Recognizing phishing aimed at wallet users
What phishing messages, fake sites and phone calls aimed at wallet owners have in common, and a short routine for checking an unexpected request through a second channel.
Phishing is the practice of pretending to be a trusted party so that a person hands over something valuable. The message, website or phone call may claim to come from a wallet provider, an exchange, a bank or a government office. The goal is a password, a recovery phrase, a one-time code or a payment. Wallet users are an attractive target because a stolen recovery phrase gives a stranger full control of the funds, and a transfer on a blockchain cannot be pulled back by a call to a help desk. The disguise changes constantly, but the underlying request stays the same: give me a secret, or send me value, right now, before anyone has time to look closely at the request.
Most phishing follows a short sequence. First, a message arrives by email, text, social media or a direct message in a chat group. It carries a link, a QR code or a phone number. The link opens a page that copies the look of a real service, often with a web address that differs by one letter or uses an unusual ending. The page then asks you to sign in, to connect your wallet, or to type your recovery phrase to verify your account. Whatever you enter goes straight to the sender. Phone versions work the same way, with a caller reading from a script and guiding you through each screen so that you have little time to stop and think.
Picture a made-up reader named Daniel. One evening he gets a text saying his wallet account has been locked and will be closed within the hour unless he confirms his identity. The text links to a page that looks like his wallet app. A second message, from an account that claims to be support staff, offers a free airdrop to anyone who verifies quickly. Daniel feels rushed and starts typing his words into the page. Then he remembers that his provider never asked for them before. He closes the tab, opens the official app from his own bookmark, finds no warning there, and deletes both messages. The pressure, the free offer and the request for the phrase were all clues.
Several traps catch careful people. Urgency is the most common one, because a deadline discourages checking. Giveaways and free crypto are another, and the ethereum.org security guidance treats such offers as scams. A third trap is the polished fake: a copied logo and a convincing support chat prove nothing, since both are easy to reproduce. Search advertisements can also lead to fake wallet sites that sit above the real one in results. Finally, a payment request in crypto from a supposed official is a warning in itself, much like an unexpected demand for gift cards, because legitimate businesses and public bodies do not demand that form of payment. Each of these works by getting you to act before you verify anything.
A quick routine closes most of the doors. Ask who is really asking, and whether you started the contact or they did. Leave the message and reach the service yourself, by typing the address you already know or opening an app you installed earlier, rather than following the link. Confirm any important request through a second channel, such as a phone number printed on an official site. Never type a recovery phrase into a website or a chat window, whatever the reason given. Look closely at the address bar before signing in. If a message asks for a password, sensitive details or a payment, treat it as suspicious until you have confirmed it somewhere else.
If you did enter something, move fast but calmly. Change the password on the affected account from a trusted device, end other sessions, and if a recovery phrase was exposed, create a new wallet and move what remains. Keep screenshots, sender names, wallet addresses and the times of every message. Official bodies such as national cyber security agencies and consumer protection agencies publish guidance on phishing and accept reports of suspected scams. This page is general education and cannot judge your own situation, and it is not legal or financial advice. The sources listed below explain the warning signs in more detail and describe how to report a suspicious message to the proper authority where you live.
- Never type a recovery phrase into a website, chat or form, whoever asks and whatever the reason
- Reach a service by typing its address yourself, not by following a link in a message
- Urgency, free giveaways and payment demands in crypto are signs of a scam
Articles on the parts of crypto that cause confusion
Definitions
- Phishing
- A message, website or call that imitates a trusted party in order to obtain passwords, keys, codes or payments.
- Airdrop
- A free distribution of tokens to wallet addresses. Scammers copy the idea and use it as bait to get people onto fake sites.
Direct answers
- What is the quickest way to check a suspicious message?
- Leave the message alone and contact the sender through an address or number you already know. Confirming an important request through a second channel exposes most fakes.
- Will a real wallet provider ever ask for my recovery phrase?
- No. Real providers have no reason to ask for the phrase, so any request to type it into a page, form or chat is a scam.
- What should I do after entering my details on a fake site?
- Change passwords from a trusted device, end other sessions and move remaining funds to a new wallet if the phrase was exposed. Then report the message to the proper authority.