Asked for something odd
This is the shortest page here because the answer is categorical rather than a judgement call.
Requests that are never legitimate
| The request | Framing you will see |
|---|---|
| Wallet seed or private key | Migration, verification, recovery, proving the wallet is yours |
| Password on a page you did not navigate to | Session expired, confirm your identity, security check |
| Two factor code sent to somebody | Support needs it to unlock your account |
| Payment outside escrow | Faster, cheaper, the escrow is having problems, a trusted regular arrangement |
| Personal identifying details | Age check, address confirmation, dispute evidence |
| Lowering browser security | The page will not work otherwise |
Why urgency is always attached
Because checking defeats all of this, and the only way to prevent checking is to make you feel there is no time. That is why every one of these arrives with a deadline, a warning, or a consequence for delay.
Which gives a rule that needs no expertise. The presence of a clock is the answer. Nothing genuine in this space requires action within a stated period, because real changes run long overlaps precisely so that nobody has to hurry.
If you already answered
- If it was a password: change it immediately from an address you verified yourself, then reset two factor, then read the message log before checking anything else.
- If it was a two factor code: assume the session is compromised right now and go straight to changing the password and resetting the second factor.
- If it was a wallet seed: move whatever remains to a new wallet immediately. This one is measured in minutes and there is nothing else worth doing first.
- If it was payment outside escrow: there is no recovery mechanism. That is the whole reason escrow exists, and it is worth knowing now so it does not happen twice.
The ordering matters. People instinctively check the balance first, and the account is what somebody can act through right now, including talking to other people as you.
Afterwards
Work out where the thing that asked you came from, because that is the part that generalises. Almost always it arrived through a channel that cannot prove anything about itself, and almost always the reader believed it because of where they found it rather than because of anything it demonstrated. The key is the fix.