Core security principles
Phishing sites often use look-alike domains, search ads, social messages, and fake support to create urgency, with the goal of stealing recovery secrets or inducing malicious signatures. When working with Phishing & Scams, separate what the interface displays from facts that can be verified on-chain. A wallet can organize information and prepare requests, but the network, address, contract, and final transaction state still need independent context. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Fake airdrops and refunds often ask users to connect a wallet or pay a small fee first; unfamiliar assets and links should not become more trustworthy because they are described as free or time-limited. In a real workflow, Phishing & Scams should not be reduced to a single click or one status message. Review the network, account, requested action, amount, and permission scope as separate checkpoints so inconsistencies become visible earlier. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Key fields
- Confirm that the network, address, or contract involved in Phishing & Scams matches the intended context
- Use public information for verification and never submit a seed phrase, private key, or verification code
- Treat signatures, approvals, transfers, and contract calls as separate decisions rather than permanent trust
Common risk scenarios
Fake airdrops and refunds often ask users to connect a wallet or pay a small fee first; unfamiliar assets and links should not become more trustworthy because they are described as free or time-limited. In a real workflow, Phishing & Scams should not be reduced to a single click or one status message. Review the network, account, requested action, amount, and permission scope as separate checkpoints so inconsistencies become visible earlier. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
If something appears suspicious, stop interacting, preserve evidence such as the domain and transaction hash, and verify through an independent source instead of following the same contact’s instructions. Risk often hides inside familiar-looking details. Similar names, addresses, domains, and repeated confirmation dialogs can make a request feel routine even when the underlying target or authority is different. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Order of operations
- Confirm that the network, address, or contract involved in Phishing & Scams matches the intended context
- Use public information for verification and never submit a seed phrase, private key, or verification code
- Treat signatures, approvals, transfers, and contract calls as separate decisions rather than permanent trust
Recognition and response
If something appears suspicious, stop interacting, preserve evidence such as the domain and transaction hash, and verify through an independent source instead of following the same contact’s instructions. Risk often hides inside familiar-looking details. Similar names, addresses, domains, and repeated confirmation dialogs can make a request feel routine even when the underlying target or authority is different. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Phishing sites often use look-alike domains, search ads, social messages, and fake support to create urgency, with the goal of stealing recovery secrets or inducing malicious signatures. After a Phishing & Scams action, review the final state and retain non-secret reference information such as the transaction hash, network name, or contract address when relevant so later verification is possible. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Risk signals
- Confirm that the network, address, or contract involved in Phishing & Scams matches the intended context
- Use public information for verification and never submit a seed phrase, private key, or verification code
- Treat signatures, approvals, transfers, and contract calls as separate decisions rather than permanent trust
Long-term security habits
Phishing sites often use look-alike domains, search ads, social messages, and fake support to create urgency, with the goal of stealing recovery secrets or inducing malicious signatures. After a Phishing & Scams action, review the final state and retain non-secret reference information such as the transaction hash, network name, or contract address when relevant so later verification is possible. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Fake airdrops and refunds often ask users to connect a wallet or pay a small fee first; unfamiliar assets and links should not become more trustworthy because they are described as free or time-limited. When working with Phishing & Scams, separate what the interface displays from facts that can be verified on-chain. A wallet can organize information and prepare requests, but the network, address, contract, and final transaction state still need independent context. If a critical field cannot be explained, stop before confirming and verify it again instead of responding to urgency from a page, an unknown contact, or short-term market movement.
Post-action review
- Confirm that the network, address, or contract involved in Phishing & Scams matches the intended context
- Use public information for verification and never submit a seed phrase, private key, or verification code
- Treat signatures, approvals, transfers, and contract calls as separate decisions rather than permanent trust