Your computer receives a message saying your cryptocurrency exchange account has been hacked. The message appears to be official, complete with the exchange’s logo, and it tells you that you have only a limited amount of time to protect your money. The message also contains a link to help resolve the issue; however, the website associated with that link is being operated by someone who wants to steal your money.
The way criminals initiate their attacks on users of cryptocurrency is by setting up fraudulent websites; acting as representatives of the company’s customer service department; urging users to sign up for fraudulent air drops; and/or by acting as though they are users of the company’s services and signing unauthorized transactions. Criminals generally do not attack the blockchain itself but instead target the individuals who have control over their wallets.
The significance of this type of attack lies in the fact that once a blockchain transaction has been finalized, it becomes extremely difficult (if not impossible) to undo. Therefore, I will now explain what goes on behind the scenes when someone falls victim to a “crypto phishing” scheme and how individuals may lower their chances of becoming victims.
What is a Crypto Phishing Attack?
Crypto phishing is a form of social engineering where an individual (the attacker) uses persuasion to trick a person (the victim) into giving up sensitive data, performing a specific action that will help the attacker.
Phishing attempts may attempt to obtain:
- Exchange passwords
- Private keys
- Recovering seed phrases or recovering a seed phrase.
- The codes for two-step verification.
- Wallet permissions
- The transaction signature
Attackers have multiple ways of contacting potential victims such as: email; SMS; social media; messaging platforms; ads; and fake customer support profiles.
The message usually causes people to act right away. For example, you may need to verify your wallet so you do not lose access to it; or you could have your account locked if you don’t do something; or you may only have a short amount of time before you lose out on receiving free money through an “airdrop.”
Do your research on any crypto website before connecting your wallet to it.
Fake sites may appear to look very similar to legitimate cryptocurrency exchanges, wallets, and dApps (decentralized applications).
Scammers can copy logos, layouts, color schemes, login pages, and many other things. They might even purchase domain names that are similar to yours but with minor spelling errors, which you may not have caught.
For example, if you create a fake website address, you can use the same name as an established company and change only one letter. Be careful when entering your domain name while using services such as creating an account (credentials) or linking your cryptocurrency wallet. You may find it helpful to bookmark the websites you use most frequently so you don’t have to search for them again each time.
The use of HTTPS is an effective method of providing security to users who access a web site; however, the presence of the padlock icon does not guarantee that the web site being accessed is owned by the organization or company represented by the web site. It should be noted that many fraudulent organizations are able to acquire a valid TLS certificate.
Avoid fake technical support, as well as, urgent messages:
“Imagine that you have made a post to your social media such as:”
Is there anyone who can help me with my wallet transaction that doesn’t seem to be working?
In about 2 minutes, you will receive a direct message from an individual claiming to be a representative of your wallet provider.
This is an instant red flag!
The people who commit fraud are posing as the administrators of cryptocurrency companies, as well as the developers of those companies’ products. They are also pretending to be employees of cryptocurrency exchanges, and customer support representatives for all of those organizations. These individuals can then direct users to fraudulent websites, or they could request that the user provide them with sensitive information under the guise of being from one of the legitimate organizations.
ignore the person that approaches you. Go directly to the company’s official website or app, without any assistance, and locate the company’s official channels for customer service.
Another big “red flag” is time pressure.
The first type of scam involves instilling fear in individuals; such as, messages like “verify now or lose your money.”
The following are five steps that can help you minimize your risk of being scammed or phished for cryptocurrency. Five ways to protect yourself from cryptocurrency scams and phishing. Five methods to lower your chances of falling victim to a cryptocurrency scam or phishing attack. Five ways to safeguard against cryptocurrency scams and phishing attacks. Five ways to defend yourself against cryptocurrency scams and phishing attacks.
Some larger security practices will help you to lessen the effectiveness of phishing attacks.
You must manage your wallets with extreme care.
You should not place all of your money in one digital wallet that connects to websites.
A person might choose to maintain a lower amount of money in their software wallet for everyday purchases, while maintaining larger balances in an alternative location such as a hardware wallet for long-term investments.
An additional wallet may also be used to test new or untested decentralized applications.
Hardware wallet private keys may be kept away from computer systems connected to the Internet; however, this is not a solution for all security issues. Users can still authorize unauthorized transactions as long as they can verify what is being authorized.
The wallet’s recovery phrase is as important. With a correctly restored recovery phrase, you can restore your wallet keys using either compatible software or hardware through restoring the device if it gets damaged or lost.
Hold back advertising of any holdings
Making a public display of large amounts of cryptocurrency can increase your chances of being targeted by phishing scams, identity theft scams, and other types of social engineering scams.
Think about what you’re sharing in your social media posts, on forums, or within public groups.
There is no reason for you to reveal how much crypto you have, which wallets you utilize, or where you store your assets to other people. Your privacy may also serve as an additional form of protection.
Keep Your Devices Safe
In addition to being dependent on the type of hardware used to access a wallet; the security of that wallet will ultimately depend upon how well secured the device(s) that are accessing it are.
Keep operating systems, web browsers, wallet applications and other types of security software up to date. Get your wallet software and/or web browser extensions only from trusted sources, do not download them via unknown links.
In order to create an effective cybersecurity strategy, businesses that deal with digital currency can implement endpoint monitoring and detection software.
In addition to being careful with the links and websites they visit, individuals should be careful with the apps, extensions, attachments and software they download, as these can take away login credentials or change what is being shown on their devices.
Prior to putting in a wallet and/or sending money to it, do some research on the website first.
The official source of information regarding the project should be reviewed along with the domain name used by the project, any available documentation for the project, its contract details (if there is a contract), and the developers of the project. There should be a higher level of caution exercised with newer projects, projects that promise unrealistic returns on investments, and projects that are primarily promoted through unwanted messages. One single social media post or an endorsement from a social media influencer cannot be trusted.
The basis of phishing lies in an attacker being able to alter the way in which a victim perceives things. This independent verification process is the weak link in the chain.
Keep Up to Date with New Attacks
The way that crypto phishers operate is changing. They now have access to a variety of software that allows them to create realistic looking emails, websites, voice samples, and video clips using AI.
With the way things have changed in the world of reviewing for spelling errors, traditional ways of checking for mistakes won’t cut it anymore. If you’re familiar with the mechanics of wallets, seed phrases, transaction signatures, exchanges and smart contracts with permissioning, you will be much better prepared to recognize potential fraudulent requests.
Common cryptocurrency phishing warning signs. Warnings that you should take notice of include:
- Unusual Requests for Your Recovery Phrase
- A request for your private key. An attempt to obtain your private key.
- A handful of misspelled web addresses.A few misspelled url’s.
- Unrequested support requests from customers.
- Fake security alerts
- Unintended Wallet Signature Requests.
- The extensions (or applications) being discussed do not have recognition from the web browser.
- Cryptocurrency up front giveaway.
- Airdrops requiring users to provide access to their private wallets.
- It is time to do something about this problem as soon as possible.
- Users can’t download software if it’s unknown. Unapproved software downloading.
- Makes false commitments and/or commits to something they cannot deliver.
Final Thoughts
There is no single app, hardware wallet, or security feature that will provide the absolute protection from crypto phishing. Protecting yourself from crypto phishing takes both the use of technology and developing good habits.
The most critical step to take is to understand completely what you are signing off on prior to doing so. You can help protect your seed phrases, as well as devices and accounts for the changes that occur. It is important not to share too much information publicly. When visiting websites, it is recommended to verify them yourself. High value assets should be kept in wallets designed specifically for those assets, and not ones being developed as part of a new kind of software.