How can you use this handbook?
If you are choosing a setup, start with wallet types. If you have received a suspicious request, go straight to the scam library or the existing response guide. You do not have to complete the handbook in order.
For example, if a message asks for recovery words, open recovery-phrase phishing before working through wallet setup. A time-sensitive message does not require a time-sensitive payment.
How do you find the next useful guide?
Which wallet setup can you manage safely?
Open choose your setup- Who can spend your bitcoin?
A wallet manages the keys used to spend bitcoin. Start by finding out who controls those keys, then make a recovery plan you understand.
- Which type of wallet fits you?
Start with who controls the keys and how you would recover. Then compare where you use the wallet and which checks you can realistically maintain.
- How do you set up a mobile wallet safely?
Check the source and custody model before creating anything. If you choose self-custody, make the backup privately and understand recovery before receiving funds.
- How do you set up a hardware wallet safely?
Use the documented setup for the exact device, initialise it yourself and keep the recovery information private. Check payment details on the signing device before approving.
- What does multisig protect, and what does it add?
Multisig makes spending depend on signatures from separate keys under a chosen rule. It can reduce dependence on a single key, but adds recovery records, separate backups and coordination that you must understand.
- How can you protect the devices around your wallet?
Protect the device, the accounts around it and the way you review a payment. Updates, a screen lock and careful installation habits help, while a separate backup protects against losing the device itself.
Could you recover without your usual device?
Open back up and recover- How should you write and store a seed phrase?
Write the words privately in their exact order and keep the backup offline. Protect it from unwanted access and damage while making sure you can retrieve it when needed.
- How can you test a backup without losing access?
Keep the working wallet intact. Start with its documented backup check, and attempt a restore rehearsal only when you understand the procedure and have a separate trusted environment.
- What does a passphrase add, and what does it risk?
In compatible phrase-based wallets, an extra passphrase changes which wallet the recovery words produce. It adds a secret you must also preserve; losing it can make the words alone insufficient.
- Is your backup ready for a safe recovery?
Check that your documented recovery information is readable, complete and protected. Use this sheet to spot gaps while the working wallet remains available; do not write any secret on it.
What does the scam want you to hand over?
Open spot scams- What is the message asking you to give up?
Look past the story to the request. A message that asks for secrets, remote access or another payment deserves a pause, even if it looks familiar.
- How do you recognise fake support?
Treat unsolicited support as unverified. End the contact if it asks for recovery words, private keys, security codes, remote access or a payment to fix access.
- How can a wallet approval become a trap?
On token networks, an approval can let another address or contract spend the specified tokens. Reject requests when you cannot explain the spender, asset or permission being granted.
- What makes a free-token claim suspicious?
An unexpected token or reward message creates no obligation to claim anything. Leave the request alone if it asks for recovery words, unexplained permissions or a payment to release a reward.
- How do you check who a message is really from?
Treat the name and photograph as unverified. Confirm a sensitive request through a separate channel you already know, especially when payment details or urgency have changed.
- When does an online relationship become a payment trap?
Pause when a new online relationship turns into instructions to send money or use a supposed investment platform. Keep the decision outside the relationship by involving someone you trust.
- How can a fake platform look convincing?
A polished app or visible balance does not prove that funds are held or withdrawals will work. Check the operator independently and stop if another payment is demanded to release access.
- Why would a website ask for your recovery phrase?
A website asking you to validate, synchronise or claim funds by entering recovery words is asking for spending secrets. Leave it and use independently located recovery documentation.
- What should you do if you think you have been scammed?
Stop the contact and further payments, then use independently verified help to protect affected access. Preserve evidence and report to local police and the Canadian Anti-Fraud Centre. You do not need to solve the scam before asking for help.
- How can a SIM swap put wallet accounts at risk?
A SIM swap moves your phone number to a device controlled by someone else. It can expose calls and text-message login codes; it does not itself reveal an offline wallet backup.
- Why should you check a QR code before paying?
A QR code can carry a website link or payment details. Scanning it does not prove who placed it there or whether its destination matches your intended payment.
- What if a pasted wallet address changes?
Malicious software can replace a copied receiving address with an attacker-controlled destination. Compare the full destination at approval and stop if it differs from the recipient you intended.
- How can a browser extension steal wallet access?
A fake or malicious extension can imitate a wallet or request access to sensitive browsing information. Verify its source and permissions before installing, and never enter recovery words because a message tells you to update.
- Why should you avoid copying an address from history?
Address poisoning places a misleading address in activity you might later copy. Obtain the destination from the intended recipient, rather than treating a history entry as your address book.
- Why is a send-first giveaway a warning sign?
A giveaway that requires you to send funds to receive more is asking you to trust an unsupported promise. Do not pay to qualify, even when the account, livestream or conversation looks familiar.
- What can a fake mining dashboard hide?
A dashboard claiming that remote machines are mining for you does not prove the machines, activity or displayed balance exist. Be cautious when access depends on sending funds to an operator you cannot verify.
- Why are guaranteed payouts a scam warning?
A promise of guaranteed payouts is a reason to stop and check. In a Ponzi scheme, money from newer participants pays earlier ones instead of the activity claimed by the promoter.
- How can a pump group turn trust into a trap?
A pump-and-dump group uses hype to attract buyers while promoters can sell into that demand. Private-group access and a scheduled announcement do not put you on equal terms with the organisers.
- Why would a job ask you to deposit crypto?
A job that asks you to deposit your own funds to complete tasks or release pay is a warning sign. Stop paying and verify the employer through a route outside the recruiter's message.
- What should you do about a threatening sextortion email?
Do not pay or follow links in a threatening email. Preserve it, seek support and use official police or fraud-reporting routes. A claimed recording or an old password does not by itself prove the sender controls your device.
- How can a recovery offer become another scam?
An unsolicited offer to recover stolen funds can be another attempt to take money or secrets. Do not pay an upfront release fee or share recovery words with someone claiming to trace your wallet.
- What warning signs can precede a rug pull?
A rug pull is a scam in which people behind a token or project withdraw support or funds and leave others exposed. A familiar name or active community does not establish that a working product or reliable controls exist.
- Which scam red flags should make you pause?
Pause when a request pressures you to hand over secrets, access or funds. A warning sign is enough to stop and verify; you do not have to prove the entire scam first.
What should you check before funds move?
Open use services safely- How can you use an exchange more safely?
Before using a platform, find out who holds the keys, whether you can withdraw and what happens if the operator stops working. An account balance is only part of the picture.
- How do you send your first small test amount?
If you choose to send, use an amount whose loss you can tolerate and verify receipt at the intended destination. Review the asset, network, address, amount and fee before approving.
- What should you check before you send?
Check the purpose and recipient, then the asset, network, full address, amount and fee. If anything differs from what you intended, reject the request and resolve it before trying again.
What should your recovery plan explain?
Open plan ahead- How should you write and store a seed phrase?
Write the words privately in their exact order and keep the backup offline. Protect it from unwanted access and damage while making sure you can retrieve it when needed.
- How can you test a backup without losing access?
Keep the working wallet intact. Start with its documented backup check, and attempt a restore rehearsal only when you understand the procedure and have a separate trusted environment.
- What does a passphrase add, and what does it risk?
In compatible phrase-based wallets, an extra passphrase changes which wallet the recovery words produce. It adds a secret you must also preserve; losing it can make the words alone insufficient.
- What does multisig protect, and what does it add?
Multisig makes spending depend on signatures from separate keys under a chosen rule. It can reduce dependence on a single key, but adds recovery records, separate backups and coordination that you must understand.
- What would your heirs need to recover access?
Your heirs need to know that the wallet exists, who is authorised to act and how to find protected recovery instructions. Keep that explanation separate from the secrets that allow spending.
- What should you plan before travelling with a wallet?
Plan for losing access to a device and for the possibility of a border examination. Check the current official rules for your route and make sure recovery does not depend entirely on what you carry.
What information does your next action reveal?
Open privacy basics- How should you write and store a seed phrase?
Write the words privately in their exact order and keep the backup offline. Protect it from unwanted access and damage while making sure you can retrieve it when needed.
- What should you check before you send?
Check the purpose and recipient, then the asset, network, full address, amount and fee. If anything differs from what you intended, reject the request and resolve it before trying again.
- Why would a website ask for your recovery phrase?
A website asking you to validate, synchronise or claim funds by entering recovery words is asking for spending secrets. Leave it and use independently located recovery documentation.
- What does sharing a Bitcoin address reveal?
A Bitcoin address is a receiving detail, not a spending secret. Sharing it can connect you to public transactions, and reusing it makes activity easier to link.
Does a familiar coin name change your safety checks?
Open bitcoin family safety- What should you check about the Bitcoin family?
BTC, fork coins and projects with Bitcoin in their name are separate things. Establish the relationship before trusting a wallet, a claim tool or a network.
- What should you check about other coins?
A token can have a convincing name and still ask for dangerous access. Understand what it does, what backs its claims and what a transaction lets someone else do.