It is never too early to be vigilant about the security of your digital assets.
Crypto theft exists for a reason. It is arguably the most profitable – and hardly traceable – assets due to the nature of blockchain. Malicious attempts to get hold of your digital assets might look legit at some point, but they are easy to spot if you pay extra attention.
With the surge in phishing within the crypto community and the feedback we have received, we’ve compiled some of the common scams that traders have fallen for.
In the unfortunate event that you encounter phishing attempts, the below tips should help you better protect yourself from scammers.
Common Scams
1. Phishing Email
The oldest phishing method (yet with the highest number of people falling for it) is through emails, where phishers engineer attacks to steal user data and login credentials to get hold of traders’ digital assets. These attempts are usually masqueraded as a trusted entity or impersonated messages from an official, customer service or network administrator. When the victim clicks to open the email, it might lead to the installation of malware that can access all your usernames or stored passwords.
We’ve seen that scammers send phishing emails disguised as OKEx using this email address <do-not-reply@www-okex.com>. Once a user clicks “confirm”, he is then directed to a phishing “OKEx” website and tricked to login with the 16-digit key for Google Authenticator private key. At this point, the victim has completely leaked his username, password and Google Authenticator code.
Tips: Setting up an anti-phishing code for emails to prevent phishing emails
2. Phishing Website
Another conventional phishing method is a fake website. Scammers set up phishing websites that mimic the exchange’s sign-in pages to trick traders into disclosing their confidential information, such as usernames and passwords.
How to tell if the website is legitimate? Phishers are very sophisticated in designing phony websites today. Typically, these websites look 99% similar to the genuine website, complete with logo and other graphics of the original one. But don’t be fooled by a site that looks real. Just because you see the logo doesn’t mean the website is legitimate. Instead, you should look at the website address carefully — whether there are spelling errors, redundant symbols before or after the company name, or if the page address is “https://”.
For instance, scammers posting fake “OKEx” links (e.g. https://okex-co.com/) on social media trigger users to open the fake website, then ask them to log in and enter their 16-digit key for Google Authenticator private keys and that’s how your assets are hacked.
Tips: Enable Google Authenticator or mobile verification to prevent phishing attacks. If you’re unsure about the website, do not sign in.
3. Phishing Attack
In the crypto world, a lot of websites ask traders to check the URL bar for the correct SSL certificate and URL before logging in, but it doesn’t guarantee that the website is safe, as hackers have also evolved. When users leak their login details on phishing websites, hackers can then use APIs to withdraw funds or perform abnormal trades to steal users’ assets. If a user is under a phishing attack, the server log records the phishing process. Users are often misled to use an API and then their assets are stolen.
Tips: Do not use any APIs if not necessary
4. Impersonating Officials
On social media platforms and communities (such as Telegram), scammers often impersonate customer support team members to text traders. As users are eager to solve their problems, they might be misled to open phishing websites and hence their data might be compromised.
How to effectively protect your assets — the practical ways
To avoid falling into the hands of crypto criminals, traders need to stay secure and flexible in order to benefit from the volatile market.
Two-Factor Authentication (2FA)
You might not have realized it but most of us regularly use two-factor authentication (2FA) online. It is widely used to protect the data of your online accounts. The most common form of two-factor authentication is when you log into your account. You will receive a one-time security code via SMS on your registered phone so that your account is better protected since you need both passwords and your phone in order to access your account.
Google Authenticator
A more secure way is Google Authenticator, which scans barcodes on participating websites to create 2FA codes that serve as a second level of protection when users log in to keep their account safe. The benefits of Google Authenticator, besides not having an SMS message hijacked, are that you have all of the codes in a central location and that they’re available all of the time, even when your phone is offline.
Never too vigilant
Although no security product can claim to be perfectly safe, it’s good to be extra vigilant (especially when dealing with cryptocurrencies), so your assets are out of reach and away from scammers.
This post originally appeared on Medium. Read more.
About OKEx
OKEx is a world-leading digital asset exchange headquartered in Malta, offering comprehensive digital assets trading services including token trading, futures trading, perpetual swap trading and index tracker to global traders with blockchain technology. Currently, the exchange offers over 400 token and futures trading pairs enabling users to optimize their strategies.
Follow Us on Twitter Facebook Telegram