Security Center
Phishing & Scams
A practical imtoken guide to phishing & scams, including core concepts, verification steps and risk-aware usage.
imtoken staff will never ask for your seed phrase, private key or verification code.
Core concepts
impersonation sites rarely appears in isolation. It often intersects with fake support and fake airdrops. A useful pattern is to separate each action into four checks: identify the object, verify the network, review permissions, and confirm the result. If one of those checks cannot be completed, stop and verify rather than relying on an unfamiliar site or remote instructions.
For impersonation sites, first define its role in the current task, then check whether fake support and fake airdrops are consistent. When malicious signatures is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For information verification, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: impersonation sites
- Cross-check: fake support and fake airdrops
- Review carefully: malicious signatures
- Verify afterward: information verification
Checks before you act
When using imtoken for Phishing & Scams, prioritize information that can be independently verified, such as addresses, network names, contract addresses, transaction hashes and block-explorer records. Visual design, urgency messages or claims from an unknown support account are not substitutes for verifiable on-chain details.
For fake support, first define its role in the current task, then check whether fake airdrops and malicious signatures are consistent. When information verification is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For impersonation sites, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: fake support
- Cross-check: fake airdrops and malicious signatures
- Review carefully: information verification
- Verify afterward: impersonation sites
How to evaluate a live request
From a risk perspective, information verification and impersonation sites deserve an independent review. Once a transaction is confirmed on-chain, a wallet normally cannot reverse it unilaterally. DApps and smart contracts can also introduce permission and contract risks, so every signature, approval and transfer should be understood before it is accepted.
For fake airdrops, first define its role in the current task, then check whether malicious signatures and information verification are consistent. When impersonation sites is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For fake support, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: fake airdrops
- Cross-check: malicious signatures and information verification
- Review carefully: impersonation sites
- Verify afterward: fake support
Risks and boundaries
After a Phishing & Scams task is completed, review fake support and fake airdrops to make sure the outcome matches the intent. Long-lived approvals and persistent connections should be revisited periodically. Good wallet hygiene is a repeated process of checking critical details and retaining traceable on-chain information, not a one-time setting.
For malicious signatures, first define its role in the current task, then check whether information verification and impersonation sites are consistent. When fake support is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For fake airdrops, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: malicious signatures
- Cross-check: information verification and impersonation sites
- Review carefully: fake support
- Verify afterward: fake airdrops
How to verify the outcome
To understand Phishing & Scams, treat information verification and impersonation sites as parts of the same on-chain workflow. The interface is only the entry point; the selected network, current chain state and permission scope determine what actually happens. Confirm the destination, source and network before continuing so the meaning of the request stays clear.
For information verification, first define its role in the current task, then check whether impersonation sites and fake support are consistent. When fake airdrops is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For malicious signatures, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: information verification
- Cross-check: impersonation sites and fake support
- Review carefully: fake airdrops
- Verify afterward: malicious signatures
Security checklist
- Never share your seed phrase, private key or verification code.
- Verify the address, network and amount before sending.
- Review each DApp signature and token approval independently.
- Use transaction hashes and block explorers to verify on-chain status.
- Revoke approvals and disconnect sessions that are no longer needed.