Phishing and Scam Awareness

10 min readarticleIncludes quiz · 5 questions

Phishing is when attackers trick you into giving up secrets (seed, passphrase, 2FA codes) or sending funds to the wrong place. Learn simple checks to stay safe.

Simple definitions (plain English):

  • •Phishing: Fake messages, sites, or apps that pretend to be real to steal your info.
  • •Seed/recovery phrase: 12–24 words that unlock your wallet. Anyone with it can spend your coins.
  • •Spoofed URL: A website address that looks real but isn't (wállet.com vs wallet.com).
  • •QR swap: A QR code replaced by an attacker so your funds go to them.
  • •Support imposter: A scammer pretending to be official help (DM, email, chat).
  • •Giveaway scam: “Send 0.1 BTC, get 0.2 back.” Always fake.

Common crypto scams (spot these fast):

1) Fake giveaways and airdrops (“send first”). 2) Fake wallet/browser extensions or cloned mobile apps. 3) Phishing emails/DMs that link to login pages. 4) Support impersonation asking for seed or remote access. 5) Address/QR replacement (clipboard malware, swapped QR). 6) Investment groups promising guaranteed returns. 7) Recovery/"unlock" services that ask for your seed.

How to verify a site or app (60‑second checklist):

  • •Type the URL yourself; don't click ads or DM links.
  • •Check the exact spelling and domain (company.com, not company‑support.help).
  • •Padlock ≠ safety: HTTPS helps, but scammers use it too.
  • •On mobile/desktop stores: verify publisher name, reviews, download count, and official links from the vendor's site.
  • •For browser extensions: avoid unless essential; verify publisher and permissions.
  • •Bookmark official sites to avoid typos.

Support imposters (what real support will NEVER do):

  • •Ask for your seed, private keys, or full screenshots of your wallet.
  • •Ask you to install remote‑control software.
  • •Rush you with fear (“account locked in 10 minutes!”).

Legitimate support may ask for non‑sensitive logs or tx IDs only.

Address and QR safety:

  • •Always confirm the receive address on your hardware device screen.
  • •After pasting an address, compare first and last 4 characters.
  • •Don't trust QR codes from strangers; verify text against a trusted source.
  • •If the address changes after a second paste, suspect clipboard malware.

Red flags (walk away):

  • •Urgency + secrecy (“don't tell anyone”).
  • •Requests for seed/keys/passphrase/2FA codes.
  • •Out‑of‑band payment requests (gift cards, wire to a personal name).
  • •Too‑good‑to‑be‑true returns or matching deposits.
  • •Links sent only via ads/DMs/Telegram groups.

Safe habits (muscle memory):

  • •Keep seeds offline on paper/metal; never in photos/cloud.
  • •Use a hardware wallet for savings and verify addresses on‑device.
  • •Enable 2FA via authenticator app (not SMS) for exchange/email.
  • •Update wallets/firmware from official sources only.
  • •Do a $5 test send before moving large amounts.

If you clicked or shared something by mistake (do this now):

1) If seed/passphrase was exposed → Move funds immediately to a brand‑new wallet with a new seed. 2) If you installed a fake app/extension → Remove it, scan device, reinstall from official source, rotate passwords/2FA. 3) If clipboard/QR swap suspected → Verify on hardware screen; change device, then sweep to a new wallet. 4) If you sent funds to a scam → Transactions are irreversible; report to exchange/law enforcement quickly with tx IDs. 5) Change email/exchange passwords; enable authenticator 2FA.

Stay Skeptical, Verify Everything
Stay Skeptical, Verify Everything
Example
Look‑alike domain examples:

wallet.com  ← legit
walIet.com   ← uses a capital i instead of L
wállet.com   ← unicode accent
wallet.support‑secure.com ← unrelated subdomain

Always type the address yourself and use bookmarks.

Test Your Knowledge

This lesson includes a 5-question quiz (passing score: 75%).

Quiz functionality available in the mobile app.