Verify, do not trust
Independently confirm people, websites, software, and transaction details.
Loading...
Loading...
Security Centre
Bitcoin security is not one action. It is a collection of practical habits for protecting wallets, accounts, devices, recovery information, and privacy. No setup is perfect, but consistent habits can reduce common risks.
Independently confirm people, websites, software, and transaction details.
Keep secrets, holdings, and personal arrangements private.
Combine strong passwords, two-factor authentication, updates, and careful backups.
Maintain readable, protected recovery information and a simple plan.
Practise important wallet processes before relying on them for more.
Avoid complexity you cannot confidently recover or review.
Security needs change as devices, accounts, and life circumstances change.
Keep operating systems and wallet software updated, but verify updates through official, independently found sources rather than unsolicited links. Download wallets only from official verified sources or trusted app stores where appropriate.
Use screen locks and device encryption. Avoid cracked software, unknown browser extensions, screenshots or photo galleries containing sensitive wallet material, and remote-access software that is not genuinely required. Reputable security software may be appropriate for your device and circumstances.
Use strong, unique passwords for email, exchanges, and social accounts. A password manager can help with unique passwords, while introducing recovery and device trade-offs to understand.
Use authenticator apps or security keys where available; SMS alone can have additional risks. Protect backup codes, recovery email and phone accounts, enable login alerts, review active sessions, and never reuse an exchange password elsewhere.
Verify receiving addresses carefully, including the first and last characters. Confirm the amount, fee, asset, and network before sending. When appropriate, use a small test transaction and make sure wallet software and device screens agree.
Avoid copying addresses from untrusted messages and watch for clipboard-replacement malware. Do not rush larger transfers. Separating everyday spending from longer-term holdings may be appropriate for some people.
See the Seed Phrase Guide and Self-Custody Guide for more context.
Verify the exchange domain before logging in. Use unique credentials, strong two-factor authentication, login and withdrawal alerts, and review withdrawal-address controls, delays, and limits where available.
Beware of fake support agents and verify support channels independently. Custodial and self-custody risks are different; this does not mean every exchange is unsafe. Keep only an amount you are comfortable entrusting to a third party.
Unsolicited messages, fake support, urgent warnings, impersonation, giveaway offers, guaranteed returns, recovery scams, remote-access requests, QR codes, copied websites, malicious attachments, and secrecy requests all deserve caution. Pause, verify, and use a separate trusted channel. Find a known contact method yourself rather than replying to the message. Learn more in the Bitcoin Scam Guide.
Avoid publicly disclosing holdings, wallet screenshots, or storage arrangements. Blockchain transactions may be public, and address reuse can reduce privacy. Social media can expose routines, devices, wealth, and travel. For larger holdings, consider physical security and coercion risks; use neutral language in public and never include seed phrases or private keys in support conversations.
Avoid sensitive wallet activity and exchange logins on shared computers. Do not connect unknown USB devices. Use personal mobile data or a trusted network when practical, and be cautious on hotel, airport, and cafe Wi-Fi. Keep backup material separate from frequently carried devices and do not travel with the only wallet and only backup together. Plan before crossing borders because legal and security requirements differ.
Use this practical checklist as a recurring reminder. Print it from your browser if you prefer a paper copy.
A browser-only educational check. It asks for no wallet addresses, balances, seed words, passwords, names, or contact details. Answers are not stored, sent, or used for analytics.
Focus first on protecting recovery information, passwords, account access, and devices.
This result does not guarantee security. It is a prompt to learn, review, and make careful decisions.
| Situation | Careful next steps |
|---|---|
| Suspicious message | Stop. Do not click links or reply under pressure. Verify through a separate trusted channel and preserve evidence. |
| Clicked a suspicious link | Close the page and do not enter credentials. Review downloads and extensions, secure the device, and change affected credentials from a trusted device if necessary. |
| Shared account credentials | Change them immediately, end active sessions, strengthen two-factor authentication, and secure recovery email and phone accounts. |
| Installed remote-access software | Disconnect from the network where appropriate, remove the software, review accounts from another trusted device, and seek qualified local technical help. |
| Exposed seed phrase | Treat the wallet as compromised. Create a new wallet securely, carefully move remaining funds, and stop using the exposed phrase. |
| Sent Bitcoin to a scammer | Stop further payments, preserve evidence, contact the service used, report through applicable cybercrime channels, and do not pay recovery scammers. Reversal is normally not possible. |
Pause and independently verify before acting. This includes messages, websites, wallet software, addresses, and unexpected support requests.
It is one useful layer, but it does not replace unique passwords, secure recovery details, device security, and careful phishing checks.
SMS can be better than no second factor, but authenticator apps or security keys may reduce some risks associated with phone-number compromise.
A password manager can help create and use unique passwords, but it also has trade-offs. Understand its recovery, device, and account-security settings.
Review them regularly, such as during a monthly security check, to confirm they remain present, readable, and protected without exposing them.
Avoid sensitive wallet and exchange activity on shared or untrusted networks where practical. Use a trusted connection and verify what you are doing.
Use the provider's official, independently found website or a trusted app store where appropriate. Do not install software from unsolicited messages, adverts, or unknown links.
Slow down, verify the address, amount, fee, asset, and network, and consider a small test transaction when appropriate.
No. Never share a seed phrase, private key, password, or authentication code with Bitcoin Access or anyone else.
No. Security is never guaranteed, but consistent habits can reduce common risks and make problems easier to spot and respond to.
Explore the next ideas connected to this topic.
Return to guides on scams, seed phrases, self-custody, and broader security habits.
Visit Security CentreNever submit or reveal seed phrases, private keys, passwords, or authentication codes. Consultations cannot guarantee security, reverse transactions, or recover inaccessible funds, but can help explain risks, procedures, and safer habits.
Book a consultation