Warning: Trezor Phishing! 'Failed update' scam steals Recovery Seed

The Bitcast team received an update from a user who experienced a real-life incident with fake support, with the following sequence of events:

🔴 Real-life Sequence of Events

Steps taken by a Trezor Model One Hardware Wallet user who was tricked into entering their Recovery Seed:

• The user connected their Trezor to the computer, and the Trezor device itself displayed a screen advising them to visit trezor.io/start (the correct URL) to manage or reset the device.
• Upon visiting trezor.io/start (which was already subtly redirected), a screen appeared prompting for a phone number, followed by a "firmware update" screen.
• When the user clicked to update the firmware, the screen displayed a progress bar from 0% to almost 100%.
• The update then failed (Error) near the end, with a message stating that "Support will contact you," causing the user to worry that the device had a problem.
• After that, a screen appeared asking for a code (to fix the problem), and the fake "Support" immediately contacted the user (via the chat bar on the right), sending a code and a link to resolve the issue.
• When the user clicked the provided link, the screen changed to one for entering the Recovery Seed. The fake Support continuously urged and advised the user to enter their existing Recovery Seed to "verify" and fix the firmware problem.

The creation of a failed update scenario was a key tactic to make the victim feel that "the device has a problem" and believe that contacting Support and following their instructions (including entering the Recovery Seed) was the way to fix the issue.

💡 What are the key observations in this incident?

Based on the sequence of events, there are important observations that all users must always be aware of.

Beware of Phishing

• Always check the URL. Even if there's a redirect, carefully examine the URL in the Address Bar to confirm if it's truly suite.trezor.io or trezor.io.

Creating "Error" Situations to Cause Concern

• Observation: The failed update at a critical moment and the message stating "Support will contact you" are designed to trigger panic and make you rely on fake "Support" immediately.
• Recommendation: Trezor Support will never contact you first unless you initiate contact. If a firmware update fails, disconnect your Trezor and start over only through Trezor Suite downloaded and installed on your device or via the correct URL.
• Do not follow instructions from any website screen that appears after an error. If you are unsure, ask Bitcast or other experts. There's no need to rush.

Trezor Never Has "Live Chat Support" on the Device Management Screen

• Observation: The chat window that appears on the right and provides codes/links is not an official Trezor website. When using Suite, the correct support channels operate through email or a ticket system on the main website only.
• Recommendation: If a chat window appears and rushes you to follow steps or sends you links, immediately consider it a scam. Do not enter any information into that chat.

Requesting "Codes" and "Links" to Fix Problems

• Observation: Scammers try to create complex steps, such as asking for codes or sending new links, to make the victim feel they are undergoing an "official" problem-solving process.
• Recommendation: If you need to resolve a Trezor-related issue, go to the trezor.io website yourself and search for the Support Center there. Never click on links sent in chat or messages.

Never Disclose Your Recovery Seed Under Any Circumstances

• Observation: Even if fake Support claims to need your existing Recovery Seed to "verify" or "fix" data during an update/reset process, this is 100% a scam.
• No service provider will ever ask for a Recovery Seed from users.
• Recommendation: Recovery Seed is for recovery only, and you should type the Seed Phrase directly on the Hardware Wallet screen. If your computer screen shows a blank field to enter the Recovery Seed, that is a phishing website (this is different from importing a seed phrase into a software wallet).

Finally, when we self-custody our assets, we are solely responsible for their security. Awareness can greatly reduce risks. We don't need to rush any process; stay vigilant at all times when performing various procedures. May you all be safe from all forms of deception.