Keep your savings separate from the account you use with apps
When using an app to swap tokens, you choose which wallet account to connect. A simple connection lets it see your public address and request actions; it is not the same as permission to spend your tokens. Read any further approval or signing request separately.
Use a separate account for these apps and transfer in only what you intend to use. Leave long-term savings in an account you do not use with them. If you accidentally grant spending permission, this can limit the funds exposed in the affected account.
Accounts in the same wallet may share one recovery phrase. If that phrase is exposed, creating separate accounts under it does not protect them.
An unexpected “support” message is not an instruction
Scam messages use a familiar name or logo to make an unexpected request seem routine. Knowing which device you own does not prove that the sender represents its manufacturer. Focus on what the message asks you to do.
An example of a fake support message
An unexpected message claiming to be support
Your wallet will be disabled today. Verify your recovery phrase now to keep access.
- The deadline creates pressure
- A threat to cut off access is meant to make you act before checking. It is not evidence that the sender can control your device.
- The recovery phrase is the target
- “Verify” does not make sharing it harmless. Someone with the recovery information your wallet requires can gain access without your device.
Never give support your recovery phrase, private key or optional passphrase. Do not install remote-access software at an unsolicited caller’s request. A genuine-looking conversation does not make those requests safe.
Find the official app or connection instructions for your wallet
Connection, spending permission and payment are different requests
A button labelled “Continue” can lead to very different requests in your wallet. Read the request itself, including the account and network. The examples below describe ordinary connections, token allowances and transfers used in Ethereum apps.
A lower spending limit can reduce the amount exposed by that permission, but it does not establish that the app is trustworthy. If you cannot identify what a request allows, leave it unapproved.
What to do after a suspicious message or request
Stop replying to the sender and close the suspicious site. Do not approve another request from it. If you shared recovery words or a private key, handle that first, even if you also sent a payment. If you installed software at the sender’s request or gave them remote access, use another computer or phone you trust for the next steps.
You shared recovery words or a private key
Someone with those secrets may be able to spend your funds without your device. Stop using the suspicious site. Move remaining funds to a new wallet that you create and control. Set it up as a new wallet with a new backup, rather than restoring the exposed recovery words. Restoring those words on another device keeps the same keys and the other person’s access.
Keep your working wallet available until you can make the transfer safely. Follow your wallet maker’s instructions for creating the new wallet and moving funds; do not reset your only working device first. Trezor’s guide below explains the options with one device or a spare.
You pressed Confirm or Approve without understanding
Do not approve anything else from that site. Open your wallet app’s activity or transaction history. Note the account, network and transaction ID if shown. Keep any original request details you still have, but do not return to the suspicious site or sign again to recreate them.
Contact the support team for the app where the request appeared. Tell them what you pressed and share the available request or transaction details, never recovery words, private keys or a passphrase. They may be able to help assess what happened. Some signed messages leave no transaction history, so an empty history or a request that support cannot identify is not an all-clear.
You approved token spending
Open the wallet app you used and check which account and network were involved. For Ethereum-style token approvals, use the official guide below to find the permission and revoke it. Revoking cancels that permission; it usually requires a network transaction and fee. Check that the revocation has completed.
Disconnecting the site leaves existing permissions in place. If you cannot tell what you approved, use the uncertain-request advice too: a list with no active token permissions does not establish that every signed request was harmless.
You sent a payment
Open the payment in your wallet or exchange and check its status. If an exchange is still processing the withdrawal, contact that exchange immediately to ask whether it can stop it.
If the transaction is pending on the network, your wallet may offer a cancellation attempt. For MetaMask on Ethereum or a compatible network, use the cancellation instructions below. For another app, contact that app’s support. Cancellation is not guaranteed. Do not choose “Speed up” for a payment you want to stop.
Once a transfer has completed successfully on the network, your wallet provider cannot reverse it. Disconnecting the site or revoking a permission will not bring it back.
You installed software or gave remote access
Stop using that computer or phone for wallet access. Use another device you trust to get help. Ask the computer or phone manufacturer’s technical support, or a repair service you already know and trust, to check the affected device for unwanted software before you use it again. Contact them independently, using their official site or contact details you already have.
Your wallet app’s support can separately help assess wallet activity; it is not the service that checks your computer or phone. If you entered recovery words or a private key into the software, follow the exposed-secrets advice too.
You only read a message or connected the site
If you did not sign anything, share secrets or install software, close the page. If you connected your wallet, remove the site from the wallet app’s connected-sites list. Connecting alone does not authorize spending.
If you approved token spending on that site before, review those permissions too: disconnecting leaves them in place.
Choose the right support team
For a payment or signing request, start with the app where the request appeared. Open Help or Support in that app or on its official website. For MetaMask, use the Help Center below and choose “Contact support,” then “Continue without wallet.”
For a hardware-device or backup question, contact the wallet maker. Our official-app directory links to manufacturers’ app and connection pages; from there, find the maker’s own contact or support page. For example, on BitBox’s download page choose Support, then Contact us. In COLDCARD’s documentation, choose Trouble Shooting, then the Coinkite support form at the bottom.
Ignore unsolicited offers to recover stolen funds, especially requests for a fee or your recovery words.