Phishing & Scams

Core security principles

Why “Verify the domain” matters

Phishing & Scams combines concepts that are related but should not be collapsed into one generic confirmation. Phishing pages often use similar domains, ads or social messages to create a credible appearance, so domain spelling deserves close inspection. If everything is treated as a single “approve” step, it becomes easy to miss network identity, permission scope or transaction state. A better learning sequence asks what is happening, who controls the relevant key or contract, where the action will execute, and what public information can confirm the result. Treat “Verify the domain” as an independent review step rather than an assumption. Avoid the common failure mode of Look-alike sites; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

The practical value of understanding Phishing & Scams is not to add friction; it is to make each action explainable. Fake support may claim account problems, compensation or recovery and then ask for seed phrases, private keys or verification codes; do not comply. Users should be able to distinguish what the wallet displays or signs from what a blockchain, contract or third-party DApp ultimately executes. A useful sequence is source, network, object, permission and result, with “Refuse recovery-material requests” included whenever it is relevant to the request. Avoid the common failure mode of Fake support; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

A verification-first approach is especially useful for Phishing & Scams. Fake airdrops and reward pages can push signatures or approvals even without asking for a private key, creating permission risk. Familiar names can refer to different networks, contracts or protocol objects, so names help orientation but do not replace network and address checks. Building “Do not skip signature review for rewards” into the workflow reduces mistakes caused by copy-and-paste changes, network switching or a misleading request description. Avoid the common failure mode of Fake airdrops; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

How high-risk situations develop

Why “Refuse recovery-material requests” matters

The practical value of understanding Phishing & Scams is not to add friction; it is to make each action explainable. Fake support may claim account problems, compensation or recovery and then ask for seed phrases, private keys or verification codes; do not comply. Users should be able to distinguish what the wallet displays or signs from what a blockchain, contract or third-party DApp ultimately executes. A useful sequence is source, network, object, permission and result, with “Refuse recovery-material requests” included whenever it is relevant to the request. Avoid the common failure mode of Fake support; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

A verification-first approach is especially useful for Phishing & Scams. Fake airdrops and reward pages can push signatures or approvals even without asking for a private key, creating permission risk. Familiar names can refer to different networks, contracts or protocol objects, so names help orientation but do not replace network and address checks. Building “Do not skip signature review for rewards” into the workflow reduces mistakes caused by copy-and-paste changes, network switching or a misleading request description. Avoid the common failure mode of Fake airdrops; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

For Phishing & Scams, ask three questions before acting: which network is active, which address or contract is involved, and what permission or transaction result will this request create? Requests to install remote-control software, share a screen or import a wallet on a public computer should be treated as high-risk situations. Only after those questions are answered do button labels and status messages become meaningful. In particular, “Refuse remote-control access” should be consistent with the wallet request, the DApp context and any public on-chain information available. Avoid the common failure mode of Clipboard hijacking; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

Recognize suspicious requests

Why “Do not skip signature review for rewards” matters

A verification-first approach is especially useful for Phishing & Scams. Fake airdrops and reward pages can push signatures or approvals even without asking for a private key, creating permission risk. Familiar names can refer to different networks, contracts or protocol objects, so names help orientation but do not replace network and address checks. Building “Do not skip signature review for rewards” into the workflow reduces mistakes caused by copy-and-paste changes, network switching or a misleading request description. Avoid the common failure mode of Fake airdrops; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

For Phishing & Scams, ask three questions before acting: which network is active, which address or contract is involved, and what permission or transaction result will this request create? Requests to install remote-control software, share a screen or import a wallet on a public computer should be treated as high-risk situations. Only after those questions are answered do button labels and status messages become meaningful. In particular, “Refuse remote-control access” should be consistent with the wallet request, the DApp context and any public on-chain information available. Avoid the common failure mode of Clipboard hijacking; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

When working with Phishing & Scams, start by separating interface messages from facts that can be verified on-chain. Phishing pages often use similar domains, ads or social messages to create a credible appearance, so domain spelling deserves close inspection. A reliable process therefore looks beyond a single button state or asset label and keeps the active network, account, public address and request type in the same context. The goal is not to memorize one screen layout; it is to know which details remain verifiable even when an interface changes. Make “Verify the domain” a repeatable checkpoint so the same reasoning still works on another device or after a network switch. Avoid the common failure mode of Look-alike sites; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

• Verify the domain
• Refuse recovery-material requests
• Do not skip signature review for rewards
• Refuse remote-control access

What to do when something looks wrong

Why “Refuse remote-control access” matters

For Phishing & Scams, ask three questions before acting: which network is active, which address or contract is involved, and what permission or transaction result will this request create? Requests to install remote-control software, share a screen or import a wallet on a public computer should be treated as high-risk situations. Only after those questions are answered do button labels and status messages become meaningful. In particular, “Refuse remote-control access” should be consistent with the wallet request, the DApp context and any public on-chain information available. Avoid the common failure mode of Clipboard hijacking; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

When working with Phishing & Scams, start by separating interface messages from facts that can be verified on-chain. Phishing pages often use similar domains, ads or social messages to create a credible appearance, so domain spelling deserves close inspection. A reliable process therefore looks beyond a single button state or asset label and keeps the active network, account, public address and request type in the same context. The goal is not to memorize one screen layout; it is to know which details remain verifiable even when an interface changes. Make “Verify the domain” a repeatable checkpoint so the same reasoning still works on another device or after a network switch. Avoid the common failure mode of Look-alike sites; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

Phishing & Scams combines concepts that are related but should not be collapsed into one generic confirmation. Fake support may claim account problems, compensation or recovery and then ask for seed phrases, private keys or verification codes; do not comply. If everything is treated as a single “approve” step, it becomes easy to miss network identity, permission scope or transaction state. A better learning sequence asks what is happening, who controls the relevant key or contract, where the action will execute, and what public information can confirm the result. Treat “Refuse recovery-material requests” as an independent review step rather than an assumption. Avoid the common failure mode of Fake support; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

Maintain your security boundaries over time

Why “Verify the domain” matters

When working with Phishing & Scams, start by separating interface messages from facts that can be verified on-chain. Phishing pages often use similar domains, ads or social messages to create a credible appearance, so domain spelling deserves close inspection. A reliable process therefore looks beyond a single button state or asset label and keeps the active network, account, public address and request type in the same context. The goal is not to memorize one screen layout; it is to know which details remain verifiable even when an interface changes. Make “Verify the domain” a repeatable checkpoint so the same reasoning still works on another device or after a network switch. Avoid the common failure mode of Look-alike sites; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

Phishing & Scams combines concepts that are related but should not be collapsed into one generic confirmation. Fake support may claim account problems, compensation or recovery and then ask for seed phrases, private keys or verification codes; do not comply. If everything is treated as a single “approve” step, it becomes easy to miss network identity, permission scope or transaction state. A better learning sequence asks what is happening, who controls the relevant key or contract, where the action will execute, and what public information can confirm the result. Treat “Refuse recovery-material requests” as an independent review step rather than an assumption. Avoid the common failure mode of Fake support; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.

The practical value of understanding Phishing & Scams is not to add friction; it is to make each action explainable. Fake airdrops and reward pages can push signatures or approvals even without asking for a private key, creating permission risk. Users should be able to distinguish what the wallet displays or signs from what a blockchain, contract or third-party DApp ultimately executes. A useful sequence is source, network, object, permission and result, with “Do not skip signature review for rewards” included whenever it is relevant to the request. Avoid the common failure mode of Fake airdrops; it encourages action before the relevant context is understood. imtoken educational pages never require a seed phrase, private key, recovery phrase or verification code.