Cryptocurrency Security & Scam Awareness

Why cryptocurrency security matters

Digital assets can involve credentials, wallet keys, authentication codes and other information that should be protected carefully.

Unlike some traditional financial transactions, blockchain transactions may be difficult or impossible to reverse once they have been confirmed.

Security therefore begins with understanding what information should remain private and recognizing suspicious requests before taking action.

Never share sensitive credentials

Some information should be treated as highly confidential. Depending on the service, this can include passwords, private keys, recovery phrases, authentication codes and other account credentials.

What is phishing?

Phishing is a form of deception in which someone attempts to make a person reveal sensitive information or take an unsafe action.

Phishing can occur through email, text messages, social media, search results, advertisements, websites, messaging apps or other communication channels.

A phishing website may be designed to look similar to a legitimate service while actually being controlled by an unrelated party.

Common phishing warning signs

• A message creates unusual urgency or pressure.
• Someone asks for your password or authentication code.
• Someone asks for your private key or recovery phrase.
• A website address looks unusual or contains unexpected spelling.
• A message tells you to bypass normal security procedures.
• Someone claims your account will immediately be closed unless you act.
• A person asks you to send cryptocurrency to "verify" an account.

Fake customer support

Cryptocurrency users may encounter people pretending to be representatives of exchanges, wallet companies, blockchain projects, or technical-support teams.

Fraudsters may contact people through social media, phone calls, email, messaging applications, or fake support websites.

A common warning sign is a request for sensitive credentials or for the user to transfer assets as part of a supposed verification or recovery process.

How to verify support contacts

If you believe you need customer support, independently locate the organization's official website or application.

Do not rely solely on contact information provided by an unexpected caller, message, advertisement, social-media account, or search result.

Verify that you are communicating through the service's legitimate support channel.

Fake websites

Fraudulent websites can imitate the appearance, branding, or terminology of legitimate services.

A convincing design does not prove that a website is authentic.

Before entering credentials, carefully check the website address and confirm that you reached the service through a trusted source.

Impersonation scams

Impersonation occurs when someone falsely claims to be another person, company, support representative, employee, expert, or organization.

Cryptocurrency impersonation scams may use official-looking logos, names, photographs, social-media profiles, email addresses, or websites.

Treat unexpected requests for money, credentials, remote access, or urgent action with caution.

Phone scams

A caller may claim that there is a problem with an account and request immediate action.

The caller may use technical language or personal information to appear legitimate.

Caller identification alone should not be treated as proof of identity.

If you receive an unexpected call, independently locate the organization's official contact information before continuing.

Recovery phrase scams

A recovery phrase can potentially provide access to a wallet, depending on how that wallet is designed.

Fraudsters may claim they need a recovery phrase to diagnose a problem, restore an account, validate ownership, or complete a transaction.

Malware and malicious software

Malware is software designed to perform unwanted or harmful actions on a device.

Malicious software can potentially capture credentials, alter information, monitor activity, or interfere with transactions.

Keep devices and software updated and avoid installing applications from untrusted sources.

Fake applications

Fraudulent applications can imitate legitimate wallet, exchange, or cryptocurrency applications.

Before installing an application, verify the developer, source, application name, and other identifying information.

Use trusted application-distribution channels and follow the security guidance of the relevant provider.

Social-media scams

Social-media platforms can be used to distribute fraudulent cryptocurrency promotions, fake support accounts and impersonation attempts.

An account having a familiar name or profile picture does not necessarily establish that it is authentic.

Avoid relying on direct messages as proof of an individual's identity or a company's affiliation.

Investment and profit scams

Some scams promise unusually high or guaranteed returns from cryptocurrency activities.

Be cautious of claims that suggest profits are guaranteed, losses are impossible, or immediate payment is required to unlock supposed earnings.

A request to send additional cryptocurrency before a person can withdraw supposed profits is a significant warning sign.

Romance and relationship scams

Fraudsters may develop personal relationships online and eventually ask the other person to send cryptocurrency or provide financial assistance.

Emotional pressure, secrecy, urgency, and requests to send money or digital assets should be treated cautiously.

Giveaway scams

Giveaway scams may claim that a person will receive cryptocurrency after first sending cryptocurrency to a particular address.

Be extremely cautious with claims that require an upfront cryptocurrency transfer in order to receive a larger amount.

QR-code scams

QR codes can make it convenient to transfer information, but a QR code can also direct a user to an unintended destination.

Before scanning or approving a transaction, verify the destination and transaction details.

Transaction safety

Before authorizing a cryptocurrency transaction, carefully check the asset, destination address, network and amount.

Where appropriate, consider verifying a small transaction first, but remember that transaction practices vary by network and service.

Once a blockchain transaction has been confirmed, recovery may not be possible.

Account security basics

What legitimate support should not ask for

Be cautious if an unexpected person claiming to provide support asks for any of the following:

• Your wallet recovery phrase
• Your private key
• Your account password
• Your authentication code
• Remote access to your computer
• Cryptocurrency sent for "verification"
• Cryptocurrency sent to "unlock" an account

What to do if you suspect a scam

Stop communicating with the suspicious person or website.

Do not provide additional credentials or send additional assets.

If an account may have been compromised, use the relevant provider's independently verified official support process and follow its security instructions.

If you believe you have experienced fraud, consider reporting it to the appropriate authorities or platform.

Security checklist

Important limitation

No security practice can eliminate every possible risk. New scams and attack methods can appear over time.

Security information should therefore be treated as general education rather than a guarantee that an account or asset will be protected from loss.

Continue learning