← All articles

Security

How to Spot and Avoid Cryptocurrency Phishing Scams

By MVaults Editorial ·

Recognize fake support messages, recovery-phrase traps, and malicious approvals, and learn what to do before a suspicious request becomes a loss.

Hardware wallet beside a suspicious cryptocurrency email with a phishing warning

A convincing logo does not make a message trustworthy. Cryptocurrency phishing succeeds when someone persuades you to reveal a secret or approve an action that benefits the attacker. A hardware wallet helps protect signing keys, but it cannot make a harmful transaction safe after you authorize it.

Recognize the request behind the disguise

An email may announce a mandatory wallet check. A social account may offer support after you describe a problem. A search advertisement may imitate a familiar download page. Treat the requested action as the deciding factor: why would resolving this problem require your recovery phrase, a transfer, or permission to spend tokens?

Ledger's phishing guidance says its support team will not request your recovery words. A request to enter those words into a website or computer application is a reason to stop, regardless of how professional the page looks.

Check the destination independently

Close the unsolicited message and navigate through a bookmark you established independently. Read the complete hostname: a familiar brand inside a longer domain does not establish ownership. HTTPS encrypts a connection; it does not establish that the business behind the page is legitimate.

Download wallet software through the manufacturer's official site. Avoid installing a replacement application simply because an unexpected pop-up claims the current one is broken. Ledger's analysis of phishing attacks describes how imitation websites collect recovery phrases.

Read approvals as carefully as transfers

Some attacks never ask for your seed phrase. Instead, a fake claim page asks you to sign a token allowance or another authorization. Before confirming, establish the network, receiving address or contract, asset, and amount or permission involved. If the device cannot display enough information for you to understand the request, cancel and investigate through official documentation.

Use a simple pause rule: an unexpected transaction stays unsigned until you can explain what it does in ordinary language. A countdown, threatened account closure, or promised reward is not a substitute for that explanation.

Respond according to what happened

  • Only opened a message: close it, avoid further interaction, and report it through the service's independently verified channels.
  • Installed suspicious software: stop using that installation for wallet activity and investigate from a separate, trusted environment.
  • Granted an unwanted allowance: use the relevant wallet's or network's official instructions to inspect and revoke it. Disconnecting a website alone does not necessarily revoke an on-chain permission.
  • Disclosed recovery words: treat the wallet as compromised. From a trusted device and official software, create a new wallet with a newly generated phrase and arrange to move remaining assets. The old phrase cannot be made secret again by changing a PIN.

Do not send a second payment to an unsolicited person promising guaranteed recovery. Keep transaction references and evidence, and seek help through verified channels without sharing private keys or recovery words.

Further reading