This page complements the cards on phishing and recovery phrases. It does not recommend any product or service, and it is not a full security guide.
Three habits that prevent most losses
- Your recovery phrase and private keys are for you alone. No support desk, exchange employee, tutor, regulator or friend needs them. A request for them is, by itself, proof that something is wrong.
- Treat any promise of gains as bait. Nobody can promise that a crypto-asset will rise in value. "Fixed daily gains", "doubling" and "can't lose" are the language of fraud.
- Verify through a channel you chose yourself. If a message claims to come from a company or authority, close it and contact that organisation using an address you found independently — not the link or number in the message.
Patterns that keep coming back
- The helpful stranger. Someone you have never met offers to teach, manage or "grow" anything for you, often after weeks of friendly chat.
- The fake insider. Messages pretending to be from a well-known company, a public figure or a government agency, usually with a deadline.
- The giveaway. "Send a small amount and get twice as much back." The second half never happens.
- The recovery offer. After a loss, someone promises to get the money back for an upfront fee. This is very often the same fraud a second time.
- The look-alike site or app. A copy of a real service, one letter different in the address, built to collect passwords or recovery phrases.
If it has already happened
- Stop replying and send nothing more, whatever you are told.
- Save evidence: messages, addresses, transaction identifiers, screenshots and website addresses.
- Report it to the police and to your national fraud reporting service. In the UK: Report Fraud (formerly Action Fraud) (England, Wales and Northern Ireland) or Police Scotland. In the EU, start with your national police and financial regulator.
- Tell people close to you. The same story is usually used on many people.