Crypto 101 Daily

If you only learn to recognise one type of crypto attack, make it this one. Phishing — tricking you into handing over your details on a fake website — is the single most common way ordinary people lose their crypto. It doesn’t require any hacking; it just requires fooling you for a moment. Here’s how it works and how to stay safe, in plain language.

What phishing actually is

Phishing is when a scammer pretends to be a service you trust — an exchange, a wallet, a support team — to trick you into giving up sensitive information like your password, your seed phrase, or access to your account. The word is a play on “fishing”: they dangle convincing bait and wait for someone to bite.

The key thing to understand is that phishing attacks your trust, not your technology. There’s nothing to “hack” if they can simply convince you to hand over the keys yourself.

How a fake website works

The classic phishing trick is a fake version of a real website. Scammers build a near-perfect copy of a popular exchange or wallet site — same logo, same layout, same colours. The only real difference is the web address, which will be subtly wrong: a misspelling, an extra word, or a different ending (for example, a “.co” instead of “.com,” or “binance-support.com” instead of the real thing).

You arrive, you log in as usual — and you’ve just handed your username and password (or worse, your seed phrase) straight to the scammer. The site might even show an error so you don’t realise anything is wrong while they empty your account.

How people end up on these sites

Fake sites usually reach you through a link: an email pretending to be from your exchange, a direct message, a fake ad in search results, or a post on social media. The message almost always carries urgency — “Your account is at risk,” “Verify now,” “Claim your reward” — designed to make you click before you think.

How to protect yourself

A handful of habits defeat almost all phishing. Type the web address yourself or use your own saved bookmark, rather than clicking links in emails or messages. Always check the address bar carefully before logging in — look for subtle misspellings. Be deeply suspicious of any message creating urgency or offering a reward. And remember the golden rule: no legitimate company will ever ask for your seed phrase, anywhere, for any reason. If something asks for it, it’s a scam, full stop.

Turning on two-factor authentication adds another layer, so even a stolen password isn’t enough on its own. And if you’re ever unsure, stop — close the page and navigate to the real site yourself.

Key takeaways

Phishing tricks you into giving up your details on a fake website that imitates a service you trust, and it’s the most common way beginners lose crypto. The tell is almost always a subtly wrong web address, reached via an urgent link. Protect yourself by typing addresses yourself, checking the address bar, distrusting urgency and rewards, enabling 2FA, and never, ever sharing your seed phrase. When in doubt, slow down. This is education, not financial advice.

New here? This pairs closely with how to spot a crypto scam and our crypto security checklist. Understanding what a crypto wallet is also explains why your seed phrase matters so much.