What do you need to understand first?
A separate signing device can reduce exposure of keys to everyday browsing. It does not judge whether a recipient is honest. A computer can display a convincing request that you still need to reject on the device.
What might this look like?
A package includes a card with recovery words already filled in. You do not use those words or send funds. Someone else may already know them. You pause and investigate through an independently verified support route without disclosing secrets.
Where is the safety checkpoint?
How can you work through it?
Check the source and documentation
Compare what arrived against the documented setup and authenticity checks. Do not rely on packaging alone.
Initialise privately
Follow the exact device instructions yourself. Stop if supplied instructions ask you to use a prewritten recovery phrase.
Record the backup offline
Write the recovery information in order where it cannot be filmed. Follow the device instructions about where recovery words may be entered.
Understand the local protections
Learn what the device access code protects and what the backup restores. An access code and an optional wallet passphrase are different.
Practise the review
Before signing a real payment, learn how the trusted display presents its destination, amount and fee. Reject any mismatch.
When should you pause?
The device is only part of the setup. You also need a protected backup, a recovery method you understand and a habit of reading the trusted display.