iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most effective protection is layered: use a different, strong password for every exchange and email account; turn on multi-factor authentication (MFA); open services through a bookmark or an independently verified address; never disclose a password or one-time code to an unsolicited contact; and compare every character of a crypto destination address before approving a transfer. Treat unexpected “support” calls, urgent account warnings, search ads, and recovery offers as possible scams until you verify them through a channel you found yourself.
If an account or wallet is compromised, stop communicating with the suspect, contact the exchange through its official channel, preserve transaction evidence, and report the incident promptly to the FBI’s Internet Crime Complaint Center (IC3). Do not pay anyone who promises guaranteed recovery: that offer can be a second scam.
What “phishing” and “account takeover” mean in cryptocurrency
Phishing is a deception designed to make you surrender a password, MFA code, identity document, seed phrase, private key, or transaction approval. A fraudulent page can copy an exchange’s colors, wording, and login form closely enough to look genuine. The attacker captures what you type and uses it on the real service.
An account takeover (ATO) occurs when a criminal gains control of an exchange, email, password-manager, or other account and then changes settings, withdraws assets, or uses the account to attack other people. Cryptocurrency adds an important complication: a confirmed blockchain transfer is generally not reversible by the exchange or the recipient’s bank.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Exchange impersonation
The FBI describes a common pattern: an unsolicited call, text, email, or direct message claims that your exchange account is compromised or has a problem. The sender creates urgency and asks for login details, identity information, a one-time code, or a click on a supplied link. Once the criminal has that information, they try to enter the real account and move the cryptocurrency.
End the conversation. Find the exchange’s official website or phone number independently, rather than using the contact information in the message. An authentic support representative should not need your password or an MFA code.
Lookalike login pages and malicious links
Search advertising, social media posts, text messages, and email can all lead to a counterfeit login page. A correct-looking logo or a padlock icon does not prove that the domain belongs to the exchange. The FBI’s account-takeover guidance states: “MFA will not protect you if you land on a fraudulent login page.” MFA can stop an attacker who only has your password, but it cannot help if you hand the code to a fake site that relays it in real time.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fake technical or customer support
A pop-up, caller, or message may claim that your device or account has a security problem. The scammer may ask you to install remote-access software, reveal a code, or pay an unexpected support fee in cryptocurrency. Close the pop-up, hang up, and contact the provider through a route you located independently. Never grant remote access to someone who contacted you unexpectedly.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Address poisoning
Address poisoning targets the transaction itself. An attacker creates or uses an address that resembles one you have paid before, sometimes matching several characters at the beginning and end. Wallet interfaces and copied address lists can make a short visual comparison seem reassuring. Compare the complete destination address with the intended recipient before confirming; a matching prefix and suffix are not proof of a match.
Build protection in layers
| Risk | Primary control | What the control does | Important limitation |
|---|---|---|---|
| Reused or guessed password | Unique, complex password | Prevents a breach at another service from opening the exchange account. | You still need to protect the email account used for recovery. |
| Stolen password | MFA on the exchange, email, and other critical accounts | Adds a second proof of identity, such as an authenticator code or hardware token. | It does not protect credentials typed into a fraudulent login page. |
| Fake login URL | Bookmark or independently verified address | Avoids links and ads supplied by an attacker. | A bookmark can be replaced if your device or browser is already compromised; inspect the destination when creating it. |
| Impersonated support | End unsolicited contact and call the official channel you found | Separates a real account issue from a social-engineering attempt. | Do not use a phone number or link supplied by the caller. |
| Wrong recipient address | Full-address verification before signing | Stops lookalike addresses from receiving a transfer. | It cannot reverse a transfer already confirmed on the network. |
| Post-incident fraud | Prompt reporting and evidence preservation | Gives investigators transaction and communication details while they are available. | Reporting does not guarantee that funds can be recovered. |
Secure the accounts that control your crypto
Use a different password everywhere
Create a long, random password for each exchange, email account, password manager, and cloud account. Never reuse an exchange password on email: control of the email inbox can let an attacker reset the exchange password or intercept security notices. A password manager can generate and store unique passwords so you do not have to memorize them, but protect the manager with its own strong, unique password and MFA where available.
- Do not use a password that appears in another service’s breach, a public profile, or a common phrase.
- Do not share a password with support staff, friends, or a caller who claims to be from the exchange.
- Change a password immediately if you entered it into a suspicious page, reused it elsewhere, or disclosed it to anyone.
Turn on MFA before you need it
Enable MFA on the exchange, the email address used for that exchange, and your password manager. The Federal Trade Commission identifies authenticator applications, one-time passcodes, and hardware tokens as MFA methods. The exact choices and recovery process vary by provider, so check each provider’s current security instructions.
| MFA method | Questions to ask before choosing it |
|---|---|
| Authenticator application | Can you transfer the authenticator safely to a replacement phone? Does the service provide recovery codes, and can you store them offline? |
| One-time passcodes | Are codes delivered by an option that remains under your control? What happens if your phone number is lost or transferred? |
| Hardware token or security key | Does the specific exchange, email provider, and password manager support the key? Can you register a second key and keep it securely as a backup? |
These methods are not interchangeable in every service, and the available options can change. Do not assume that an exchange supports a particular security key until its own documentation confirms it. Keep recovery codes or backup methods in a secure place that is not exposed to the same theft or malware as your primary device.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect the email account first
Your email inbox often receives password-reset links, withdrawal notices, and identity-verification messages. Use a unique password and MFA there before relying on the email account to secure an exchange. Review forwarding rules, recovery addresses, active sessions, and devices you do not recognize. Remove old sessions and update recovery details through the provider’s official settings page.
Reach the real exchange, not an imitation
- Start from a known-good route. Type the exchange’s address yourself, use a bookmark you created after verifying the domain, or locate the official site through a trusted record. Do not use the link in an unexpected alert, direct message, or search advertisement.
- Inspect the domain before entering anything. Look for misspellings, extra words, unusual subdomains, deceptive characters, or a different top-level domain. A padlock only indicates an encrypted connection to that domain; it does not prove the domain is the exchange.
- Use the service’s own app or security page when practical. Open the app from your device’s normal application list and check account alerts there instead of following a message link.
- Stop at any unusual request. A demand for your password, MFA code, seed phrase, private key, remote access, or an urgent cryptocurrency payment is a reason to end the interaction and verify independently.
When you receive an unexpected account alert, do not reply to the sender. Open a separate browser window or the official app, sign in through your saved route, and look for the same alert. If it is not visible there, treat the message as fraudulent.
Handle support calls and messages safely
- Legitimate support does not need your password, seed phrase, private key, or one-time passcode.
- Do not install remote-control software at an unsolicited caller’s direction.
- Do not read a verification code aloud, even if the caller already knows your name or partial account details.
- Do not pay an unexpected support caller in cryptocurrency. A payment request is not proof that the person works for the exchange.
- Save the message or caller details only after ending the interaction; do not keep chatting to gather evidence.
If you need help, navigate to the exchange’s official help center yourself and use the contact method listed there. Compare the address in the browser with the address you normally use. An independently found phone number is safer than a number in a pop-up, email, or social-media reply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsVerify every crypto transaction
Before you copy an address
Use the recipient’s address from a trusted, current source. If you are paying a person or business, confirm the address through a second channel that is not the same chat or email thread that supplied it. Be alert when a familiar address suddenly changes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before you approve the transfer
- Compare the entire address shown by your wallet or exchange with the intended address character by character. Expand truncated fields where the interface permits.
- Confirm the network or asset type as well as the address. A correct-looking string on the wrong network can still result in loss.
- Check the amount, destination label, and any memo or tag required by the recipient.
- If the amount is significant or the address is new, send a small test amount only when the recipient and network support that approach, then verify receipt before sending the remainder.
- Review the final confirmation screen on the device that will sign the transaction. Do not approve a request that differs from the one you initiated.
Do not rely on the first and last few characters alone. Address-poisoning attacks are designed to pass that shortcut.
Choose a wallet with the right expectations
The U.S. Department of Justice describes several wallet forms: hardware devices, software wallets, mobile applications, paper keys, and exchange-associated online accounts. This is a custody choice, not a guarantee against phishing.
| Wallet form | What it changes | What it does not automatically solve |
|---|---|---|
| Exchange-associated online account | The provider holds or manages the online account and its withdrawal controls. | It does not prevent a fake login page, stolen password, compromised email, or social engineering. |
| Software or mobile wallet | Keys and signing activity are managed through software on a computer or phone. | Malware, a malicious approval, or a wrong destination address can still result in loss. |
| Hardware wallet | Keys are held on a dedicated device and transactions are reviewed through its signing workflow. | It does not make a fraudulent website, malicious contract, or deceptive address trustworthy. |
| Paper keys | Key material is kept offline on paper. | Loss, theft, damage, or photographing the key can permanently expose or destroy access. |
Whichever form you use, never type a seed phrase or private key into a website, send it to support, or store it in an unsolicited form. A hardware wallet may be appropriate for some custody arrangements, but it is not a substitute for verifying websites, contacts, and transaction details.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to do if an account or wallet is compromised
- Stop the attacker’s channel. End the call, close the fraudulent page, disconnect remote-access software, and do not continue negotiating.
- Secure a clean device. If you suspect malware or remote access, use a different trusted device to change credentials and contact the exchange. Do not conduct the response on a machine the attacker may control.
- Contact the exchange through its official route. Use the website or app you located independently. Tell support that you suspect account takeover, ask about freezing withdrawals or sessions, and follow the provider’s identity-verification process.
- Change exposed credentials. Change the exchange password, the email password, and any other account that reused either password. Revoke unknown sessions, API keys, withdrawal addresses, and connected applications where the provider offers those controls.
- Protect remaining assets. Follow the exchange’s verified instructions for securing or moving funds. Do not take hurried action based on a caller’s directions, and do not reveal a seed phrase or private key.
- Preserve evidence. Keep transaction IDs, wallet addresses, amounts, cryptocurrency type, dates and times, domains, application names, phone numbers, email addresses, usernames, screenshots, and a timeline of what happened.
Do not promise yourself that a transfer can be reversed. Blockchain settlement and exchange policies differ, and a confirmed transfer may not be recoverable.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Report the theft and recognize recovery scams
Report suspected cryptocurrency fraud promptly to the FBI’s Internet Crime Complaint Center (IC3). Include as much transaction information as possible: the sending and receiving wallet addresses, amount and cryptocurrency type, date and time, and transaction ID or hash. Add the communications and account details you preserved.
Be skeptical of anyone who contacts you after the theft and claims to be able to recover your funds. Recovery scammers may ask for an upfront fee, taxes, private keys, remote access, or another cryptocurrency payment. No caller can guarantee recovery merely because they know a transaction hash or claim to work with investigators.
How widespread is account-takeover fraud?
In an FBI alert dated November 25, 2025, the bureau reported more than 5,100 complaints involving account-takeover fraud and losses exceeding $262 million since January 2025. Those figures cover account-takeover fraud generally, not cryptocurrency-only losses, so they should not be interpreted as a crypto-specific total.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
A practical maintenance routine
When opening or changing an account
- Create a unique password and store it in your password manager.
- Enable MFA on the exchange and the associated email account.
- Save the verified login page as a bookmark and record the official support route separately.
- Store recovery codes or a backup MFA method securely and test the recovery process before an emergency.
Before every sign-in
- Use the bookmark or official app, not a message link or advertisement.
- Check the domain and stop if the page behaves unexpectedly.
- Do not enter credentials after an unsolicited caller tells you to do so.
Before every transfer
- Confirm the asset, network, amount, memo or tag, and full destination address.
- Use a second channel to confirm a changed or newly supplied address.
- Read the final signing screen on the wallet or hardware device.
After a suspicious event
- End contact and secure the account from a clean device.
- Contact the provider through its independently verified channel.
- Preserve evidence and file an IC3 report.
- Ignore guaranteed-recovery offers and requests for an upfront crypto payment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
