Terenval Answers · P1 safety · Русская версия

How Can You Tell a Fake Crypto Wallet App from a Real One?

A fake wallet can look nearly identical to a legitimate one. Verify the publisher and official download path before entering a recovery phrase or moving funds.

Last reviewed: 2026-10-05.

Key takeaways

• Start from the project's official domain, not a search ad, social-media reply or message.
• Verify the exact app/PWA publisher and URL before entering sensitive recovery material.
• Never give a seed phrase or private key to support staff.
• A fake app can copy branding, screenshots and even reviews; visual similarity is not verification.
• Test a newly verified wallet with a small amount before relying on it for a meaningful balance.

1. Verify the source before the interface

The safest verification chain is outside the wallet itself: type or use a previously verified official domain, follow its documented installation path and compare the destination with the project's official documentation. Search results can contain sponsored placements or lookalike domains, and social networks are easy places for impersonators to distribute counterfeit links.

Check small details that attackers rely on users skipping: substituted letters, extra hyphens, unusual subdomains, a different package/publisher name or a certificate/prompt that does not match the expected install model.

2. Recovery prompts need context

A self-custody wallet needs recovery material only for specific wallet-management actions such as restoring an existing deterministic wallet. The dangerous pattern is a phrase request that appears outside that context: support asks for it, a website claims the wallet needs to be “validated,” a faucet asks for it, or a troubleshooting page requests it to “synchronize” an account.

Anyone who obtains the recovery phrase or relevant private key may be able to control the derived accounts. Treat unsolicited phrase requests as a stop signal.

3. Check behavior before adding significant funds

After installation from a verified source, inspect the wallet's network list and basic receive/send flow. Create or import only through the official wallet interface. If possible, compare the receive address to a known backup or use a small test transfer first.

A real wallet can still have bugs or limitations, so authenticity is not the same as safety. The goal of this check is narrower: make sure you are interacting with the software and domain you intended to use.

Red flags

• “Support” contacts you first and asks for a recovery phrase or private key.
• A wallet link arrives in a Telegram/Discord/X reply rather than official documentation.
• The app demands a seed phrase to claim an airdrop, unlock a faucet or “verify” your balance.
• The domain is one character away from the real project domain.
• The app asks for unrelated device permissions with no clear reason.
• The wallet tells you to disable security software to install it.
• You are pushed to move all funds immediately without time to verify the source.

A safe first-use checklist

1. Open the project's official website from a trusted bookmark or independently verified source.
2. Follow only the installation route documented there.
3. Confirm the URL/publisher before creating or importing a wallet.
4. Record the official support channels separately; support should never need your seed phrase.
5. Verify your first receive address and network.
6. Send a small test amount before a large balance.
7. Keep long-term savings separated from wallets used for experimental dApps.