Most wallet scams rely on getting you to reveal a secret, send assets to the wrong address or approve a transaction you do not understand. A few habits make it much harder for someone to trick you.
Keep your recovery details private
Your wallet's secret, seed phrase or recovery words give control of your account. Anyone who gets them may be able to move your assets.
- Never share them with anyone, including someone claiming to be from a wallet, exchange or DROP support team.
- Never enter them into a website or send them in a message.
- Store them somewhere private and offline.
Wallet support should not need your secret to help you. If someone asks for it, stop responding.
Check the token issuer
Anyone can create a token called DROP. Before setting a trustline or making a trade, compare the issuer address with the official $DROP details on our How to buy page. A matching name, logo or ticker is not proof that it is authentic.
If someone sends you an XRPL Check
An XRPL Check is a legitimate way to arrange a payment for later. Receiving one does not automatically transfer tokens into your wallet. If a Check arrives unexpectedly, open your wallet yourself instead of following a link in a message. Check that your address is the recipient, verify who sent it through a separate trusted channel if needed, and confirm the asset, issuer, amount and any expiry. For $DROP, compare the issuer with the official address on our How to buy page.
You may need the correct trustline before cashing a token Check. If you decide to cash it, make sure your wallet is asking you to approve a CheckCash transaction for the Check and amount you reviewed. Reject any request to approve a different or unclear transaction. A Check is not a guarantee that the sender still has enough available funds when you cash it. See how XRPL Checks work.
Check links and messages
Scammers copy profile pictures, names and websites. Open our links page yourself to find official channels instead of trusting links in replies, direct messages or ads. Be cautious of urgent “claim” offers, surprise giveaways and people who contact you first to offer help.
Review before you approve
Your wallet shows a transaction before you sign it. Check what it will do, which account or assets are involved, and the amount. If the details are unclear or different from what you expected, reject it and ask the platform's official support channel for help.
XRPL transactions that have succeeded generally cannot be reversed. A website connection alone does not give the site your recovery phrase, but a transaction you approve can move assets or change account settings. Treat each request separately and only approve what you understand.
If something goes wrong
If you shared your recovery details or think someone else has them, treat the wallet as compromised. If you can still access it, use a trusted device and wallet app to move remaining assets to a new wallet you control. Contact the wallet provider through its official support pages and report suspected theft to the relevant authorities.
Be wary of anyone offering to recover stolen funds for an upfront fee; that can be another scam. No one can promise to reverse a confirmed ledger transaction.
For the basics, see Set up a wallet: Xaman or Joey and What is a trustline?.