Wallet approval scams and recovery phrase theft

A wallet approval scam tricks a person into giving a stranger permission to move funds, without any password changing hands. A software wallet is an app or browser extension that holds the keys to crypto assets. Many websites ask a wallet to connect, and a connection on its own only shows an address. An approval is different. It is a signed instruction that can let another party spend from the wallet. Fraudsters copy the look of real sites and then show a prompt to connect, verify or claim a reward. The Canadian Anti-Fraud Centre (CAFC) describes this pattern in a bulletin on evolving fraud types. The danger is that the click feels routine.

The sequence is short. First, a link arrives by email, text, social post or search advertisement, or a pop-up appears on a site the person already visits. Second, the page asks to connect a wallet. Third, a window from the wallet app lists what the site wants to do. Fraudsters count on the person pressing approve without reading it. Once signed, the permission lets the fraudster's address move funds out, sometimes much later. A second route skips the approval and goes straight for the recovery phrase, the list of seed words that rebuilds a wallet on any device. According to a CAFC wallet bulletin from August 2026, fraudsters chase these phrases through fake sites, emails, calls, QR codes and malware.

Consider a made-up case. Daniel keeps a few digital tokens in a browser wallet. One evening a message says his wallet must be verified to claim a reward. The link opens a page that copies a site he knows. It asks him to connect, and he does. A second prompt asks for approval, and he presses it because the first step went smoothly. Nothing seems to happen. Days later the tokens are gone. Then a stranger writes to him and says an expert can get the assets back. Looking back, three signs were present: an unexpected message, a reward he never asked for, and an approval he never read. Each looked minor alone.

Several traps overlap. The first is the unsolicited prompt itself, such as a request to connect, to verify a wallet or to claim a reward. The second is any request for a recovery phrase or seed words. No genuine service needs those words, because they work like a master key. The third is that a crypto transfer is difficult or impossible to reverse, so a mistake cannot be undone by calling a card issuer. The same CAFC bulletin notes that people who have lost crypto are then targeted by recovery scams that promise to win the money back. A fourth risk sits outside the person's control. The Financial Consumer Agency of Canada says hackers may target wallet companies and exchanges to steal private keys.

A few questions can be answered alone. Did I start this connection, or did a message start it for me? Does the web address match the one I saved myself, letter for letter? Does the wallet window describe the action in words I understand, or does it ask for broad permission over many assets? Is anyone asking for seed words, a private key or a screenshot of a recovery phrase? Is a deadline being used to rush me? A prompt that fails any of these questions deserves a closed page and an unconnected wallet. Opening the wallet app directly, instead of through the link, shows whether a real request exists. Where a wallet may already be exposed, general guidance describes moving what remains to a new wallet with a fresh phrase.

The sources below hold the detail. The CAFC bulletin on evolving fraud types explains how fake connection prompts and approvals work. The wallet fraud bulletin, republished by the Financial and Consumer Services Commission of New Brunswick, covers recovery phrases and recovery scams. The Financial Consumer Agency of Canada explains crypto assets for consumers in plain language. Reports of fraud are taken by the CAFC, and keeping screenshots, wallet addresses and transaction IDs gives that body something concrete to read. This page cannot judge any single case, and it cannot say whether a given approval was genuine. It is general education, not legal or financial advice.

• A prompt to connect a wallet, verify it or claim a reward that nobody asked for is a warning sign by itself
• A recovery phrase or seed words should never be shared, whoever asks and whatever the reason given
• Crypto transfers are hard or impossible to reverse, and people who lost crypto are then targeted by recovery scams