Phishing links, fake support and the bookmark habit

Phishing is a route problem

Phishing persuades you to use an attacker-controlled destination that resembles the one you intended. The route may arrive through a support reply, a search ad, a community message, a fake update or a social post. The FTC has documented impersonators buying prominent search placement to pose as businesses and direct people to fake contact routes. A top result, familiar logo or polished page is not proof of identity.

HTTPS encrypts your connection to the host shown in the address bar; it does not establish that the host is the organization you meant to reach. Check the actual hostname—not just a brand word somewhere in the URL—and inspect the request before entering a password or approving a wallet action. If a message creates urgency, do not use its link, QR code or phone number.

Reach support through a route you verify

Close the message and navigate independently: open the provider's official app, type an address you already know, or use a bookmark you saved only after checking it against the provider's official documentation. Find the support contact from that destination. Search results can help discover a starting point, but verify the domain and contact route before entering account details. The FTC's U.S. consumer guidance warns that sponsored results can impersonate businesses; ethereum.org separately says not to reply to messages claiming to be official Ethereum support. That is an Ethereum.org-specific warning, not a statement about how every service communicates.

No one helping with a self-custody wallet needs your recovery phrase or private key. Do not share passwords, one-time codes or remote access, and do not send crypto to “verify,” “unlock” or “recover” an account. Genuine support procedures differ by provider, so check the exact instructions from the independently reached help page.

Check what the page asks you to do

A real website can still present a risky action. Before signing, review the recipient, network, amount, contract or message, and permission on the device that will authorize it. A missing password prompt does not make a wallet signature harmless. If the destination or requested permission is unclear, stop rather than letting a support contact interpret it for you.

Treat urgency, secrecy and a request to move the conversation as reasons to pause—not proof by themselves. Preserve a suspicious message for reporting, but do not follow its route to “verify” it. The FTC says some crypto-investment approaches start through direct messages or dating apps and lead to fake investment sites; read its investment-scam guidance. For that specific pattern and practical next steps, see our guide to romance and crypto investment scams. If you entered credentials or signed a request, stop using the contact that sent it and follow the provider's incident instructions from a verified route. For passkeys and account recovery, read two-factor authentication and passkeys; for a wallet-specific address check, see address poisoning.