Table of Contents
- 🔴 The Real Sequence of Events
- 💡 What are the key observations in this incident?
- Beware of Phishing
- Creating "Error" Scenarios to Induce Worry
- Trezor Never Has "Live Chat Support" on its Device Management Screen
- Requesting "Codes" and "Links" to Resolve Issues
- Never Disclose Your Recovery Seed Under Any Circumstances
The Bitcast team received an update from a user who experienced a real incident with fake support, with the following sequence of events:
🔴 The Real Sequence of Events
Steps where a Trezor Model One Hardware Wallet user was tricked into entering their Recovery Seed:
- The user connected their Trezor to a computer, and the Trezor device itself displayed a screen advising them to go to trezor.io/start (the correct URL) to manage or reset the device.
- Upon entering trezor.io/start (which had already been discreetly redirected), a screen appeared prompting for a phone number, followed by a "Firmware Update" screen.
- When the user clicked to update the firmware, the screen showed a progress bar from 0% almost to 100%.
- Then, the update failed (Error) near the end, with a message stating "Support will contact you," causing the user to worry that the device had an issue.
- After that, a screen appeared asking for a code (to fix the problem), and the fake "Support" immediately contacted them (via the chat bar on the right), sending a code and a link to resolve the issue.
- When the user clicked the received link, the screen changed to one for entering the Recovery Seed. The fake "Support" kept insisting and advising the user to enter the same Recovery Seed to "verify" and fix the firmware issue.
Creating the failed update scenario was a key tactic to make the victim feel that "the device has a problem" and believe that contacting support and following their instructions (including entering the Recovery Seed) was the solution to the problem.
💡 What are the key observations in this incident?
From the sequence of events, there are observations that all users must always be aware of:
Beware of Phishing
- Always check the URL. Even if redirected, carefully examine the URL in the address bar to confirm it is actually suite.trezor.io or trezor.io.
Creating "Error" Scenarios to Induce Worry
- Observation: The update failing at a critical moment and the message stating "Support will contact you" are designed to trigger panic and make you rely on the fake "Support" immediately.
- Advice: Trezor's Support will never contact you first unless you initiate contact. If a firmware update fails, disconnect your Trezor and restart the process only through Trezor Suite downloaded and installed on your computer or through the correct URL.
- Do not follow instructions from any website screen that appears after an error. If unsure, consult Bitcast or other experts. There's no need to rush.
Trezor
Trezor Never Has "Live Chat Support" on its Device Management Screen
- Observation: The chat window that appears on the right, providing codes/links, is not an official Trezor website. When using Suite, the correct support channels are via email or a ticket system on the main website only.
- Advice: If a chat window appears and rushes you to follow steps or sends you a link, consider it a scam immediately and do not enter any information into that chat.
Requesting "Codes" and "Links" to Resolve Issues
- Observation: Scammers try to create complex steps, such as asking for codes or sending new links, to make victims feel that they are going through a "formal" problem-solving process.
- Advice: If you need to resolve an issue with Trezor, go to trezor.io yourself and find the Support Center there. Never click on links sent in chat or messages.
Never Disclose Your Recovery Seed Under Any Circumstances
- Observation: Even if fake support claims that the original Recovery Seed is needed to "verify" or "fix" data during an update/reset process, this is 100% a scam.
- No service provider will ever ask for your Recovery Seed.
- Advice: The Recovery Seed is only for recovery purposes, and you should only type the Seed Phrase directly on the screen of your Hardware Wallet. If your computer screen shows a blank field for entering the Recovery Seed, that is a phishing website (this is different from importing a seed phrase into a software wallet).
Ultimately, when we self-custody our assets, we are solely responsible for their security. Awareness can significantly reduce risks. There's no need to rush any process; remain mindful at all times during any procedures. May you all be safe from all forms of deception.
แชร์:
Foundation Passport Core (Batch 2): In-depth exploration of interesting architecture
Multi-Coin vs Bitcoin Only Hardware Wallets: A Comparison