Fake Wallets, Phishing and Malicious Signatures: Warning Signs
Published · GetBestWallet editorial
Recognize fraudulent downloads, recovery-phrase traps and dangerous signing requests before granting access.
Key takeaway
A convincing logo, search advertisement or wallet popup is not proof of legitimacy. Verify the download source and requested action independently, and stop when a request is unclear or asks for recovery secrets.
Follow the authorization request
A scam can look like a wallet update, reward claim, support session or ordinary login. Instead of judging only the branding, ask what the flow wants you to disclose or authorize. Recovery phrases grant access to accounts; approvals grant spending rights; some signatures can enable actions later. An attractive offer does not change those consequences.
Check downloads and support channels
Use a verified official domain to reach the app store or browser-extension listing. Confirm the publisher and watch for changed spellings. Unsolicited direct messages claiming to be support are not a trusted channel. Genuine troubleshooting can usually work with public transaction information and does not require your phrase, private key or remote control of an unlocked wallet.
Treat secret-entry prompts as high risk
A site asking for your phrase to activate a balance, repair synchronization or claim an airdrop is a major warning sign. Creating a new wallet should generate your own credentials, not use words handed to you by a stranger. If you intentionally restore a wallet, do so only through the verified wallet or hardware device’s documented recovery flow.
Read what a signature permits
A request that costs no gas can still authorize a token permit or trade. Check the domain, chain, amount, spender and expiry. Be cautious about opaque data or instructions to disable warnings and enable blind signing. Even a realistic transaction simulation cannot guarantee future contract behavior or every effect of a signature.
Respond to the exposure you actually had
If you only visited a suspicious page without granting permissions, close it and review the browser environment. If you signed something, preserve the request details and inspect relevant permissions. If recovery information was exposed, treat all derived accounts as at risk and plan migration to fresh credentials. Do not let a supposed rescuer rush you into another signature or recovery payment.