Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
Read the complete domain
Phishing pages can copy branding and use valid HTTPS. Check the complete hostname, subdomains, spelling, and internationalized characters, preferably through saved official bookmarks. Ads, QR codes, and short links do not establish authenticity. A certificate protects transport; it does not certify the honesty of the site operator.
Verify message provenance independently
Verify urgent updates, prizes, and support requests through independently opened official channels. A phone number inside a suspicious message cannot validate that message. Accounts themselves may be compromised. Requests for seeds, asset transfers, or remote-control software deserve a pause and confirmation through a separate trusted path, regardless of profile branding.
Decode the actual request
A claim or verification flow can conceal allowances or other authority. Inspect signature type, contract, spender, amount, chain, expiry, and batch calls. Do not guess when only raw data is displayed. An off-chain signature may be submitted later, so the absence of an immediate transfer does not establish that approval was harmless.
Limits of transaction simulation
Simulation estimates behavior under particular state and assumptions. Future state, external calls, or upgrades can change outcomes, while simulation failure is not itself proof of malice. Combine it with address and permission review. A green result is not a safety guarantee, and social proof cannot resolve a mismatch between requested authority and intended purpose.
Triage after a mistaken signature
Record site, time, account, network, and request details. Distinguish connection, allowance, permit, and completed transfer. Disconnecting or changing a password may not remove the exposure. Use verified revocation or migration procedures and avoid unfamiliar rescue sites. Preserve evidence without publishing secrets or unnecessary identifying information.
Build executable habits
Before consequential actions, pause to review the bookmark, network, address, and device display. Separate browsing from important reserves, limit extensions, and maintain trusted software. Review allowances and sessions regularly. Repeatable checks do not guarantee zero risk, but they make anomalies easier to recognize than relying on visual familiarity alone.
Worked review example
A familiar-looking page with a one-letter hostname difference requests unlimited approval. HTTPS and a social post do not resolve authenticity. Stop and compare official entry points and spender details. If approval completed, investigate revocation; if the seed leaked, assess new-key migration. The appropriate response depends on the exposed authority, not merely on closing the browser tab.
