What to Verify When a ‘Compliance Department’ Contacts You From a Personal Messaging Account

If a message says it is from an exchange’s compliance, risk, or security team but arrives through a personal messaging account, do not treat the message itself as proof. The safer approach is to open the exchange’s official website or app yourself and check whether the same issue appears there through a normal support, security, or account-notice path. Public cyber-safety guidance consistently recommends independent verification instead of using links, contact details, or instructions supplied inside an unexpected message.

Summary box

- Treat unsolicited compliance or security chats as unverified until you confirm them independently.

- Do not click links, scan QR codes, open attachments, or send funds from the conversation.

- Use the exchange website or app you opened yourself, not the route provided by the sender.

- Save evidence before you report, block, or delete the contact.

Phishing and social-engineering messages commonly rely on urgency, authority, and account-problem claims. A message about “compliance,” “suspicious activity,” or “verification” can sound routine while still trying to push you into unsafe actions. That is why the channel matters: a direct message from a personal account is not self-authenticating, even if it uses formal language or exchange branding.

Date checked: this article is based on the public cyber-safety sources listed below that were available at the time of drafting. It does not assume that all exchanges use the same support or compliance-contact process. If your exchange publishes its own contact or anti-phishing policy, check that policy directly before acting.

Do not try to confirm the sender by continuing in the same chat. Instead, type the known website address yourself or open the official app you normally use, then look for a support center, account alert, or message center. This follows standard anti-phishing guidance: navigate independently rather than through details supplied in the suspicious message.

If the message claims there is a restriction, review, verification problem, or security issue, look for a matching sign inside the account environment you opened yourself. If you cannot find any corresponding alert, ticket, or notice, that does not prove the message is fake, but it is a reason to slow down and verify further through official support.

A logo, job title, copied case number, or polished wording is not enough to establish identity. Public cyber guidance places more weight on independent confirmation than on appearance inside a message.

Be especially cautious if the sender asks you to:

• share passwords or one-time codes
• click a login link or open an attachment
• install software
• allow remote access
• send money, deposits, or release fees
• move assets to another wallet for “safekeeping”

Use this practical list before you do anything:

1. Pause the conversation.
2. Do not click, scan, download, or sign anything from the chat.
3. Open the exchange website or app yourself.
4. Check for a matching notice, restriction, or ticket.
5. Use only published support channels you found independently.
6. Save screenshots, usernames, wallet addresses, and message text if the contact appears suspicious.
7. Report and block the sender after you preserve the evidence you need.

Treat the message as unverified. Open the exchange independently and check for any real notice or ticket. If nothing matches, continue only through official support you found yourself, not through the chat.

Do not send money based only on a direct message. A demand for payment tied to account access is a serious warning sign and should be checked through official support opened separately.

Do not share the code in chat. One-time codes are used in account access and verification flows, so giving them away can expose the account.

Reality: Branding and reference numbers can be copied. Independent confirmation is more reliable than appearance alone.

Reality: Partial personal or account information is not enough to prove authority. Keep using a separate official route to verify the claim.

Reality: Pressure to act quickly is common in phishing and impersonation attempts. Slow down and verify through a channel you opened yourself.

• Stop replying.
• Do not click links, scan QR codes, or open attachments.
• Open the official app or website yourself.
• Check for matching notices or support messages.
• Report the contact through the platform’s published support route if available.

Use official account-safety routes you opened yourself. Depending on what happened, practical steps may include changing your password, reviewing security settings, checking recent activity, ending active sessions if the platform offers that option, and contacting official support. Preserve the conversation and related details as evidence, but avoid continued back-and-forth with the sender.

• Trying to verify the sender inside the same conversation.
• Using phone numbers, websites, or forms supplied in the message.
• Sending a small “test” payment.
• Installing software or accepting remote-help requests.
• Assuming formal wording means the contact is genuine.

Not on its own. A personal account or direct-message channel should be treated as unverified until you confirm the claim through an official route you opened yourself.

Those topics can arise in legitimate account reviews, but they can also be used to create pressure. The safer response is the same: verify the claim through the exchange’s official app, website, or published support path that you accessed independently.

First save evidence if you can do so safely. After that, reporting and blocking can help reduce further contact.

Do not share passwords, one-time codes, seed phrases, private keys, or remote-access access to your device.

• CERT Polska
• NASK
• Gov.pl: Cyberbezpieczeństwo