The page looks different
People are good at noticing that something changed and bad at saying what. The noticing is the useful part and it is worth acting on.
Trust the instinctA vague feeling that something is off is the cheapest signal you will ever get. Checking costs a minute. Dismissing it because you cannot articulate the difference is how people talk themselves past the one warning they got.
What to check, in this order
- The address, in the middle. Not the first few characters. A forged address matches the recognisable opening because that is cheap, and differs in the middle because nobody reads it.
- The signature. This settles it regardless of what the page looks like, and it is the only thing that does.
- What is being asked of you. A page that wants something it did not want before is the shape that matters most.
- Whether the other doors look the same. A real interface change appears on all three. A clone is one address.
Changes that are innocent
| What you see | Usually |
|---|---|
| Layout shifted, fonts different | Your security level is blocking things it did not block before, or a stylesheet failed to load under congestion |
| Pieces missing, half rendered | Partial fetch under load. Reload once. |
| Slower and plainer | Degraded mode during heavy traffic, which is normal and deliberate |
| A genuinely new interface | Platforms do change. It will be on all three doors and it will not ask you for anything new. |
Changes that are not
- A login prompt when you were already logged in, particularly during an outage.
- A request for the wallet seed, in any framing. Nothing legitimate ever needs it. There is no migration, verification or recovery flow that does.
- Being asked to confirm your account to continue, which is not a thing that happens.
- A prompt to lower your browser security to make something work.
- A deadline of any kind. Nothing here operates on a clock, and a clock is manipulation rather than scheduling.
If you already typed something
Then it is a credential problem rather than a browsing problem, and the response is the ordered one on login refused. Move fast on the account and slower on the balance, because the account is what somebody can act through right now. Do it from an address you established yourself, not the one you were on.