bad domains at the gateway, and give people an easy way to report suspicious mail. Organisations should also report incidents to CERT-In where required.

Can stolen crypto be recovered?

Rarely. Blockchain transfers cannot be reversed by a bank. Funds may be moved through mixers or other wallets quickly. Fast reporting gives law enforcement a chance to trace and ask exchanges to freeze accounts, but nothing is guaranteed. Be wary of "recovery services" that charge upfront. They are a common second scam.

Next steps

To understand how phishing like this is built and stopped, see WebAsha's cyber security course. Read next: Firefox extensions that steal cryptocurrency wallets.

Related reading

• Hackers Use Fake Ledger Apps to Steal Mac Users’ Seed Phrases | Latest Malware Campaigns Exposed
• How Celestial Stealer Malware is Stealing Your Browser Data and Crypto
• Minecraft Mods Used to Spread Malware | Stargazers Hackers Steal Passwords, Discord Tokens, and Crypto Wallets Through Fake Mods on GitHub