What do you need to understand first?
Recovery words can restore keys in compatible wallets. That makes them useful to an attacker even if the current phone is locked. Genuine recovery is a deliberate process in a trusted setup, not a response to an unsolicited webpage or support message.
What might this look like?
A warning says your wallet must migrate and opens a form with spaces for recovery words. The warning may look official, but its request would give another party the backup. You close it without entering anything.
Where is the safety checkpoint?
How can you work through it?
Do not submit or share the words
Do not send part of the phrase as a sample or use a website to check its spelling.
Leave the supplied page
Find your own documentation. Do not trust a recovery link sent by the same person who raised the alarm.
If words were entered, treat them as exposed
Changing a login or device password does not make a disclosed recovery phrase private again. Seek verified guidance for securing affected access without sending the phrase to anyone.
Keep evidence free of secrets
Record the website and message. Do not include the phrase in screenshots, reports or requests for help.
When should you pause?
Do not ask another stranger to check whether the phrase is compromised. The disclosure itself is enough reason to treat that backup as exposed.