Ripple has issued a fresh warning about a seasonal rise in crypto fraud, saying XRP users are increasingly being targeted by scams that rely on impersonation, fake promotions, and AI-generated deception. The company said year-end periods often create a favorable environment for attackers because online activity rises, attention becomes fragmented, and users may be more likely to react quickly to messages that appear urgent or time-sensitive.
At the center of Ripple’s warning is a familiar but still highly effective scam format: fake giveaway promotions that ask users to send crypto first. Ripple stressed that offers such as “Send 5 XRP and get 50 XRP back” are fraudulent in every case. According to the company, no legitimate organization or individual runs promotions that require a user to transfer cryptocurrency upfront in exchange for a larger return. That message remains one of the most important red flags for retail users navigating social media and unofficial promotional channels.
Deepfakes and impersonation are raising the threat level
Ripple said fraudsters are no longer relying only on basic phishing pages or copied social posts. In some cases, attackers directly contact people on social platforms while pretending to be trusted public figures, company representatives, or well-known members of the crypto community. The company also pointed to a growing use of AI voice cloning and deepfake video, which can make fraudulent messages look and sound more convincing than traditional scams.
These campaigns often combine multiple deceptive tactics at once. Ripple said scammers use copied branding, altered URLs, urgency-driven language, and fabricated social proof such as fake comments and engagement signals. The goal is to push targets into acting before they pause to verify whether a link, account, or message is authentic. In practice, that may mean clicking a malicious website, connecting a wallet to a fake interface, or sending XRP to an address controlled by criminals.
The company’s message to users is straightforward: slow down and verify. Unsolicited offers, private messages, and promotional claims should be treated with skepticism, especially when they include pressure to act immediately or promises of unusually high returns. For Ripple, early detection and public education are critical because many scam losses occur when users respond before conducting even basic verification.
Holiday campaigns are being met with coordinated industry action
Ripple is also highlighting a broader industry effort to make scam awareness more visible during the holiday season. The company is part of the Tech Against Scams Coalition (TASC), an initiative launched by Coinbase with support from crypto firms including Ripple, Kraken, and Gemini. The coalition is rolling out a holiday campaign called Scamberry Pie, designed to make conversations about scams more accessible and memorable in family and community settings.
Rather than framing fraud prevention solely as a technical issue, the campaign emphasizes everyday discussion of warning signs. Dennis Jarosch, Ripple’s SVP of Engineering, said education remains one of the strongest protective tools available. In his view, people who understand what to look for are better able to protect themselves and others, and simple conversations about suspicious offers, fake support messages, or giveaway scams can help reduce victimization before it happens.
That emphasis reflects a larger trend across the crypto sector: scam mitigation increasingly depends on a mix of platform enforcement, intelligence sharing, and user literacy. While exchange operators, wallet providers, and browser security systems can intercept some threats, many attacks still begin in places where users make their own decisions quickly, such as social media feeds, private chats, livestreams, and search results.
Ripple details the scale of its anti-fraud infrastructure
Alongside the public warning, Ripple shared new figures on the scope of its threat-mitigation program. The company said its malicious-domain detection tools have enabled the removal of more than 7,000 scam websites. These sites were tied to crypto-related fraud and likely used to imitate legitimate brands, host phishing interfaces, or distribute misleading promotional content aimed at XRP holders and other crypto users.
Ripple also said its collaboration with Google Safe Browsing has prevented more than 68,000 attempted visits to malicious crypto domains through Chrome browser warnings. That figure illustrates the importance of browser-level defenses in the modern scam landscape. Even if a malicious link spreads widely on social media, search engines, or messaging apps, browser warnings can create a crucial final checkpoint before a user reaches a harmful page.
Video platforms are another major battlefield. Ripple said it has worked with YouTube to eliminate more than 8,000 fraudulent “Live” videos used to promote crypto scams. According to the company, 85% of those videos were taken down in under 90 minutes. Fake livestreams have become a persistent tactic in crypto fraud because they can combine replayed conference footage, edited interviews, fake QR codes, and giveaway language in a format that appears authoritative and urgent.
These operational metrics suggest that fraud defense is no longer limited to takedown requests after harm has occurred. Instead, companies like Ripple are building systems designed to detect patterns across domains, videos, and impersonation campaigns fast enough to reduce their reach before they scale. That is especially important during seasonal spikes when attackers launch many variants of the same scam in a short window.
Threat intelligence sharing is reducing known XRP scam losses
Ripple said its 2024 threat feed distributes fraud intelligence to industry partners in near real time. According to the company, that system has contributed to a reduction of more than 90% in known XRP losses reported from scams. While the company did not break down exactly how much of that decline comes from domain takedowns, platform actions, or information sharing, the figure points to the value of coordinated response across the ecosystem.
The ability to move quickly matters because crypto scams evolve rapidly. Once one domain is disabled, another may appear. Once one fake account is suspended, a cloned profile may take its place. Real-time or near-real-time intelligence allows partners to identify repeating infrastructure, cross-reference suspicious indicators, and respond before a campaign fully matures. For retail users, that behind-the-scenes collaboration may not be visible, but it can significantly reduce exposure to the most common attack routes.
Ripple summarized its position by saying it invests heavily in consumer protection both by removing threats and by helping others across the industry identify them quickly. That framing places anti-scam work at the intersection of brand defense, platform trust, and public safety. In crypto, where transactions are often irreversible, preventing a fraudulent transfer is vastly more effective than attempting to recover funds afterward.
What XRP users should take from the warning
The practical takeaway from Ripple’s latest alert is that users should assume scams will intensify when attention is high and trust signals are easy to fake. Any message promising instant returns, bonus XRP, or limited-time access in exchange for an upfront transfer should be rejected immediately. Likewise, videos or voice messages that appear to feature executives or influencers should not be trusted on appearance alone, especially as AI-generated media becomes easier to produce and harder to detect at a glance.
Users should verify account handles, inspect URLs carefully, avoid engaging with unsolicited direct messages, and rely on official channels when checking whether a promotion or announcement is real. The more convincing scam content becomes, the more important it is to add friction to decision-making. Waiting, checking, and confirming may feel inconvenient, but those steps remain among the most effective defenses against impersonation-driven crypto fraud.
Ripple’s warning ultimately underscores a broader reality for the digital asset sector: as fraud tools become more sophisticated, defense must scale across technology, partnerships, and education. The company’s latest data suggests that coordinated action can meaningfully reduce harm, but it also makes clear that retail vigilance remains essential—especially during holiday periods when scams are designed to blend into the noise of increased online activity.