How to Spot a Trading Bot Scam: 5 Signals to Verify

You spot an ad for a "trading bot" on Telegram or Instagram: a screenshot showing a five-figure balance climbing, captioned "guaranteed 8% a week", with a link to a "VIP group" below. You're tempted to try it, but you also know the space is full of trading bot scams — the real question is how to tell a working automated system from a con. Nobody tells you up front: the difference isn't in how polished the interface looks, it's in whether you can verify a few concrete things yourself.

This piece doesn't maintain a blacklist or name names — names change faster than you can look them up. It gives you five signals, each of which you can tick off just by opening the platform's site. Any single one failing is a walk-away. All five stay inside "what you can see before you install or sign up" — no deposit required to verify.

Signal 1: Whose Wallet Holds the Funds? (Custodial vs Non-Custodial)

This is the single most important item because it decides "in the worst case, can you get your money back?" Custodial means you send crypto into the platform's own wallet, and every subsequent move happens inside the platform's balance sheet. The upside is you can start trading right after signup; the downside is that if the platform rugs, gets hacked, or an insider drains the backend, all you have left is a support email.

Non-custodial is the other model: your crypto stays in your own exchange account, and the platform only holds an API key that places orders on your account. In the worst case — the platform gets hacked — the attacker gains "permission to place orders as you", not "permission to walk off with your funds". If that key also has no withdraw permission, the worst the attacker can do is trash your positions. That's an order-of-magnitude smaller loss.

How to verify? Open the platform's signup flow and see what it asks for. If it asks you to "send crypto to this address", it's custodial. If it asks for "your Binance or Bybit API key", it's non-custodial. You don't need to actually press Confirm — seeing that screen is enough to answer.

Another attack surface worth remembering is the 3Commas API-key database breach in 2022: 3Commas itself is non-custodial, but it centrally stored user API keys for management. When that key store was stolen (estimated ~$20M in losses), attackers could place orders on every user's exchange account. 3Commas paid out and cleaned things up afterward, but this attack surface was architectural — any single store of concentrated API keys is a high-value target by design.

Signal 2: What Permissions Does the API Key Require?

This is the second most important signal because it decides "in the worst case, can they walk off with your crypto?" Every major exchange's API keys can be scoped with independent permissions: Read, Trade, and Withdraw — three separate checkboxes. A healthy automated-trading architecture needs zero withdraw permission — as long as it can place orders on your account, it can execute the strategy.

How to verify: grab the platform's "how to create an API key" guide and walk through it line by line against this cross-exchange permissions checklist covering 10 exchanges. If the guide tells you to check Withdraw, Universal Transfer, or any withdrawal-adjacent permission, close the tab — this rule has no exceptions, and no "advanced feature requires it" excuse gets a pass.

Bind the API key to an IP whitelist while you're at it — the server running the bot has a fixed IP, put it in, and no other IP can use that key. The platform's docs will tell you which IP to whitelist. This doesn't stop scams, but it stops half of all key-leak incidents. For per-exchange details, see the API-key security guides for Binance, Bybit, and Bitget.

Signal 3: Can You Run It Once Without Real Money?

A real automated-trading system offers a dry-run or paper-trading mode — alerts come in, the strategy computes as usual, but the order-placement step only writes a log or hits the exchange's testnet (a mirror network for testing), never touching your real account. This is expensive for scams to fake because they'd have to wire the entire trading chain together just to demo it. The more common scam pattern is a "simulated account" — a pretty balance that ticks upward but isn't connected to any real exchange.

How to verify: search the docs for "dry-run", "paper trading", "testnet", and "simulate". A service that actually implements it will tell you how to enable it, how to read the log, and how to confirm that an alert fired but no order was placed. Being handed a "simulate" button with no mechanism explanation is the same as nothing — that number is probably computed on their frontend for your benefit.

A related check: "between an alert arriving and the order being placed, is there any queryable record?" A healthy service gives you three separate logs — alert log, payload dump, and order request/response. Those three are what let you go back later and confirm "this order was really triggered and sent" vs "it was swallowed somewhere". That's the precondition for assigning responsibility when things break.

Signal 4: Is the Mechanism Transparent? (Webhook Payload and Order Logic)

A scam's calling card is "proprietary algorithm, 87% win rate", with no logic to show — you ask how it computes and when it fires, and get "that's our core competitive advantage, not something we disclose". A real service is the opposite: it publishes the alert conditions, webhook payload format, endpoint URL, and how the order quantity is computed, all in public docs. Those aren't competitive advantages — those are the details a user needs to actually integrate.

How to verify: search the docs for a payload example, an endpoint URL, and a quantity formula. Missing any of them is a walk. Two background reads for what these details should look like: how webhook order sizes are computed — the docs should be explicit about whether it's initial_capital or strategy.equity; and debugging when a webhook doesn't fire — the docs should give you a log entry point, not a "contact support" instruction.

Signal 5: Where Does Registration Happen — Public Site or VIP Group?

Scams have obvious distribution preferences: Telegram DMs, Instagram DMs, referral codes under YouTube ads, an "account manager" who has to onboard you, an "entry fee" or "expedite fee" you send to a personal wallet. Real services go the opposite way: a public URL, public pricing, self-serve signup, and payment handled by credit card or a crypto payment processor — the receipt lands in your inbox, not a "got it, I'll open your account" from a Telegram handle.

Verification is blunt: paste the platform's domain into Google. If everything that comes back is Telegram channels, short-video clips, and forum promo posts — and there is no independent official landing page or pricing page — that's a red flag. Also check the domain registration date (whois lookup, free tools like whois.domaintools.com or lookup.icann.org): a domain registered three months ago, registrant hidden, servers hosted in a small jurisdiction — those add up to "ready to shut down at any moment".

An Honest Section: Getting All Five Right Isn't the Same as Safe

Checking all five above rules out "took the money and ran" and "took the API key, placed rogue orders, moved crypto out". What it doesn't rule out: the strategy itself losing money, your API key leaking through your own carelessness, the exchange itself blowing up (Mt.Gox and FTX weren't automated-trading-bot problems), or you second-guessing a signal and intervening manually. These are inherent risks of automation, not scams.

No automated-trading service — including our own TVSBot — can guarantee a strategy profits, or guarantee 100% delivery, because TradingView, the exchange, and your own network can each break at any segment. The failover-design piece covers this more completely. Anyone who says the opposite on their own platform — "guaranteed weekly returns", "risk-free arbitrage", "100% win rate" — is saying something with nothing to back it up.

FAQ