Phishing websites, ads and look-alike apps

What phishing is

Phishing is an attempt to trick you into handing over something secret by pretending to be someone you trust. In crypto, the usual targets are login details, one-time codes and recovery phrases. A phishing page does not need to be clever. It only needs to look familiar for long enough for you to type something in.

Look-alike web addresses

The address bar is the most important thing on any page, and fraudsters work hard to make it look right at a glance. The addresses below are made up for illustration, using the reserved ".example" ending.

• Swapped or extra characters: "rnyservice.example" instead of "myservice.example" — "r" and "n" side by side look like "m".
• Extra words: "myservice-login-secure.example" is a completely different site from "myservice.example".
• The real name in the wrong place: in "myservice.example.account-check.example", the site you are actually on is "account-check.example". Read the part just before the first single slash, from right to left.
• Different endings: the same name with a different ending after the dot belongs to whoever registered it.
• Look-alike letters: some alphabets contain characters that look identical to Latin letters.

A padlock in the address bar only means the connection is encrypted. Fraudsters can get a padlock for their own sites easily, so it says nothing about who owns the page.

Adverts and search results

Fraudsters pay for search adverts for the names of popular services, so a fake site can appear above the real one. Others post adverts on social networks that use stolen celebrity photos or fake news headlines. The safest habit is to avoid reaching important services through adverts at all. Save the real address as a bookmark once, and use it every time.

Fake apps and browser extensions

Fake apps sometimes slip into official app stores for a while before they are removed, and fake browser extensions imitate real tools. Before installing anything that will handle accounts or keys, follow the link from the provider's official website rather than searching the store, and check the developer name, the number of reviews and the date it was first published. Be suspicious of an app that asks for your recovery phrase immediately after you install it.

Why recovery phrase pages are the biggest prize

A stolen password can often be reset, and a stolen one-time code expires within minutes. A recovery phrase captured by a phishing page gives the attacker lasting control of every key it creates, and nothing can be reset afterwards. That is why many crypto-related phishing pages skip the password entirely and go straight to "enter your recovery phrase to continue". Logging in to a service never needs those words. A page that asks for them is fake, whatever it looks like.

Messages that lead to phishing pages

Most phishing pages are reached through a message: an e-mail about a security alert, a text about a delivery or a locked account, a direct message about a prize or a problem. The message gives you a reason to click quickly. If it is about an account you really have, open the service yourself and look for the same alert there. If the alert is real, it will be waiting.

QR codes

A QR code is just a link you cannot read. Fake codes appear on posters, parking machines, letters and e-mails. Your phone usually shows the address before opening it — read it before you tap, and treat a QR code from an unexpected source like any other unknown link.

Tools that help

• Bookmarks for every important service, so you never need to search or click links.
• A password manager. Most will only fill in a password on the exact site it was saved for, so if it refuses, ask yourself why.
• Phishing-resistant sign-in, such as passkeys or hardware security keys, which do not work on a fake site. See our guide to passwords, two-factor authentication and SIM swaps.
• Updates for your browser and operating system, which include warnings about known phishing sites.

Reporting phishing

Reporting a phishing message helps get the site taken down. In the UK, forward suspicious e-mails to report@phishing.gov.uk and suspicious texts to 7726. In the EU, your national cybersecurity agency or police can receive reports, and in the US the FTC accepts reports at ReportFraud.ftc.gov. Most e-mail services also have a "report phishing" button.

This guide is general safety education. It is not financial, legal or security advice for your individual situation, and it does not recommend acquiring, holding or disposing of any crypto-asset. If you think you are dealing with fraud, contact your bank and the police.