A message saying your account needs attention can lead to a page that looks almost identical to the service you normally use. The logo may be familiar, the writing polished and the request plausible. Entering your details can still put your account at risk.
Phishing is an attempt to obtain information or access by pretending to be a trusted person or service. The safest response to an unexpected account warning is to open the service independently and check there.
Key takeaways
Logos, display names and familiar message threads do not verify the sender.
A QR code is another way to open a destination; it is not proof that the destination is trustworthy.
If you entered a password or shared a code, contact support promptly and protect the affected accounts.
Where phishing reaches you
Phishing can arrive through email, SMS, social media messages or a fake login page. A search advertisement can lead to an imitation website. An attachment may ask you to install software, while a QR code may conceal the destination until your device reads it.
The intended result is often the same: you enter a username, password, two-factor authentication code or personal information that the attacker can use. Scamwatch explains these deceptive contacts in its phishing scam guidance.
An unexpected message can also tell you to call a number. That number may connect you to a person who continues the deception. Avoid assuming a phone conversation is safer than clicking the original link.
A fictional message, examined
This example is invented and does not describe an actual CoinByte message or customer.
An SMS reads: “CoinByte security alert. Your account will be restricted in 30 minutes. Verify your details now.” It includes a link. The linked page uses a CoinByte-style logo and asks for a password and the next authentication code.
Several details call for a pause:
The short deadline discourages checking.
The message chooses the login destination for you.
The page asks for credentials before you have independently established its identity.
The branding is being used as evidence, even though branding can be copied.
You do not need to determine exactly how the page works. Open the official app yourself and check the account there, then contact support if the warning remains uncertain.
How to check a website address
Start with the official address obtained independently, such as from the service's established website or app listing. Save a verified bookmark for future visits. Do not use a suspicious message as your source of the correct address.
Read the hostname carefully. A brand word anywhere in an address does not make the website part of that brand. For example, coinbyte.example.com belongs under example.com; it does not belong to CoinByte. This is an illustrative domain, not a real login link.
Watch for extra words, swapped letters, unusual characters or a different domain ending. Check again after any unexpected redirect. If an address is shortened or difficult to interpret, use the independently verified app or website instead.
HTTPS protects a connection in transit; it does not certify the operator's honesty. A fraudulent site can also use HTTPS. Treat a padlock as a connection indicator, not a verdict on the business. Mozilla explains this distinction in its HTTPS security guidance.
Emails, search advertisements and QR codes
An email's display name can differ from its actual sender address. A familiar address also does not remove the need to check an unexpected request. Poor spelling may be a warning, but good spelling is not a guarantee.
Search results can include paid advertisements. A top position or sponsored label does not establish that a login page is the official one. When accessing an account, a verified bookmark or the installed official app reduces reliance on a search result.
Before opening a QR destination, inspect any preview your device provides. Do not scan an unexpected code to verify your account, claim a token or bypass a warning. If the destination is unclear, stop. A printed or digitally displayed code can lead to the same fake login page as an ordinary link.
Protecting your CoinByte account
Keep your account password unique and use the security options available in CoinByte. Two-factor authentication adds protection, but giving another person your code can undermine it.
Use CoinByte's account and security guidance to find its published instructions. If a message claims to be from CoinByte, contact support independently before carrying out an uncertain request. Learn more about verifying the contact in Impersonation Scams.
If you clicked or entered information
Close the suspicious page. Clicking a link alone does not establish that an account was accessed, but downloads, permissions or information you supplied may require action. Note what you actually did.
If you entered a password, shared a code or downloaded software, contact CoinByte and use a trusted device to protect affected accounts. Include your email account if it may be exposed. Avoid returning to the page to investigate.
For the full response sequence, read What to Do If You Think You've Been Scammed.
Scam & FraudWhat to Do If You Think You've Been ScammedIf you think you may have been caught in a crypto scam, act quickly. You do not need to be certain before asking for help. The immediate priority is to prevent further payments and protect any affected accounts or devices. Take these steps firstStop sending money or cryptocurrency and stop following
Scam & FraudHow to Verify a Crypto Platform, App or Investment OpportunityBefore sending money, check the business, the person contacting you and the particular offer. They are separate questions. A real company can be impersonated, and a genuine app can be used to buy crypto that is then sent to a scammer. This checklist helps you identify gaps before making a payment. It
Scam & FraudRecovery Scams: When Getting Your Money Back Becomes Another ScamAfter losing money, an offer to retrieve it can be difficult to ignore. Someone may say they traced your crypto, found it in a frozen wallet or can recover it using specialist tools. The apparent solution can be another attempt to obtain money or account access. You can seek help without accepting an