Crypto phishing tries to make a user reveal a recovery phrase, enter credentials on a copied site, or approve a harmful transaction. The message often creates urgency or promises an unexpected reward.
Warning signs
No legitimate wallet support agent needs a seed phrase or private key. Be suspicious of unsolicited support messages, lookalike domains, sponsored search results, surprise airdrops, and instructions to “verify” a wallet by importing it.
A familiar logo is easy to copy. Check the full domain, navigate from a saved bookmark or authoritative source, and treat direct messages as unverified.
Urgency is a common manipulation tool
Messages that demand immediate action can push people to skip verification. Open services through a trusted bookmark or independently typed address instead of the supplied link.
Pause before signing
Read the wallet prompt and confirm the network, contract, amount, and permission. A signature can authorize more than a visible login, including token spending or an asset transfer.
Use separate accounts for valuable holdings and routine application use, keep software updated, and test unfamiliar services with limited value. If something feels urgent, close it and verify independently.
Legitimate support should not need secret keys
A recovery phrase or private key provides wallet control. Anyone requesting it is asking for the ability to move funds, regardless of the explanation.
Sources
Educational information, not investment advice.