How to recognize a fake hardware-wallet recall

A fake recall turns a safety message into a route to your wallet. It may arrive by email, post, text or an unexpected parcel. The sender claims that your device needs urgent replacement, a security inspection or a special update. The useful question is not whether the notice looks professional. It is whether you can establish the claim without using anything supplied by the sender.

Separate the recall claim from the requested action

A manufacturer can publish a genuine product warning. That does not make every message repeating it authentic. A scammer can copy a real announcement, add your name and order details, then replace the next step with a malicious download or QR code. Knowing your address shows access to contact information, not authority over your wallet.

Read the requested action closely. Requests to disclose recovery words, install remote-access software, approve an unexplained transaction or send assets to a support-controlled address are reasons to stop. BitBox’s official phishing guidance explicitly rejects these kinds of support requests. Instructions must be checked against your own manufacturer’s current documentation.

Verify through a separate route

Ask whether your particular device or order is covered, not simply whether a recall exists. A real notice may apply only to a production batch or delivery period. Our guide to verifying a wallet-support message explains why a fresh support inquiry is stronger than replying within a suspicious conversation.

An unsolicited device needs its own verification

Do not connect an unexpected replacement to test the sender’s story. A familiar enclosure, intact-looking package or successful electronic check is not a complete account of how the device reached you. BitBox’s supply-chain guidance describes packaging, device construction, provenance and electronic checks as different safeguards, rather than interchangeable proof.

Do not open the casing yourself or attempt a destructive inspection. Preserve the device as received and ask the manufacturer for its handling instructions. See authenticity-check limits for what a passing result does and does not establish.

If you already followed part of the notice

Record exactly what happened: opening the letter, visiting a page, downloading a file, running software, approving an action or revealing a backup are different exposures. Receiving a recall notice alone does not establish wallet compromise. Stop further interaction and use the relevant vendor’s official incident instructions; this interaction guide helps distinguish the branches.

If you disclosed recovery words, treat them as compromised and seek the manufacturer’s urgent recovery guidance through a separate trusted device. Do not follow a replacement or transfer procedure supplied by the suspected scammer. Legitimate verification does not require giving support the secrets that control your wallet.