Breaches & scams
How to verify a message from wallet support
By Jolly Ledger editorial · Published · Reviewed · 4 min read
Short answer
Open the wallet maker’s official website independently and start a new support inquiry to verify the message. Do not rely on the message’s own links, callback number, ticket reference or apparent sender identity.
A support message can contain your name, order number and a plausible description of your device without being genuine. Verification means establishing a separate route back to the company. Asking the same sender whether they are legitimate only continues the original conversation.
Break the message’s control of the conversation
Do not click its contact button, scan its QR code, call its number or follow an invitation into a private chat. Leave the communication where it is while you open the manufacturer’s official website independently. Use a trusted bookmark or carefully checked address, rather than a sponsored search result.
Find the current support channel on that website and create a new inquiry. Ask whether the message and its requested action are genuine. Include the claimed ticket number as something to verify, not as proof. A case reference, staff photograph or signature block is easy to copy.
Check the channel and the request separately
Manufacturers have different support practices. BitBox, for example, states that it does not call customers and that its support communicates in writing. Check your own vendor’s published policy rather than assuming every company follows the same rule.
A familiar email address is not conclusive either. Trezor reported that an attacker used its Brevo newsletter account to distribute phishing in September 2026. Our explanation of phishing from an official address covers why delivery authenticity and trustworthy instructions are different questions.
| Claim or request | Safer way to verify |
|---|---|
| There is an urgent firmware problem | Open the official application and vendor guidance independently. |
| Your device must be recalled | Check the published scope and ask about your specific device or order. |
| Support needs your recovery words | Do not provide them; report the request through a new official inquiry. |
| Send assets to a secure support wallet | Do not follow the destination; verify through the official channel. |
| Install a remote-access tool | Decline and consult the vendor’s published support policy. |
Provide evidence without handing over access
- Keep the sender address, date, subject and claimed case reference.
- Describe the requested action in your own words.
- Redact wallet secrets and unrelated personal information from screenshots.
- State whether you clicked, installed software, approved anything or shared information.
- Never include recovery words, private keys, passphrases, PINs or authentication codes.
Do not upload a photograph of your backup to demonstrate that you own a wallet. If a diagnostic file or screen recording is requested, first verify the request and check the official instructions for sensitive content. A legitimate troubleshooting need is not permission to disclose everything visible.
If you already acted
Receiving a suspicious message alone does not establish compromise. If you ran unfamiliar software or allowed remote access, stop sensitive activity on that computer and use a separate trusted device for official guidance. Do not approve further wallet actions to help the original sender investigate.
If recovery words were disclosed, treat them as compromised and follow the urgent official-guidance route. For a supposed replacement campaign, also review fake hardware-wallet recalls. The goal is to establish the facts without allowing the suspicious contact to choose your next step.
Sources
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Turn this into a preparation plan
Answer 16 calm questions about your setup. Get findings, scenario walkthroughs and a family briefing — on your own device, no account, no wallet connection, no recovery words.