How to Protect Your Seed Phrase From Scams

A seed phrase—also called a recovery phrase—is a set of words that can restore access to a self-custody wallet. Anyone who gets it may be able to control the wallet and move its assets. Your first rule is simple: never give the phrase to another person, and never enter it into a website or form.

Scammers try to get the phrase by pretending to be wallet support, an exchange employee, a project representative, or someone helping with a transaction. They may claim your wallet is frozen, that you need to verify ownership, or that a reward is waiting. A message can look official and still be fraudulent.

Treat these requests as warning signs:

• Someone asks you to send, type, photograph, or read out your recovery words.
• A page asks you to “synchronize,” “validate,” or “upgrade” your wallet by entering the phrase.
• A stranger offers to recover funds if you share your phrase or connect your wallet.
• A supposed support agent pressures you to act quickly or keep the conversation secret.

A real wallet recovery may require entering the phrase into the trusted wallet app or hardware device you chose. That is different from giving it to a person or a page reached through a message.

Protect the phrase from both online theft and physical access. When you create a wallet, write the words down carefully and check their order against the wallet’s instructions. Store the record somewhere private and protected from theft, fire, and water. For assets that matter to you, consider keeping a second secure physical copy in a separate location.

Use this storage checklist:

• Keep the phrase on paper or another offline medium you can secure.
• Do not save it in email, cloud notes, chat, screenshots, a photo gallery, or an unencrypted document.
• Do not print it on a shared printer or leave it where visitors can see it.
• Never label it in a way that makes clear it unlocks cryptocurrency.
• Do not let anyone watch you record or enter it.

A password manager can protect ordinary account passwords, but saving a wallet’s master recovery phrase online creates a different risk: malware, account takeover, or an exposed backup could reveal it. A hardware wallet does not make sharing safe. If anyone gets the phrase, they may be able to restore the wallet elsewhere, regardless of whether your device is still with you.

When a message claims there is a problem with your wallet, stop and verify it without using the message’s instructions. Do not click its button, scan its QR code, call its number, or reply with personal information. Open the wallet app you already use from your device, or find the organization’s official support channel independently.

Before you connect a wallet or sign anything, check what the action actually does. A normal wallet connection should not require your seed phrase. A transaction or signature can still have consequences: read the wallet prompt, confirm the network and recipient, and reject anything you do not understand. If a prompt asks for a phrase on a webpage, close it.

Use these steps when you need support:

1. Stop communicating through the unsolicited message.
2. Find the official app or support channel independently.
3. Describe the issue without sharing recovery words, private keys, passwords, or one-time codes.
4. Decline requests to install remote-access software or let a stranger control your screen.

A real support conversation should not depend on you handing over the master key to your wallet. If the person insists, end the conversation and report the account or message through the service’s own reporting tools.

Scammers often use urgency and plausible stories to make you act before checking. A fake airdrop, giveaway, investment opportunity, or account alert may direct you to a page that looks like a wallet service. The page may ask for the phrase under the pretext of checking eligibility or restoring access. Entering it gives the scammer the information needed to take control.

Reduce the chance of being caught off guard:

• Be skeptical of unexpected messages, including ones from accounts that appear familiar. Their accounts may have been taken over.
• Do not trust a website just because it has a logo, polished design, or a familiar name.
• Reach services through bookmarks or an independently verified app, rather than a link in a direct message, email, or search ad.
• Never share screen recordings, photos, or screenshots that might show your phrase or wallet backup.
• Pause when a message says you must act immediately to avoid losing funds.

Keep your device and wallet software updated through their normal official update process. Use a device you control, a strong device passcode, and separate strong passwords with multifactor authentication for email and exchange accounts. These steps do not replace protecting the phrase: a compromised phrase can bypass many protections on the original device.

If you shared the phrase, typed it into an untrusted page, or believe someone photographed it, assume the wallet is compromised. Do not wait to see whether funds move. From a clean, trusted device, create a new wallet with a fresh phrase. Do not restore the old phrase into the new wallet; that would keep using the credential the scammer may have.

Then move remaining assets to addresses controlled by the new wallet. Check each destination and network carefully before sending. You may need the relevant network’s native token to pay transaction fees, and fees can vary with network conditions. If you hold assets on several networks, account for each one. For a large or complicated wallet, ask a trusted, independently verified professional for help without revealing either phrase.

After moving funds:

• Secure the email and exchange accounts connected to your crypto activity; change passwords and enable multifactor authentication.
• Review wallet activity and save transaction records and scam messages for reporting.
• If the phrase was stored in a cloud account or on a device, remove exposed copies and secure that account, but do not assume deletion makes the old phrase safe again.
• Never pay a stranger who promises guaranteed recovery or asks for another payment to release funds.

If assets have already left, report the incident to relevant platforms and local authorities. Recovery is not guaranteed, and no one can reverse an ordinary blockchain transfer simply because you report it.

Not every wallet scam starts with a request for recovery words. A fake site may instead ask you to connect a wallet and approve a transaction or token permission. That does not necessarily expose the seed phrase, but it can still authorize an action that puts assets at risk. Read each wallet prompt and understand what you are approving before you sign.

If you signed something suspicious, stop interacting with the site. Review your wallet’s transaction history and any active token permissions using a trusted wallet feature or a reputable tool you locate independently. Revoke permissions you do not recognize when you can verify what they are; revoking may require a network fee. If you are unsure whether the phrase itself was exposed, treat the wallet as compromised and move assets to a fresh wallet.

Avoid these common mistakes:

• Sharing the phrase because a message looks like it came from a familiar brand.
• Assuming a password, PIN, or hardware wallet blocks someone who has the phrase.
• Reusing the exposed phrase in a new wallet or sending assets to an address supplied by the person who contacted you.
• Paying a “recovery expert” who guarantees a refund or asks for your phrase.

A careful pause is safer than signing or transferring under pressure. When in doubt, stop, verify independently, and do not reveal your recovery words.

Make seed phrase safety part of how you use crypto, not just something you think about during wallet setup. Before a new transaction, confirm the network, recipient, and asset in your wallet. For a first transfer to a new address, a small test transfer may help you catch an address or network mistake, though it costs an additional network fee and does not prove that a recipient is trustworthy.

Keep a short personal checklist near your wallet routine:

• Has anyone asked for my phrase? If yes, stop; do not share it.
• Did I open this service independently, rather than through an unsolicited link?
• Do I understand the transaction or permission shown in my wallet?
• Is the destination address the one I intended, on the correct network?
• Can I access my offline backup without exposing it to anyone?

Review who can physically access your backup and whether your device or email account is secure. If you have shared a phrase with another person, stored it in a place others can access, or entered it into a questionable site, create a new wallet and move the assets rather than relying on the old phrase. Keep the new words private and offline. Your seed phrase is not a password to troubleshoot over chat; it is the key to your wallet.