Avoiding scams
Bitcoin payments cannot be reversed, so scammers love it. The good news is that almost every scam breaks one of a few simple rules.
The rules
- Nobody genuine asks for your seed phrase. Not support, not a wallet maker, not an exchange.
- Guaranteed returns do not exist. Doubling offers, fixed daily profits and celebrity giveaways are scams.
- Real support never messages you first. Fake support accounts reply to posts on X and Telegram within minutes.
- Be wary of online friends who talk money. Romance and "pig butchering" scams build trust for weeks before pushing a fake investment app.
- Check the address and the website. Bookmark the real sites and do not click links in emails or ads.
- Address poisoning. Scammers send tiny amounts from look alike addresses so they appear in your history. Never copy an address from past transactions.
- Fake hardware wallets by post. After the Ledger leak, some owners were sent tampered "replacement" devices. Only use devices bought direct from the maker.
- Fake recovery services target people who have already lost money. They are scams too.
If it happens
Stop sending money, gather screenshots and transaction IDs, and report it to Report Fraud (formerly Action Fraud). Forward phishing emails to the NCSC at report@phishing.gov.uk. You can also check firms and warnings with FCA ScamSmart.
Read more safety basics on the Start page.
Alert: fake Foundation "Passport recall" emails
Status: active, first reported 25 to 26 October 2026.
Owners of Foundation's Passport hardware wallet, and some people who never bought one, are getting emails that claim to be an urgent product recall. They are phishing. Foundation did not send them.
What the email looks like
- Sender: shows the name "Foundation". One widely shared copy came from info@newinblue.com, which has nothing to do with Foundation (screenshot via Bitcoin News). Other copies came from Foundation's own real domains, because attackers got into part of its email systems (Foundation incident notice). So a real looking sender proves nothing.
- Story: "A display module in Passport was changed by one of our suppliers", so every device is being recalled and "your funds are safe as long as you follow the steps on our website".
- The hook: a "Learn more" button and the line "You can confirm your address on the recall page."
- Personal details: some copies included the reader's real name, home address, phone number or order details (Bitcoin.com News, BeInCrypto).
- Where it leads: a fake site (reported as foundation.support, now taken down) copying Foundation's Envoy app, built to get your recovery words or get you to send bitcoin to the attacker.
What Foundation says
Passport devices, keys and funds were not compromised. Attackers got into part of its backend through a vulnerable self hosted app, likely reached its support inbox, and sent emails through its systems. Foundation counted more than 23,000 phishing attempts, revoked keys and took the fake domain down. It also says the attacker may be mixing in data from other recent leaks, which is why non customers received it too (Foundation incident notice, FoundationHQ on X).
Why your address matters: the Ledger leak
This has happened before. In 2020 the wallet maker Ledger had its shop and marketing database breached. In December 2020 the data was dumped free on a hacker forum: 1,075,382 newsletter email addresses and 272,853 order records with names, postal addresses and phone numbers (BleepingComputer). A separate Shopify insider incident took Ledger's total to roughly 292,000 people with personal details exposed (Ledger FAQ). Years later, those lists still power fake emails, texts and even posted letters with fake "replacement" devices.
The lesson: once your name and address sit on a list of hardware wallet buyers, assume scammers have it forever. A message that knows your address is not proof it is genuine.
What to do
- Do not click, reply or "confirm" anything. No real recall needs your recovery words, and you should not hand your address to a link in an email.
- Never type your seed words into a website, form, app or email. They belong only on your device and your offline backup. Foundation says it will never ask for them.
- Check through a route you choose. Type the maker's web address yourself or use your bookmark, and read its official channels.
- If you entered your seed words anywhere: treat that wallet as burned. Set up a new wallet with a new seed on a trusted device and move your funds to it straight away.
- If you sent bitcoin: it cannot be reversed. Save the email, the address you paid and the transaction ID, and report it to Report Fraud (or call 0300 123 2040). Ignore anyone who offers to "recover" it for a fee, that is a second scam.
- Report the email: forward phishing emails to the NCSC at report@phishing.gov.uk (NCSC).
- Expect follow ups by text, phone or post. Treat them all the same way.
- Going forward: consider a delivery address that is not your home (a collection point, for example) and a separate email for wallet purchases.
Not financial advice. General safety education only. Details correct as of 31 October 2026 and may change as Foundation's investigation continues.
Key takeaways
- Anyone asking for your seed phrase is a scammer.
- Guaranteed returns and giveaways are always scams.
- Stop sending money and report fraud to Report Fraud.
Not financial advice. These lessons are general education only. Bitcoin prices can swing hard. Never put in more than you can afford to lose, and do your own research.