What is a phishing scam?
A phishing scam is an attempt to deceive users into providing access to sensitive information. In the context of cryptocurrency, phishing scams often aim to:
- Steal a user’s recovery phrase, or
- Connect a user’s wallet to a malicious smart contract.
These scams may come in the form of emails, texts, fake websites, or fraudulent dapps and NFTs, all designed to appear legitimate or to impersonate a trusted source. The goal of these phishing attempts is to obtain information that allows the attacker to steal tokens or funds.
What actions should be taken if connected to a malicious website?
If a wallet has been connected to a malicious website or if funds have been unexpectedly withdrawn, follow these steps:
- Move all funds to an uncompromised wallet address immediately.
- Delete the compromised account.
- Report the malicious website and alert any entities being impersonated.
For reporting phishing, use services such as Google’s Report Phishing Page.
How to identify a malicious website
- Verify the URL: Malicious websites may look similar to legitimate ones, but the URL cannot be faked. Open a browser, type the trusted website’s URL, and compare it to the one in question. If there are discrepancies, do not visit the suspicious URL.
- Check the security certificate: Click the padlock icon in the browser’s address bar to review the site’s security certificate. Ensure the details match the legitimate organization's information.
- Search for phishing reports: Paste the URL into a search engine and check if it is associated with any phishing or scam reports.
- Be cautious of unrealistic offers: Tokens with real value are rarely given away for free. Be wary of offers that seem too good to be true.
Check wallet balance and activity
If the wallet balance is unexpectedly low or the blockchain explorer shows unfamiliar transactions, investigate recent activity. If a new dapp or website was connected, or a recovery phrase was entered, the wallet may have been compromised. Corrective action should be taken immediately.
Never enter a recovery phrase unless the website or wallet is completely trusted. If anything seems suspicious, stop and verify the legitimacy of the site or wallet.
Is fund recovery possible?
Due to the immutable nature of blockchain transactions, recovery of stolen funds is not possible. To prevent further losses, follow the steps outlined above.
Disclaimer: Users are encouraged to conduct their own research. Valora is a self-custodial wallet and does not assume responsibility for any loss of funds.