imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.
imtoken
中文Download

imtoken Practical Guide

Phishing & Scams

Phishing and scams often use urgency, look-alike domains, fake support, fake airdrops, or remote-control requests to induce users to reveal secrets or sign requests. A strong response is to stop the pressured action and re-verify information from a trusted entry point.

Users keep control of seed phrases and private keys. imtoken will never ask for a seed phrase, private key, or verification code. Verify the address, network, and amount before sending and inspect approval scope before authorizing.

look-alike domains

Users keep control of seed phrases and private keys. imtoken will never ask for a seed phrase, private key, or verification code. Verify the address, network, and amount before sending and inspect approval scope before authorizing.

Security check 1

Core security principles

Focus: look-alike domains, fake support, and fraudulent airdrops

Phishing and scams often use urgency, look-alike domains, fake support, fake airdrops, or remote-control requests to induce users to reveal secrets or sign requests. A strong response is to stop the pressured action and re-verify information from a trusted entry point.

Start by separating secret material from public, verifiable information. Seed phrases, private keys, and verification codes should not be sent to other people; addresses, networks, transaction hashes, and public contract details can be used for self-service verification.

When checking an on-chain result, place look-alike domains, fake support, and fraudulent airdrops in one risk model: decide whether the information should appear at all, whether the source is trustworthy, and whether the action can change assets or permissions.

Security check 2

Common risk scenarios

Focus: fraudulent airdrops, urgency tactics, and malicious signatures

Before moving to the next step, risk can come from a page, device, network environment, or social pressure. urgency tactics, malicious signatures, and remote control may look like different situations, but each can cause a user to reveal information or authorize a request without sufficient review.

Urgent time-pressure prompts, impersonated support, remote-control requests, instructions to copy recovery material, look-alike domains, and unexpected approvals all deserve caution. Knowing some public information about an account does not prove a person's identity.

Use public computers and public networks cautiously. Important wallet operations are easier to protect on a device and network you control, with operating-system, browser, and security settings you understand.

Security check 3

Recognize suspicious requests

Focus: malicious signatures, remote control, and clipboard replacement

From a beginner's perspective, ask four questions when a request seems unusual: who is the source, why is the permission required, what can the request change, and where can the outcome be verified? If any answer is unclear, stopping is appropriate.

When reviewing clipboard replacement and forged notices, verify more than a name or icon. Check the domain, address, network, contract object, and permission scope because visual similarity and habitual clicking are common sources of error.

Connecting a wallet does not mean every signing request should be accepted. Message signing, transaction signing, and token approval have different effects and should be evaluated independently.

Security check 4

Respond in a deliberate order

Focus: clipboard replacement, forged notices, and look-alike domains

Over long-term use, if you discover a suspicious situation, reduce new risk first: stop signing, approving, or transferring; leave the suspicious page; preserve public evidence such as transaction hashes; and reopen a trusted entry point to inspect account and network state.

If the device environment may be compromised, stop performing important actions there and review recently installed software, browser extensions, remote-control tools, and clipboard behavior. Do not attempt to 'repair' a wallet through an untrusted page.

Consider revoking permissions that are no longer needed and disconnect sessions you no longer use. The exact method can differ by chain and contract, so identify the network and object first.

Security check 5

Turn security checks into a routine

Focus: look-alike domains, fake support, and fraudulent airdrops

When an interface message differs from expectations, make the security sequence repeatable: do not disclose secret material, re-check the domain, verify address and network character by character, read signatures in full, inspect spender and allowance, and review permissions after use.

No wallet can credibly promise a promise that all risk is eliminated, that assets can no asset-loss incident can ever occur, or complete prevention of every scam. Security controls reduce risk and make suspicious situations easier to notice; they do not eliminate every possible threat.

imtoken will never ask for a seed phrase, private key, or verification code and cannot recover a user's private key. Users keep their own recovery material and should independently decide whether to interact with third-party DApps or smart contracts.

Operation and security checklist

  • Keep seed phrases and private keys offline and under your control
  • Official personnel will not ask for seed phrases, private keys, or verification codes
  • Verify domains, addresses, and networks carefully
  • Review every signature and approval independently
  • Inspect the spender and permission scope
  • Consider revoking approvals that are no longer needed
  • Use public devices and public networks cautiously

Continue learning

Security CenterApproval SecurityPhishing & ScamsTransaction Checks