Learn / Beginner · Using Crypto Safely

Safe habits checklist

Beginner · Using Crypto Safely · about 5 min read

Most crypto losses come from a few avoidable mistakes, so a short checklist of habits goes a long way.

The checklist

• Guard your seed phrase. Never share your recovery phrase or private keys, and do not screenshot them, because a screenshot can sync to the cloud.
• Use strong, unique passwords for every exchange and wallet account, and a password manager to keep track of them.
• Turn on two-factor sign-in with an authenticator app or a security key. Ethereum’s guide warns that codes sent by text message can be hijacked through SIM jacking.
• Check the address before you send. A crypto transaction cannot be reversed, so make sure the recipient matches exactly and read what you are signing.
• Check the website address before you connect a wallet, and be wary of links and attachments from people you do not know.
• Limit what apps can spend. Approve only the amount a transaction needs, and cancel approvals you no longer use.
• Consider a hardware wallet for larger amounts, since it keeps your keys offline.

Keep in mind

• Be very wary of giveaways. Offers to multiply the crypto you send are a well-known scam, and you should not hand your private keys or remote access to your computer to anyone.
• The US Federal Trade Commission says only scammers demand payment in cryptocurrency or guarantee profits.
• For the warning signs of common scams, see Scam Watch. For the one rule of seed phrases, see Seed phrases: the one rule.
• General information, not financial advice.

Why prevention beats recovery

With a bank card, a wrong or fraudulent payment can sometimes be disputed. Crypto is different. The US Federal Trade Commission notes that crypto payments usually lack the protections of credit and debit cards and are typically irreversible, and Ethereum's security guide says the same about transactions on its network. If something goes wrong, you generally get the money back only if the recipient chooses to return it. That is why habits matter more than any recovery plan: the cheapest moment to stop a loss is before you press send.

How phishing really looks

Phishing means a fake message or website built to make you hand over a password, a recovery phrase or a payment. Ethereum's guide advises against opening links or attachments from unknown senders and says to check the web address after any click, because a fake site can look identical to the real one while its address is slightly different. In practice, scammers lean on four tricks:

• Urgency. "Your account will be frozen in one hour." Real companies do not demand instant action through a text or a direct message.
• Fake support. A stranger replies to your public question, offers to "help", then asks you to share your screen or type your recovery phrase. Real support never needs your phrase.
• Lookalike websites. The address swaps a letter or uses a different ending. Open your exchange and wallet from a bookmark you saved yourself, not from an advert or a message.
• Too-good offers. Ethereum's guide says any offer to double the crypto you send is a scam, and that a celebrity name or a livestream does not make it real.

Address poisoning: a copy-and-paste trap

Crypto addresses are long strings of letters and numbers, so people rarely type them and often copy one from their recent transaction history. In an attack called address poisoning, a scammer creates an address whose first and last characters match one you use, then sends a tiny or empty transfer so the lookalike appears in your history. Later you copy the wrong one. A 2025 academic study presented at the USENIX Security Symposium found that victims were more likely to choose a lookalike that was closer in appearance or that appeared earlier in the list. Because transfers cannot be undone, the money is gone.

The defences are simple. Compare the whole address, not just the start and end. Save trusted addresses in your wallet's address book or an exchange allowlist. Copy an address from the source you trust, not from your history.

If something goes wrong

Move fast but stay calm. The FTC advises reporting a scam to the relevant agencies and contacting the exchange you used to send the money, while warning that recovery is difficult. In Trinidad and Tobago, also report it to the police and keep every message, address and transaction ID. Be careful of anyone who offers to recover your money for an upfront fee, which is a common follow-up scam. If a recovery phrase may have been exposed, move your funds to a fresh wallet with a new phrase and cancel old approvals.

Common mistakes

• Using the same password for an exchange and the email account that can reset it.
• Relying on text-message codes when your phone number is easy for others to find.
• Saving a recovery phrase in a photo, notes app or email "just for now".
• Approving unlimited spending for an app and forgetting about it.
• Testing a new app with your main wallet instead of a small spare one.
• Trusting a link because it appeared in a group chat you know.

Try it yourself

This takes about fifteen minutes and needs no money.

1. List every crypto-related account you have: exchanges, wallets, and the email address used to sign up.
2. For each one, check what kind of two-factor sign-in is on. Where you can, switch from text messages to an authenticator app or a security key.
3. Check the security of your email account first, since it can reset almost everything else.
4. Decide where a paper backup would live and write down the place, not the phrase itself.
5. Paste two crypto addresses that share the same first and last four characters into a text file and find the first character where they differ. That is exactly the check address poisoning hopes you skip.

Key terms

Two-factor sign-in, phishing, hardware wallet, approval, SIM jacking.

Sources and credits

Security guidance: ethereum.org, Stay safe. Scam warning signs and what to do if you paid: US Federal Trade Commission. Address poisoning: "Blockchain Address Poisoning" (USENIX Security 2025) and Elliptic. General information, not financial advice.

Module quiz

3 questions. Tap an answer to see if you are right and why. Get 2 right to complete the module.

Back to Learn →