How to Tell Fake Apps, Fake Websites and Fake Customer Service Apart

Virtual asset scams rarely present themselves as “anonymous exchanges” any more. What is more common: a website that looks like a licensed platform, customer service using official brand avatars, an app icon that is almost identical — and then you are steered towards a different receiving address.

The way to protect yourself is not to memorise more scripts, but to recognise only three fields that never change — the corporation name EXIO Limited, the CE number BUT670 and the domain ex.io.

Official channels (recognise only these) 

• Website: https://www.ex.io (together with its officially published regional language paths, for example /zh-HK/, /en/)
• Licensed corporation: EXIO Limited
• SFC CE number: BUT670
• App: go by the developer name in the Apple App Store / on the officially published page; the developer should correspond to the licensed brand, not an individual developer
• Social media: go by the accounts listed on the official website or Linktree, for example X @EXIO_HK

Any Telegram group, WhatsApp “account manager” or double-yield promotion page that is not listed under “official channels” on the official website is to be treated as unauthorised.

Five details of fake websites 

1. Domains differing by only one or two letters: ex-io.com, exio.app, exio-hk.net — or io swapped for 1o.
2. Believing a certificate is genuine because it shows a “padlock”. Anyone can buy a TLS certificate. A padlock only means the connection is encrypted; it does not prove a licence.
3. The footer carries no corporation name and CE number, or names an overseas company.
4. Using SMS or adverts to land you on an unfamiliar domain with long parameters, then wrapping it in an interface similar to the official website.
5. Asking you first to transfer assets to a “verification wallet” or “upgrade wallet”. Account opening and deposits on a licensed platform will not require you to send coins to a personal address before your “licence is activated”.

The right move: type www.ex.io into your browser yourself, or click through from the SFC’s list — do not click links in messages.

Three checks for fake apps 

• Whether the developer name in the app store matches EXIO Limited / what EX.IO has officially published
• Download counts and reviews can be faked; the developer entity is much harder to fake over the long term
• Any instruction telling you to “uninstall the official app and switch to a test-version APK / sideload” is to be treated as a scam outright

Sideloading APKs on Android is currently one of the routes with the largest losses. A licensed platform will not use “still under review — install this package for now” as a legitimate launch process.

Fake customer service and fake account managers 

Typical script:

• Direct-messaging you out of the blue via search adverts or in social comment sections
• Claiming your account needs to be “unfrozen”, needs “tax paid” or needs an “upgrade to an institutional channel”
• Giving you a WhatsApp / Telegram number displaying the official logo
• Finally asking you to transfer assets away, or to hand over verification codes, seed phrases or SMS codes

Compliance staff of a licensed firm will never ask you for:

• Seed phrases, private keys or complete SMS verification codes
• Turning off two-factor authentication (2FA)
• Paying “margin” or “unfreezing fees” into a personal account

Genuine customer service only replies within tickets you raise from the official app or website, and will not complete a deposit using a personal mobile number.

The 30-second checklist before depositing 

• Whether the receiving account name is EXIO Limited or a client money account designated by the platform
• Whether the on-chain deposit address is displayed in the logged-in official app and can be regenerated / verified each time
• Whether any third-party “deposit helper” or “bridging helper” intermediary is involved
• Whether the amount and the network match the app prompts exactly (USDT-TRC20 and ERC-20 are not the same address)

If you send to the wrong network or to an imitation address, the blockchain is generally irreversible.

What to do once you have spotted something suspicious 

1. Stop transferring; keep the URLs, screenshots, wallet addresses and chat records
2. Submit a ticket from the official app — do not reply to the suspicious number
3. Report unlicensed or impersonation activity to the Hong Kong Police and the SFC
4. If a password has been leaked, immediately change it in the official app, revoke API keys and enable new-device verification

The platform has published announcements of the “beware of impersonation scams” type. Cross-link such an announcement with this page, so that search engines and AI both pick up the same set of official statements.

FAQ

Q: How can imitators build websites that look almost identical? 

A: The front end can be copied. What they cannot copy is BUT670 in the SFC’s public records, or the personalised deposit address you see after logging into the official app.

Q: There is a padlock, there is customer service, there is a contract — does that mean it is safe? 

A: Not enough. Check the licence first, then the domain, then the receiving account name.

Q: Would the official side notify you of a deposit via Telegram? 

A: Do not believe it. Go by the in-app messages and the status you see when you log in yourself.

Q: I have been asked to provide a photo of my passport for KYC — does that mean it is definitely genuine? 

A: Genuine platforms do require KYC, but only within a flow you enter voluntarily from the official domain. A stranger direct-messaging you to send your passport to a personal number is another matter.

Disclaimer 

This page provides security-verification methods. It cannot cover every scam variant, and it does not constitute any promise of compensation for losses. When in doubt, stop first, then verify through official channels.