Look-alike entry points
“Look-alike entry points” deserves its own checkpoint when working with Phishing & Scams. It can affect network selection, account control, transaction confirmation or permission scope, so a single interface label should not be treated as the full story.
In a Phishing & Scams workflow, build a short verification chain: confirm the source, confirm the target, review the permission or amount, then verify the on-chain result. This helps prevent different networks, contracts or sessions from being mixed together.
Security starts with keeping control secrets private. A seed phrase, private key or recovery phrase should not be sent to anyone or entered on an untrusted page. Verification codes should also remain private, including from people claiming to be support staff.
After working through “Look-alike entry points,” keep only the non-sensitive references you may need later, such as a transaction hash, network name or public address. Do not store or forward a seed phrase, private key, recovery phrase or verification code.
- Confirm the network and account related to “Look-alike entry points”
- Verify the source or DApp domain
- Read the actual transaction, signature or approval request
- Check the resulting transaction state and any permissions left behind
Fake support and airdrops
“Fake support and airdrops” deserves its own checkpoint when working with Phishing & Scams. It can affect network selection, account control, transaction confirmation or permission scope, so a single interface label should not be treated as the full story.
In a Phishing & Scams workflow, build a short verification chain: confirm the source, confirm the target, review the permission or amount, then verify the on-chain result. This helps prevent different networks, contracts or sessions from being mixed together.
Risk often appears inside a flow that looks familiar: a look-alike domain, a broad approval, a clipboard-modified address, remote-control software or a misleading signature request. Separate the source, target, permission and expected result instead of trusting the overall appearance.
After working through “Fake support and airdrops,” keep only the non-sensitive references you may need later, such as a transaction hash, network name or public address. Do not store or forward a seed phrase, private key, recovery phrase or verification code.
- Confirm the network and account related to “Fake support and airdrops”
- Verify the source or DApp domain
- Read the actual transaction, signature or approval request
- Check the resulting transaction state and any permissions left behind
Malicious signatures
“Malicious signatures” deserves its own checkpoint when working with Phishing & Scams. It can affect network selection, account control, transaction confirmation or permission scope, so a single interface label should not be treated as the full story.
In a Phishing & Scams workflow, build a short verification chain: confirm the source, confirm the target, review the permission or amount, then verify the on-chain result. This helps prevent different networks, contracts or sessions from being mixed together.
If something appears abnormal, stop additional signing, approvals or transfers and review what has already happened on-chain. Permissions that are no longer needed can be considered for revocation after verifying the correct network and approval record.
After working through “Malicious signatures,” keep only the non-sensitive references you may need later, such as a transaction hash, network name or public address. Do not store or forward a seed phrase, private key, recovery phrase or verification code.
- Confirm the network and account related to “Malicious signatures”
- Verify the source or DApp domain
- Read the actual transaction, signature or approval request
- Check the resulting transaction state and any permissions left behind
After spotting a problem
“After spotting a problem” deserves its own checkpoint when working with Phishing & Scams. It can affect network selection, account control, transaction confirmation or permission scope, so a single interface label should not be treated as the full story.
In a Phishing & Scams workflow, build a short verification chain: confirm the source, confirm the target, review the permission or amount, then verify the on-chain result. This helps prevent different networks, contracts or sessions from being mixed together.
Security starts with keeping control secrets private. A seed phrase, private key or recovery phrase should not be sent to anyone or entered on an untrusted page. Verification codes should also remain private, including from people claiming to be support staff.
After working through “After spotting a problem,” keep only the non-sensitive references you may need later, such as a transaction hash, network name or public address. Do not store or forward a seed phrase, private key, recovery phrase or verification code.
- Confirm the network and account related to “After spotting a problem”
- Verify the source or DApp domain
- Read the actual transaction, signature or approval request
- Check the resulting transaction state and any permissions left behind
Important reminder
Seed phrases and private keys should remain under the user’s control and should never be sent to anyone. On-chain transactions generally cannot be unilaterally reversed by a wallet, and third-party DApps, smart contracts, bridges or staking services can introduce technical, market and operational risks.