Judge the requested action before the story
A convincing story can still request a dangerous action. Before responding, identify what the person wants you to do: send funds, reveal a secret, install software, connect a wallet, sign a message or approve a contract. Then verify the request through an independently located official channel. A logo, follower count or professional website does not establish who controls it.
The FTC describes schemes involving investment promises, impersonation and demands for cryptocurrency payments. A dashboard showing profit is not evidence that a withdrawal is possible. Repeated demands for additional deposits, taxes or verification payments to unlock a supposed balance are a reason to stop and investigate rather than keep paying.
A fictional fake-support message, checked line by line
Example: “Your wallet will be suspended in 30 minutes. Open this recovery link, enter your backup words and sign the verification.” The deadline creates pressure; the suspension claim borrows authority; the link chooses the destination for you; the backup request seeks signing control. None of those steps is validated by the sender knowing your public address.
A useful reply is no reply through that channel. Open the provider from a trusted bookmark or its independently verified website and check its support process. Do not test the supplied link with your funded wallet. Public balances and transactions can be visible to strangers; mentioning them is not proof that the sender is legitimate support.
Account access and on-chain permissions need different checks
For a service account, review recent logins, connected applications and the provider’s supported multifactor-authentication options. Use a unique password and the verified account-recovery channel. If the email account used for recovery is compromised, securing only the exchange password leaves part of the recovery path exposed.
For a wallet, inspect the actual transaction or message request. A request labelled verification can still authorize something valuable. In the conventional token-approval model, permission is tied to a spender and token on a specific network. Closing a site or disconnecting it is not the same as cancelling an on-chain allowance. Follow official wallet documentation to inspect and, where appropriate, revoke permissions.
Work out which incident you actually have
Scenario A: you received a suspicious message but did not act. Preserve it if needed, report or block the sender through the service, and do not create an incident by opening its recovery tool. Scenario B: you approved a suspicious spender. Identify the chain, token, spender and transaction, then consult the wallet’s verified approval guidance.
Scenario C: a private key or recovery phrase was exposed. Treat the signing arrangement as compromised; an allowance revocation alone cannot remove someone’s copy of the key. Use a clean, verified environment and the wallet provider’s incident instructions. This checklist cannot establish that a device is malware-free or guarantee asset recovery.
Keep an evidence record that contains no secrets
Record the date and time with timezone, affected service or network, public transaction hash, public addresses, the claimed support identity, the message and the action you actually took. Separate an attempted action from a confirmed transaction. The exchange or wallet interface and an independently opened explorer can help establish whether an on-chain transaction occurred.
Send relevant evidence only to the provider’s verified support channel and appropriate reporting authorities. Never include a recovery phrase, private key, password or authentication code. Avoid publicly naming a person as the attacker based solely on an address label; on-chain movements do not by themselves establish a real-world identity.
Do not let a recovery offer become a second loss
The FTC warns about cryptocurrency scams and provides reporting routes for U.S. consumers. Use the appropriate official channel for your jurisdiction as well as the affected service. Be skeptical of an unsolicited person who guarantees recovery, wants remote access or requests an advance payment.
For routine prevention, keep a short record of official domains, account-recovery options and wallet permissions. Review it when devices, recovery contacts or commonly used applications change. The aim is to know which access you have granted before a rushed message asks you to grant more.
Sources & further reading
- FTC: cryptocurrency scams and reporting
- Ethereum: security and support scams
- MetaMask: approvals are different from disconnecting
- Ethereum: wallet and account concepts
Educational content. Examples are illustrative. Protocols, products and rules can change; consult the linked documentation for current details.