Phishing Prevention
Do not trust a search result, advertisement or direct message by appearance alone. Verify the exact domain through multiple official sources before entering credentials, depositing funds or connecting a wallet.
Phishing sites often copy logos, colors and login screens from real exchanges. Warning signs include misspelled domains, unexpected subdomains, urgent bonus claims, requests for a seed phrase, unusual browser downloads and support agents who contact you first.
HTTPS only means the connection is encrypted; it does not prove that the operator is legitimate. A fake site can also have a valid certificate.
Use a password manager because it will not usually autofill credentials on a different domain. Enable passkeys or authenticator-based two-factor authentication, review the requested wallet signature and reject any transaction you do not understand.
If you already entered credentials on a suspicious site, use a clean device to change the password, revoke active sessions, review withdrawal addresses and contact the real exchange through its official support channel.
No. Search placement and advertising are not proof of ownership. Verify the exact domain through independent official sources before signing in.
No. The padlock indicates an encrypted connection, not the identity or trustworthiness of the operator. Phishing sites can also use HTTPS.
If you entered credentials, change them on the verified official site, revoke sessions, strengthen two-factor authentication and review account activity. If you connected a wallet, review and revoke suspicious approvals.