Phishing-Proof Habits for Crypto: Bookmarks, Link Hygiene, and Verification Drills

Why do habits beat detection?

CISA's phishing guidance lists the usual signs: urgent or emotionally charged language, requests for personal and financial information, and suspicious links such as shortened URLs or addresses with a swapped character. It also warns that AI-generated phishing can now have perfect grammar, so the old advice to look for spelling mistakes is unreliable. The practical conclusion is that inspecting each message is a losing game over time, because the fakes keep improving and your attention does not.

A habit does not depend on inspection. If you decide in advance that you only reach your exchange from a saved bookmark or its official app, then it does not matter how convincing a message is: you never use its link. This is the difference between a rule and a judgement. Rules work when you are tired, distracted, or frightened, which is exactly when scammers time their messages. This guide builds rules, and our guides on fake support and signature phishing explain the specific scams those rules are designed to defeat.

Rule one: where may you enter a financial site?

Pick a short list of entry points and refuse all others. For each exchange, wallet, and portfolio tool you use, the allowed entries are the official app installed from the link on the provider's own website, or a bookmark you saved yourself after checking the address carefully once. Not allowed: links in email, text messages, direct messages, social media replies, QR codes you did not generate, and search-engine results, including ads. The FBI's advisory on exchange impersonation tells people not to click links sent by someone who contacts them and to navigate to the official exchange website separately, and this rule makes that advice automatic.

Setting it up takes ten minutes. Type each address by hand once, confirm it matches what the provider publishes, and save it into a dedicated bookmarks folder. Delete old bookmarks you cannot verify. On your phone, use the official app or a home-screen shortcut created from the saved bookmark. Where your provider supports passkeys, the FIDO Alliance notes passkeys are tied to a specific site, so a passkey is designed not to offer to sign in on a lookalike domain, which is a useful backstop to the bookmark habit. Search engine ads and cloned pages are one reason typed or bookmarked entry is worth the small effort.

Rule two: how does the three-source check work?

Sometimes you must verify something new: a project's site, a token contract address, a support channel. Do not trust any single source, and especially not the one that sent you. The three-source check asks for agreement from three places that an attacker would find hard to control at the same time. First, the project's own official site, reached from a source you already trust, not from the link you were given. Second, an independent reference, such as a reputable data aggregator or a block explorer entry for the asset. Third, the project's long-standing official social or documentation accounts, checked for age and history, not just a verified badge or a matching name.

If the three disagree, or you cannot reach all three, you stop. For a contract address, copy it from the project's official documentation, then compare it character by character with what the explorer and aggregator show, not just the first and last few characters, a habit our address poisoning guide at /guides/address-poisoning-lookalike-address-scam explains. Scammers can list a token with a similar name and a different contract. A mismatch costs you nothing to walk away from, and a match from three independent places is strong evidence. This is general guidance, not a guarantee, and you should still avoid anything that promises returns.

Rule three: how do I verify a support channel?

Support impersonation is covered in depth in our fake support account takeover guide at /guides/fake-support-account-takeover, so this section only adds the habit. Genuine support is something you reach from the inside: the help section of the official app, or a contact page you reach from your bookmark. Write down, once, the official support route for each provider you use and keep it in your password manager notes. Then apply a simple rule: if anyone contacts you first about your account, you end the contact and re-enter through your own saved route.

Public channels need special care. Community chats and social replies are where impersonators watch for people asking for help, then message you privately from a lookalike account. Treat every direct message offering help as unsolicited, whatever the name and avatar say. Be equally sceptical of group admins asking you to 'verify your wallet' or connect it to a link, which leads to the approval and signature problems in our signature phishing guide at /guides/signature-phishing-permit-signatures. The FTC's crypto scam guidance and the CFTC and SEC investor alert on fraudulent trading sites are worth reading alongside this for the wider pattern of fake platforms.

Four drills that make the habit automatic

Rules fade without practice, so rehearse them. Drill one, the bookmark audit: once a month, open your financial bookmarks folder and confirm each entry still goes to the right place, and delete any you cannot explain. Drill two, the stranger's link: when any message contains a link to a financial site, say out loud 'not from a message' and open your bookmark instead. Do it for harmless messages too, so the reflex exists before it matters. Drill three, the contract compare: pick any token you hold, copy its address from the official documentation, and compare it against the explorer in full. Drill four, the callback script: write a single sentence for unsolicited contact, such as 'I will contact you through the official app', and practise saying it.

Run all four in about twenty minutes. If you share your devices or help family members with their crypto, run the drills together, since older relatives and newcomers are frequent targets. The CISA recommended response to a suspicious message is to resist clicking, report it using your email platform's tools, and delete it, and if you are unsure to contact the organization directly using details from its official website or through a separate channel. The drills simply make that response your default, so that doing the safe thing takes no willpower.

What do these habits not cover?

Be honest about limits. Bookmarks and verification protect the entry point, but they do not protect you if malware on your device swaps an address after you copy it, a risk covered in our clipboard hijacking guide at /guides/clipboard-hijacking-clipper-malware. They do not stop you from knowingly signing a malicious approval on a real site that was itself compromised, which is where reading the signature request matters. And they cannot protect you from a scheme where you are persuaded to send funds voluntarily, such as a romance or investment story, which our scam checklist covers.

Treat this guide as one layer of several. Combine it with the account hardening in our security baseline checklist, strong second factors, a hardware wallet for meaningful holdings, and a small test transaction before any large transfer. If you do click something you should not have, act quickly: disconnect, change passwords from a clean device, revoke approvals, and follow our scam recovery guide. The aim is not to be perfect, but to make the common attack paths fail by default.

FAQ