Never share a seed phrase with support staff, wallet developers, exchange employees, airdrop pages or “recovery” services. The phrase is not an identity check—it is the authority needed to rebuild the wallet and move its assets.
The request is the warning#
Scammers invent technical explanations because the simple request would sound absurd. They may call the phrase a validation code, synchronization key, migration phrase, wallet rectification key or compliance backup. Renaming it does not change what it controls.
A decentralized application can ask your wallet to connect or sign. It does not need the underlying recovery words. A hardware-wallet company can troubleshoot a device without learning the phrase. An exchange may verify account identity, but it does not need a self-custody wallet’s secret.
Common stories used to obtain the phrase#
“Your wallet must be synchronized”
The attacker sends a link to a fake form that asks for all recovery words. A real wallet restores locally through its official application, not through a generic web form.
“Support needs to repair a failed transaction”
Blockchain transactions are investigated using public addresses and transaction hashes. The seed phrase is not required to read them.
“Claim or unlock an airdrop”
The page may ask directly for the phrase or present a malicious signature after connection. Unexpected rewards are not a reason to expose authority.
“We can recover stolen funds”
Recovery scammers target victims when they are frightened and willing to trust a second stranger. A person who asks for your phrase can steal anything that remains.
Why a wallet password does not save you#
The password normally protects the wallet data on one device. The seed phrase can recreate keys in another compatible wallet, beyond that device’s password, biometric lock or extension session.
Changing the password after disclosure does not rotate derived private keys. The correct response is to generate new recovery material and transfer assets to addresses derived from it.
If you already sent the words#
Act as though the attacker has them, even if no transfer is visible yet.
- Use a trusted device to create a new wallet with a new phrase.
- Verify the destination address carefully.
- Move remaining native assets and tokens, considering network fees and approvals.
- Stop using every account derived from the old phrase.
- Preserve the scam messages, domain and transaction evidence.
Do not create a “new account” under the same compromised phrase. That account can also be derived by the attacker.
Frequently asked questions#
Can I share one or two words safely?
There is no legitimate reason to reveal fragments during support. Partial disclosure reduces secrecy and can be combined with other leaked information.
Can I type the phrase into my official wallet?
Only during a recovery you intentionally initiated through verified wallet software. Confirm the application, device and environment before doing so.
Does an exchange ever issue a seed phrase?
Conventional custodial exchange accounts usually use account credentials rather than giving the user the custodian’s wallet seed. Some products include separate self-custody wallets; identify which product you are using.
Is a QR code of the phrase safer than words?
No. It encodes the same secret and can be copied by any camera or application that reads it.
Sources#
- MetaMask: Secure Your Secret Recovery Phrase
- Trezor: Common Scams and Phishing
- Ethereum.org: Security and Scam Prevention
Risk notice: Once a recovery phrase is exposed, assume every derived account is compromised and migrate to new recovery material.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
