What to check before you start
Fake domains, impersonated support and malicious approvals can all lead to loss. Verify destinations and permissions, not just the look of a site.
A practical review sequence
Local keys and self-custody
Wallet credentials demand deliberate care. Never send a recovery phrase or private key to support chats, websites or cloud notes.
Back up before you transact
Record recovery details offline and double-check the word order before adding funds or making a transfer.
Review every transaction
Check the chain, token, recipient and fees. Read approvals carefully, especially requests for unlimited spending.
Security takes more than alerts
Labels and status indicators can help flag problems, but they never replace checking the source, transaction and backup.
Risks and next steps
If a domain looks unfamiliar, a request creates urgency, or network details do not match, pause and verify through an independent trusted source.