Guide
How to avoid THCA scams: the patterns and what to do if it happens
Straight answer
Most THCA scams follow one of seven scripts. Here is how each one works, the tell that gives it away, and what to do in the first 24 hours if you already paid.
Most THCA scams are ordinary online-shopping fraud in a hemp costume: a copied website, a seller that only takes gift cards or crypto, a faked lab report, or a fee that appears after you pay. You avoid nearly all of them by checking who you are paying and paying with something you can dispute.
Last checked Oct. 3, 2026. If you already paid and something is wrong, skip to what to do in the first 24 hours.
The seven patterns
| # | Pattern | How it works | The tell |
|---|---|---|---|
| 1 | Clone site | A copy of a real seller’s site on a lookalike domain, often found through ads or links in DMs | One letter off in the domain, a domain registered weeks ago, a phone number that is not on the real site |
| 2 | Social-media dealer | A profile on Instagram, Telegram or Snapchat with menus and “plug” posts. You pay, it blocks you | No business name, no address, no way to pay except an app transfer to a person |
| 3 | Gift card or crypto only | The seller insists on gift card numbers or a crypto transfer | The FTC: “Only scammers demand payment in cryptocurrency” |
| 4 | Fee after payment | After you pay, a “shipping insurance”, “compliance” or “release” fee appears before the parcel can move | Any new charge after the order was agreed |
| 5 | Faked COA | A real lab’s report with the numbers, strain or lot edited, or a lab that does not exist | The math on the report does not add up (see below) |
| 6 | Fake tracking text | A text says your parcel is held and links to a page that asks for card details | You did not sign up for texts, and the message contains a link |
| 7 | Recovery scam | After a loss, someone offers to get your money back for a fee, sometimes claiming to be the FBI | Anyone asking for money to recover money |
Memorize pattern 3. The FTC is blunt: “Only scammers will tell you to buy a gift card… and give them the numbers off the back of the card” (FTC, gift card scams), and “No legitimate business is going to demand you send cryptocurrency in advance” (FTC, crypto scams).
Payment apps are a gray area in this market. Many hemp sellers lack mainstream card processing, so app payments are common. The FTC lists payment apps alongside gift cards, crypto and wires as payment methods scammers ask for (FTC, four signs of a scam), and warns that once you send app money to a scammer, “it’s hard for you to get your money back” (FTC, payment apps). An app payment to a business you have verified, after a phone call, is a different risk from an app payment to a stranger’s handle.
How to spot a clone site in two minutes
- Type the address yourself. Not from an ad, DM or comment.
- Look up the domain. ICANN Lookup shows when a domain was registered. A seller claiming years in business on a domain created last month has told you something.
- Compare contact details. Phone and email should match the seller’s known site and review pages.
- Check the price against the market. On Oct. 2, 2026, the cheapest THCA flower in public listings was shake at about $0.22 a gram, and indoor started near $1.10 (our price bands). “Exotic indoor” well under the shake price is a lure, not a deal.
How to catch a faked COA
A doctored report usually breaks here:
- The math. Total THC should equal delta-9 + (THCA x 0.877). If a report says 25% THCA, 0.2% delta-9 and 15% total THC, someone edited a number.
- The lot. One report, same date and numbers, attached to five strains.
- The link. The QR code opens a PDF on the seller’s own domain instead of the lab’s portal.
- The lab. No website, no phone, no accreditation number you can look up.
The full ten-point seller check, including how to confirm a lab, is on where to buy THCA flower.
If it already happened
Speed matters most. Call whoever moved the money, then report.
| You paid with | First call | What to ask | Clock |
|---|---|---|---|
| Credit card | Card issuer | A dispute and refund | Written dispute must reach the issuer within 60 days of the first bill showing the charge (FTC) |
| Debit card | Your bank or credit union | Refund the transaction | Report at once |
| Zelle, Cash App, Venmo | The app, through its in-app support | Reverse the payment | Report at once |
| Gift card | The company that issued the card | Refund; say a scammer got the number and PIN | Keep the card and the store receipt |
| Crypto | The exchange or crypto ATM operator | Say it was a fraudulent transaction and ask for a reversal | No card-style legal protection, so often hard to recover |
| Wire transfer | The wire company or bank | Reverse it; say a scammer tricked you | Report at once |
These steps follow the FTC’s guide, What to do if you were scammed. Under the Fair Credit Billing Act, once your written dispute arrives the issuer must acknowledge it within 30 days and resolve it within 90.
Then report it, even if the money is gone:
- ReportFraud.ftc.gov. The FTC uses reports to build cases and spot patterns.
- IC3.gov, the FBI’s Internet Crime Complaint Center. File even if you are unsure it qualifies.
- Your state attorney general’s consumer protection office.
Save everything before the seller deletes it: screenshots of the site, the listing, the chat, the payment receipt and any tracking number.
Two things that make it worse
The second scam. IC3 states it “does not work with any non-law enforcement entity” to recover lost funds and “will never directly contact you for information or money.” Anyone who calls offering recovery for a fee, using the FBI’s name or not, is running pattern 7.
The link in the tracking text. The Postal Inspection Service says USPS does not send texts or emails unless you requested tracking with a tracking number, and those messages do not contain a link (USPIS). Go to the carrier’s site and type the number in yourself.
One date to know
As of Oct. 3, 2026, THCA counts toward the federal 0.3% total-THC hemp limit from Dec. 11, 2026. Congress set the new hemp definition in Sec. 781 of P.L. 119-37 (CRS IF13136) and moved its start for plant cannabinoids such as THCA to Dec. 11 in H.R. 6500, Sec. 2019. After that date, high-THCA flower sold as “federally legal hemp” is a red flag unless Congress changes the law again.
Sources
- FTC: Avoiding and reporting gift card scams
- FTC: What to know about cryptocurrency and scams
- FTC: How to avoid a scam
- FTC: Mobile payment apps
- FTC: What to do if you were scammed
- FTC: Using credit cards and disputing charges
- FBI Internet Crime Complaint Center (IC3)
- U.S. Postal Inspection Service: Smishing
- CRS In Focus IF13136, Aug. 17, 2026
- H.R. 6500, enrolled text
Questions
- Is it safe to buy THCA online?
- It can be, with a seller you can verify and a payment method you can dispute. The scams in this market are mostly ordinary online-shopping fraud: copied websites, sellers who only take gift cards or crypto, faked lab reports and fees invented after you pay. Each has a tell you can check before you send money.
- What is the most common sign of a THCA scam?
- The payment method. The FTC says only scammers demand payment by gift card or cryptocurrency, and no legitimate business demands crypto in advance. A seller that will take nothing else, or adds a new fee after you paid, is the clearest warning.
- I paid a THCA seller and nothing arrived. What do I do?
- Contact whoever moved the money the same day: your card issuer, bank, payment app, gift card company or crypto exchange. Ask them to reverse the payment. Then report it at ReportFraud.ftc.gov and to the FBI's IC3 at ic3.gov. For credit cards, a written dispute must reach the issuer within 60 days of the first statement showing the charge.
- Can a recovery company get my THCA money back?
- Be very careful. The FBI's IC3 says it does not work with any non-law-enforcement entity to recover lost funds and will never contact you directly for information or money. A stranger who offers to recover your loss for a fee is a common second scam.