Phishing

Phishing, a blend of ‘password’ and ‘fishing’, means scammers fishing for login details. They pose as a bank, a service provider or a public authority and lure you to fake websites by email, text message (‘smishing’) or phone call (‘vishing’).^[1] With Bitcoin, they are mainly after your seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×. Anyone who knows it can empty your wallet – and the money can practically never be recovered.^[2]

Typical schemes and how to protect yourself

• Fake warnings styled like a wallet maker’s: you’re asked to ‘confirm’ your words or install an ‘update’. Never enter your seed phrase anywhere – except when restoring it in your own wallet. Only get apps and updates from the official app store or the maker’s website.
• Fake login pages with a slightly altered web address, linked from emails, ads or chats: only open your exchange and wallet via a bookmark or the official app.
• Fake support by direct message, shortly after you’ve asked for help in public: legitimate companies never ask for your seed phrase, passwords or security codes.^[2]

The European financial supervisory authorities also name time pressure (‘Your account will be blocked in 24 hours’) as a warning sign.^[2] Two-factor authenticationGlossaryTwo-factor authentication (2FA)Logging in with two independent proofs, such as a password plus a code from an authenticator app. For accounts with exchanges and Bitcoin apps, 2FA is a must – and SMS codes are the weakest option.On the learning path: Stage 4 · Step 3 – Buying Bitcoin →In the glossary →× using an app or a security key adds protection. More schemes: Spotting & avoiding scams.

Test yourself