How we checked this
We reviewed the linked sources and keep this page updated when the record changes. Use the source list below to verify the details.
Key points
Summary: A Travel Rule-related message may be a real compliance check, but similar wording can also appear in phishing or impersonation attempts. The safest approach is to treat any unexpected message as unverified until you confirm it through the exchange’s official app or website that you opened yourself. Do not share passwords, one-time codes, seed phrases, private keys, or remote-access permissions in chat, DM, email, or phone support reached from the message itself.
What a Travel Rule message means in plain English
In general, the “Travel Rule” refers to information-sharing requirements connected to some financial transfers. For exchange users, that can appear as a request for more information about a transfer, the recipient, or another compliance-related detail. It is safer to think of this as Travel Rule-related compliance messaging rather than one standard consumer message format used everywhere.
Because exchanges and scams can both use formal compliance language, a message may sound official without being genuine. That is why the message wording alone is not enough to prove legitimacy.
What legitimate requests may look like
A legitimate compliance request is more likely to direct you back to the exchange’s normal account environment or published support channels, instead of pushing you to handle everything through an unexpected DM, phone number, or chat link.
Common patterns that are more consistent with a real request- it tells you to sign in through the official app or website you normally use
- you can find the same notice inside your account after logging in independently
- the request stays within the platform’s normal support or security process
- it does not ask for secrets such as passwords, one-time codes, seed phrases, or private keys
Even then, caution still matters. A compliance-themed message is not automatically fake, but it is not automatically trustworthy either.
How impersonators copy compliance wording
Impersonators often borrow the tone of compliance, security, or account-review messages. They may claim that a withdrawal is blocked, your account is restricted, or immediate action is required.
The pressure tactic is usually the point: to make you use the contact route inside the message instead of verifying it independently. That can expose you to phishing pages, fake support conversations, credential theft, or payment demands supposedly needed to “unlock” funds.
Legitimate exchange signal vs impersonation signal| Signal | More consistent with a legitimate process | More consistent with impersonation |
|---|---|---|
| Where it sends you | The official app or website you open yourself | A link in the message, a DM, a pop-up chat, or an unverified phone number |
| What it asks for | Limited follow-up within a normal account or support path | Passwords, one-time codes, seed phrases, private keys, or remote access |
| Tone | Formal, but still leaves room to verify | Extreme urgency, threats, countdowns, or pressure not to contact normal support |
| Payment | No surprise fee just to “release” or “unlock” funds | A demand to pay first to complete “verification” or restore access |
| Contact method | Published support channels | Lookalike handles, changing contacts, or off-platform chat apps |
Safe verification steps
- Pause first. Do not click the link, scan the QR code, call the number, or open attachments immediately.
- Open the exchange independently. Use the official app or type the known website address manually.
- Look for the same notice inside your account. Check alerts, account messages, support tickets, and security notices.
- Use only contact details you find yourself. Do not rely on the phone number, email reply path, or chat handle included in the suspicious message.
- Compare with official help or security pages. If the exchange publishes anti-phishing or contact-verification guidance, use that instead of trusting the message.
- Stop if secrets are requested. Do not provide passwords, one-time codes, seed phrases, private keys, backup codes, or remote-access approval.
If you want broader safety checks, see our guides to [exchange impersonation warning signs](/exchange-impersonation-warning-signs), [account locked after travel or new device](/account-locked-after-travel-or-new-device), and [how to verify official exchange contact](/how-to-verify-official-exchange-contact).
What not to send over chat, DM, email, or phone support reached from a message
Never send the following to someone who contacts you unexpectedly about a Travel Rule or compliance issue:
- your password
- SMS or authenticator one-time codes
- your seed phrase or recovery phrase
- private keys
- backup codes
- permission for screen sharing or remote device access
- a payment to “unlock,” “release,” or “verify” funds
These requests are high risk because they can lead to account takeover, wallet theft, or follow-on fraud.
If you already replied to a suspicious message
If you clicked a link but did not submit anything, stop using that page and return to the exchange only through the official app or a manually entered domain. If you shared account credentials or a one-time code, change them through the official platform and review your security settings as soon as possible. If you shared a seed phrase or private key, treat that wallet as compromised.
Date-checked note
Date checked: 2025-08-08. This article provides general consumer-safety guidance only. Travel Rule-related handling is not identical across exchanges or jurisdictions, so confirm any account-specific request through the exchange’s own published help and support channels.
Cover image plan
Alt text: Illustration comparing legitimate exchange compliance messages with spoofed impersonation attempts
Caption: Travel Rule-related language can appear in both genuine exchange compliance notices and fake impersonation messages, so users should verify through official channels they open themselves.
Sources
- CERT Polska: aktualności i ostrzeżenia - CERT Polska.
- NASK: cyberbezpieczeństwo - NASK.
- Gov.pl: cyberbezpieczeństwo - Gov.pl.
- Es - cryptorescue.
Update log
- 25 Jul 2026Published with source tracking and reader-safety context.
- CorrectionsIf a source changes or a claim needs clarification, this page can be updated from the editorial desk.