On this page
Impersonation Sites: the core ideaFake Support: practical checksFake Airdrops: verifying resultsClipboard Tampering: risks and mistakesRemote-Control Scams: making it routineSeed phrases and private keys remain under the user’s control. imtoken personnel will never ask for a seed phrase, private key, or verification code. Check the address, network, and amount before transferring, and review the target and scope before approving permissions.
Impersonation Sites: the core idea
When working with Phishing & Scams, separate what an interface displays from what the network has actually recorded. impersonation sites usually defines the context of the action, while fake support affects how the next step is interpreted. Read the required details from the wallet, then verify critical fields with a trusted network or destination source. Familiar branding or a claim of “official confirmation” is not a substitute for checking the target, network, and request yourself. Phishing often relies on lookalike domains, search ads, private messages, fake support, fake airdrops, and urgency. Clipboard malware can even replace an address after it has been copied. Effective defence means checking the domain, destination, transaction content, and an independent source rather than trusting a screenshot or a single message.
For impersonation sites, keep information review separate from the final confirmation. Identify the active account and network first, then verify the destination. If a third-party DApp or contract is involved, independently check the domain and contract source. Keep the transaction hash or related record after the action so you can revisit it in a block explorer. This does not remove every risk, but it makes the decision points explicit and avoids treating an interface message as the only source of truth.
Fake Support: practical checks
In everyday use, fake support and fake airdrops often appear together, but they solve different problems. The fact that an action can be initiated does not prove that the network, destination, or permission scope is correct. Confirm the account and network first, review the address, contract, or request source second, and only then inspect fees and the final confirmation screen. If you cannot explain what a request will do, stop rather than repeatedly approving it to see whether it works.
For fake support, keep information review separate from the final confirmation. Identify the active account and network first, then verify the destination. If a third-party DApp or contract is involved, independently check the domain and contract source. Keep the transaction hash or related record after the action so you can revisit it in a block explorer. This does not remove every risk, but it makes the decision points explicit and avoids treating an interface message as the only source of truth.
impersonation sites
Treat this as an independent check; do not skip it because the interface looks familiar or someone is urging you to act.
fake support
Treat this as an independent check; do not skip it because the interface looks familiar or someone is urging you to act.
fake airdrops
Treat this as an independent check; do not skip it because the interface looks familiar or someone is urging you to act.
Fake Airdrops: verifying results
After an action involving Phishing & Scams, use a transaction hash, block height, confirmation state, or contract record to verify what happened. Wallet status can lag because of node synchronisation or interface caching, while on-chain records can show whether a transaction was broadcast, included in a block, or received enough confirmations. For approvals, also confirm that the spender and allowance match what you intended.
For fake airdrops, keep information review separate from the final confirmation. Identify the active account and network first, then verify the destination. If a third-party DApp or contract is involved, independently check the domain and contract source. Keep the transaction hash or related record after the action so you can revisit it in a block explorer. This does not remove every risk, but it makes the decision points explicit and avoids treating an interface message as the only source of truth.
Clipboard Tampering: risks and mistakes
Typical problems include selecting the wrong network, pasting the wrong address, misunderstanding decimals or gas, assuming a message signature is harmless, or treating a DApp connection as permission for every later request. Actions involving clipboard tampering deserve separate review. On-chain transactions are generally not reversible by a wallet provider, and third-party DApps or contracts can carry technical, permission, and operational risk.
For clipboard tampering, keep information review separate from the final confirmation. Identify the active account and network first, then verify the destination. If a third-party DApp or contract is involved, independently check the domain and contract source. Keep the transaction hash or related record after the action so you can revisit it in a block explorer. This does not remove every risk, but it makes the decision points explicit and avoids treating an interface message as the only source of truth.
On-chain transactions are generally not reversible by a wallet provider. Third-party DApps, smart contracts, bridges, and staking services can involve technical and operational risk.
Remote-Control Scams: making it routine
A consistent checklist is more reliable than trying to remember warnings under pressure. Use the same sequence each time: confirm the account, network, target, amount or permission, fee, and final transaction hash. Keep seed phrases and private keys offline and never send them to anyone. Review permissions that are no longer needed. Treat remote-control scams as a routine closing check rather than something to do only after a problem appears.
For remote-control scams, keep information review separate from the final confirmation. Identify the active account and network first, then verify the destination. If a third-party DApp or contract is involved, independently check the domain and contract source. Keep the transaction hash or related record after the action so you can revisit it in a block explorer. This does not remove every risk, but it makes the decision points explicit and avoids treating an interface message as the only source of truth.