A copied logo or a convincing message is not proof of identity. Use a saved official address to reach a service instead of a link in an unsolicited message. Treat urgency, guaranteed returns and requests to move a conversation as signals to pause and verify.
Use a unique password and the strongest supported second factor for exchange accounts. Never share a recovery phrase, private key or one-time login code with someone claiming to be support. A hardware wallet still needs careful review of the transaction you approve.
If something looks wrong, stop signing and use official support channels. Preserve transaction details and messages. Recovery promises can themselves be scams; do not pay an unknown party merely because they claim they can recover missing crypto.
Verify the route to the service
Use an official address saved from a trusted source. Reaching a familiar-looking login through an advertisement or message creates another step to verify.
Check the domain before entering credentials. If a request creates urgency, pause and contact the service through an independently located channel.
Protect access and approvals
Use a unique password and the strongest available second factor. Keep recovery information separate from everyday browsing.
Review wallet signatures on a trusted display. A convincing page can still request an action that has nothing to do with the task you intended.
Account recovery and wallet recovery are different processes. Use the custody and recovery guide to identify which credentials and backups your setup needs.
Keep a clear incident record
If you suspect a problem, stop further approvals and collect transaction details and messages. Use official support and relevant reporting channels.
Treat unsolicited recovery offers with the same caution as the original message. Paying another unknown party can add a second loss.
A practical checklist
- Use a saved official address.
- Keep credentials and recovery phrases private.
- Stop and verify unexpected requests.
Common questions
How can I check whether a crypto support message is genuine?
Open the organisation's official address independently and check the request through its published support channel. Logos, sender names and familiar page designs can be copied. Do not follow a message's login or recovery link merely because it looks familiar or creates urgency.
What if someone guarantees recovery of lost crypto?
Treat the guarantee as unverified. Do not provide recovery words or private keys, and do not pay an unknown party solely on that promise. Keep the transaction identifiers, messages and payment records, then contact the real provider or relevant reporting authority through an independently verified channel.
Can a hardware wallet stop a phishing transaction I approve?
Not reliably. The device helps protect keys, but cannot decide whether a recipient or contract serves your interests. Check the full address and action on the trusted display. If the request differs from your intended task, stop instead of confirming it to dismiss a warning.
What should I do first after a suspected crypto phishing incident?
Stop further approvals and avoid links or recovery offers in follow-up messages. Keep a record of what happened, including transaction identifiers and the channels used. Reach the service through verified support and follow the wallet's official security instructions. The next step depends on what information or access was exposed.
Continue exploring wallet custody and security.
Prepared from the primary sources linked below. This is documentary research, not a hands-on product test, personalised advice or an independent security audit.
Sources and further reading
- Ethereum.org - wallet safety
- Ethereum.org: security and scam prevention
- Bitcoin.org: avoiding scams
- Finanstilsynet: cryptocurrency fraud
- Ledger: hardware-wallet security practices
An introductory guide. Consider your circumstances and consult the linked primary sources.
