On this page
Start with the security boundaryCommon risk scenariosHow to recognize abnormal requestsWhat to do when something looks wrongA repeatable security checklistStart with the security boundary
When working with Phishing & Scams, avoid reducing the decision to a single button or status label. The topic connects phishing domains, fake support, fake airdrops, malicious signatures, clipboard tampering and urgency tactics. Impersonation sites, fake support, fake airdrops, malicious signing requests and remote-control scams often use urgency to make users skip verification. Base decisions on the domain, request details, address, network and contract data rather than pressure. Before continuing, identify the network, the account involved and the exact type of request so the next action has a clear context.
For Phishing & Scams, review the network, account and action type in a consistent order. Confirm the source and destination first, then the network and asset, then the amount, gas or contract parameters, and only then consider signing or approving. This process cannot remove every risk, but it reduces errors caused by a wrong network, a copied address, misunderstood permissions or an incomplete reading of transaction state. In a Phishing & Scams scenario, if a request adds a countdown, guaranteed reward, threat of account loss or demand for remote-control access, stop and verify the source before doing anything else.
Learning Phishing & Scams also means separating information that is displayed from information that is independently verifiable. Wallet labels, token symbols and DApp text are useful context, but consequential actions should be checked against addresses, network details, contract information and transaction hashes where appropriate. Your seed phrase and private keys remain your responsibility; support staff, promotions and third-party pages should never require you to send them or reveal a verification code.
Common risk scenarios
Keep key facts in one context
When working with Phishing & Scams, avoid reducing the decision to a single button or status label. The topic connects phishing domains, fake support, fake airdrops, malicious signatures, clipboard tampering and urgency tactics. Impersonation sites, fake support, fake airdrops, malicious signing requests and remote-control scams often use urgency to make users skip verification. Base decisions on the domain, request details, address, network and contract data rather than pressure. Before continuing, identify the network, the account involved and the exact type of request so the next action has a clear context.
For Phishing & Scams, review addresses, assets and fee details in a consistent order. Confirm the source and destination first, then the network and asset, then the amount, gas or contract parameters, and only then consider signing or approving. This process cannot remove every risk, but it reduces errors caused by a wrong network, a copied address, misunderstood permissions or an incomplete reading of transaction state. In a Phishing & Scams scenario, if a request adds a countdown, guaranteed reward, threat of account loss or demand for remote-control access, stop and verify the source before doing anything else.
Learning Phishing & Scams also means separating information that is displayed from information that is independently verifiable. Wallet labels, token symbols and DApp text are useful context, but consequential actions should be checked against addresses, network details, contract information and transaction hashes where appropriate. Your seed phrase and private keys remain your responsibility; support staff, promotions and third-party pages should never require you to send them or reveal a verification code.
How to recognize abnormal requests
When working with Phishing & Scams, avoid reducing the decision to a single button or status label. The topic connects phishing domains, fake support, fake airdrops, malicious signatures, clipboard tampering and urgency tactics. Impersonation sites, fake support, fake airdrops, malicious signing requests and remote-control scams often use urgency to make users skip verification. Base decisions on the domain, request details, address, network and contract data rather than pressure. Before continuing, identify the network, the account involved and the exact type of request so the next action has a clear context.
For Phishing & Scams, review signatures, approvals and contract targets in a consistent order. Confirm the source and destination first, then the network and asset, then the amount, gas or contract parameters, and only then consider signing or approving. This process cannot remove every risk, but it reduces errors caused by a wrong network, a copied address, misunderstood permissions or an incomplete reading of transaction state. In a Phishing & Scams scenario, if a request adds a countdown, guaranteed reward, threat of account loss or demand for remote-control access, stop and verify the source before doing anything else.
Learning Phishing & Scams also means separating information that is displayed from information that is independently verifiable. Wallet labels, token symbols and DApp text are useful context, but consequential actions should be checked against addresses, network details, contract information and transaction hashes where appropriate. Your seed phrase and private keys remain your responsibility; support staff, promotions and third-party pages should never require you to send them or reveal a verification code.
- Confirm the current network and account
- Verify the address, amount or contract target
- Read the exact signature or approval request
- Keep the transaction hash and verify the result
What to do when something looks wrong
Do not let urgency replace verification
When working with Phishing & Scams, avoid reducing the decision to a single button or status label. The topic connects phishing domains, fake support, fake airdrops, malicious signatures, clipboard tampering and urgency tactics. Impersonation sites, fake support, fake airdrops, malicious signing requests and remote-control scams often use urgency to make users skip verification. Base decisions on the domain, request details, address, network and contract data rather than pressure. Before continuing, identify the network, the account involved and the exact type of request so the next action has a clear context.
For Phishing & Scams, review transaction state and confirmations in a consistent order. Confirm the source and destination first, then the network and asset, then the amount, gas or contract parameters, and only then consider signing or approving. This process cannot remove every risk, but it reduces errors caused by a wrong network, a copied address, misunderstood permissions or an incomplete reading of transaction state. In a Phishing & Scams scenario, if a request adds a countdown, guaranteed reward, threat of account loss or demand for remote-control access, stop and verify the source before doing anything else.
Learning Phishing & Scams also means separating information that is displayed from information that is independently verifiable. Wallet labels, token symbols and DApp text are useful context, but consequential actions should be checked against addresses, network details, contract information and transaction hashes where appropriate. Your seed phrase and private keys remain your responsibility; support staff, promotions and third-party pages should never require you to send them or reveal a verification code.
A repeatable security checklist
When working with Phishing & Scams, avoid reducing the decision to a single button or status label. The topic connects phishing domains, fake support, fake airdrops, malicious signatures, clipboard tampering and urgency tactics. Impersonation sites, fake support, fake airdrops, malicious signing requests and remote-control scams often use urgency to make users skip verification. Base decisions on the domain, request details, address, network and contract data rather than pressure. Before continuing, identify the network, the account involved and the exact type of request so the next action has a clear context.
For Phishing & Scams, review remaining permissions and security records in a consistent order. Confirm the source and destination first, then the network and asset, then the amount, gas or contract parameters, and only then consider signing or approving. This process cannot remove every risk, but it reduces errors caused by a wrong network, a copied address, misunderstood permissions or an incomplete reading of transaction state. In a Phishing & Scams scenario, if a request adds a countdown, guaranteed reward, threat of account loss or demand for remote-control access, stop and verify the source before doing anything else.
Learning Phishing & Scams also means separating information that is displayed from information that is independently verifiable. Wallet labels, token symbols and DApp text are useful context, but consequential actions should be checked against addresses, network details, contract information and transaction hashes where appropriate. Your seed phrase and private keys remain your responsibility; support staff, promotions and third-party pages should never require you to send them or reveal a verification code.