Phishing: how to recognize and avoid it

What phishing actually is

Phishing is not mainly about hacking systems. It is about influencing decisions.

A phishing attempt tries to make you sign, approve, or reveal something under false assumptions. If a signature is valid, the system accepts it, and the protocol has no way to distinguish a willing action from a manipulated one.

Phishing operates outside protocol rules. It exploits human interpretation, not technical weakness.

Why phishing works in crypto

Crypto systems are designed to remove intermediaries. That also removes many of the filters that traditional systems provide.

There is no central gatekeeper checking whether your intention matches the action being signed. Wallets faithfully sign what users approve, and phishing works because interfaces often hide complexity behind familiar-looking prompts. This is why understanding Approvals and permissions matters before interacting with DeFi applications.

Common phishing patterns

Phishing can appear in many forms:

• Impersonated support messages
• Fake applications or websites
• Urgent alerts about compromised accounts
• Requests to reconnect a wallet or resynchronise data

A wallet prompt appearing after a visit to a DeFi application may look entirely routine. The branding is familiar, the request resembles a standard reconnection process, and nothing immediately suggests a problem. That sense of normality is often what makes phishing effective. 
If you use on-chain applications regularly, How to interact with DeFi safely provides a practical way to slow down and check what you are doing.

The pattern is usually similar. A situation is framed as familiar but incomplete. Action feels necessary, leaving little room to verify what is actually being requested.

Recognition is contextual

Phishing is rarely detected through one signal alone. It is recognised through context.

Does the request make sense? Is this action expected? Has urgency been introduced artificially?

Phishing takes many forms, but some details are often worth checking before taking action:

• The URL: a domain that closely mimics a known one, perhaps with a letter swapped, a missing character, or an additional word.
• The sender address: a familiar display name can hide an unrelated email domain.
• The destination of a link: branding and button text may look legitimate while directing to a different website.
• The nature of the request: legitimate platforms rarely ask users to enter a seed phrase or reconnect a wallet through an unsolicited link.
• The signing request itself: permissions, approvals, or signatures that seem unrelated to the action being performed deserve additional scrutiny.
• The timing: a prompt that appears without any action on your part may warrant closer examination.

Legitimate wallet interactions are usually connected to an action you have just initiated. Anything that appears without a clear connection to what you were doing deserves closer attention.

Why avoidance is not a checklist

There is no universal list of rules that blocks phishing. Attack patterns evolve, and interfaces change.

What remains constant is behaviour. Phishing succeeds when attention is diverted and assumptions are trusted. Avoidance depends on slowing down before irreversible actions.

If you think you approved something unsafe, the next step is not panic but containment. Reviewing and removing unnecessary permissions with How to revoke approvals safely can reduce exposure after a suspicious interaction.