Crypto phishing does not usually start with a hacker breaking into your wallet; it starts with an email, a direct message or a search result that looks almost exactly like a real exchange, wallet or support team. The message creates urgency, a locked account, a missed airdrop, a suspicious login, and asks you to click a link, connect a wallet, or share a code. Because crypto transactions cannot be reversed, one click can be enough to drain funds. Learning to spot phishing before you click is therefore the single most valuable security skill in crypto, and it is easier than it sounds once you know the patterns.

Most phishing emails follow a template: a familiar logo, a greeting that uses your email address rather than your name, and an urgent call to action such as verify your account within 24 hours or your funds will be frozen. The link usually goes to a lookalike domain, for example a misspelled exchange name, an extra hyphen, or a different top-level domain, and the page it opens asks you to enter your password, seed phrase or two-factor code. Fake support scams work differently: a scammer replies to your public complaint on social media, claims to be support, and moves you to WhatsApp, Telegram or a fake live-chat site, where they ask for remote access to your device or for your seed phrase to fix the problem. Real support will never ask for either.

Before clicking anything, check three things in order. First, the sender address: hover over the name to see the real domain, and be suspicious of free email domains, misspellings, or domains that add words like support, security or verify to a real brand. Second, the link: hover over it without clicking, and check that the domain matches the official site exactly, character by character, and that it uses HTTPS. Third, the request itself: any message asking for a seed phrase, private key, wallet password or two-factor code is a scam by definition, because no legitimate service needs those to help you. If any one of those three checks fails, do not click, do not reply, and go to the official site or app directly by typing the address yourself.

Phishing is not only email: sponsored search results and app-store listings are a major source of fake wallets and exchanges. Scammers buy ads for misspelled versions of popular wallets, and the fake site or app looks identical until you enter your seed phrase, at which point it is sent to the scammer. Always download wallets and exchange apps from the official website linked from a source you trust, or from the developer's verified listing, and check download counts, reviews and developer name before installing. Bookmark the official sites you use regularly, and use those bookmarks instead of searching each time, because a single typo in a search can lead to a convincing fake.

If you clicked a phishing link but entered nothing, close the tab, run a malware scan, and change your password on the real site from a clean device. If you entered a password or two-factor code, change the password immediately, revoke active sessions in the exchange or wallet settings, and enable hardware or app-based two-factor authentication. If you entered a seed phrase, assume that wallet is compromised: create a brand-new wallet with a new seed phrase, move any remaining funds to the new wallet as quickly as possible, and never reuse the old seed phrase. If funds were stolen, report the addresses and transaction hashes to the exchange and to law enforcement, even though recovery is unlikely, because reports help track scam networks.

The best defence is a routine that removes urgency from the equation: never click links in crypto emails, always navigate to the site yourself, and treat any unsolicited support message as a scam until proven otherwise. Enable app-based or hardware two-factor authentication, use a separate email address for crypto accounts, and keep a hardware wallet for funds you do not trade daily. Tell friends and family the same rule, because scammers often target new users through social media groups and promise help that turns into theft. Phishing works because it exploits trust and urgency, and a calm, check-first habit breaks both of those levers.

This is educational content, not financial advice, and you should never share a seed phrase with anyone, for any reason.