Phishing, seed phrases and account takeover

Account takeover is a dull name for a simple event: someone else can sign, or someone else can log in. The costumes change. The objects do not. In a non-custodial wallet the object is usually a seed phrase or a live approval. On a licensed platform the object is usually a password plus the second factor that was supposed to save you. Fake support desks stitch the two worlds together by talking like a help centre and asking for the secret that a help centre would never need.

This briefing sits next to crypto wallets explained for Singapore, which is about what a wallet is, and next to crypto scams targeting Singapore residents, which is about the stories that deliver people to these mechanics. The operational rest of the beat is in the security hub. Nothing here is a recommendation to self-custody, to leave assets on a platform, or to buy a device. Digital payment tokens can be lost through a single confirmation.

Seed phrases: a spare key with no locksmith

In most consumer non-custodial designs, a seed phrase is a list of ordinary words that encodes the master secret. Anyone who has the words can recreate the keys in another app and move the assets. Anyone who loses the words, without another backup, has lost the assets. There is no “forgot password” desk on the network. There is no branch in Tampines that reprints them.

That design is why phishing against seed phrases is so efficient. The thief does not need to break cryptography. They need you to type the words into a page, a chat, or a “support form”.

Common deliveries, described without a product ranking:

• A website that looks like the wallet vendor and asks you to “validate”, “sync” or “claim” by entering the words. The words were generated by your wallet, not by a website. A site that gives you words is a different trap; a site that asks for words you already have is the classic one.
• A popup inside a browser extension or a lookalike mobile app. Check the publisher. Sideloaded packages from a chat are not a store listing.
• A voice or text “security officer” who needs the phrase to reverse a transaction, clear a flag, or connect you to MAS. They do not.

Household rules, in the tone of a fire extinguisher rather than a manifesto:

• The words are not typed into a computer after the day you wrote them down, except into a device you already trust and already own.
• Cloud photos, email drafts and chat backups are copies in someone else’s data centre.
• Splitting the list in half and giving each half to a relative is a folk tale. There are better splitting schemes; they are also easy to get wrong.
• A second physical backup in a different failure domain is prudence. Five backups in five apps is diffusion.

If this sounds like the instructions that came with a spare house key, that is the register. Bearer instruments need household procedures. Singapore is already good at those procedures for jewellery and for cash. The seed phrase is a new object in that set.

Anyone who asks for the words is not your friend, not MAS, not the platform’s verification team, and not a police officer with a helpful form. The request is the attack. Everything else is scenery.

SIM swap: stealing the number that resets the account

A SIM swap (or a similar port-out) is an attack on the mobile number, not on the blockchain. The thief persuades the telco, or abuses a weak process, so that your number rings on their SIM. From that moment, SMS one-time codes arrive with them.

Why this matters for tokens:

• Many platform accounts still use SMS as a second factor.
• Many email accounts still use SMS as the recovery path. If the thief resets the email, they can reset the exchange.
• Some banks still use SMS. A token purchase funded from a hijacked banking session is a payments problem that ends in a DPT withdrawal.

Singapore telcos and banks have tightened port-out and SIM-replacement checks over the years. Tightening is not a seal. A determined swap still happens, and a sloppy one still happens to people who reused passwords after a leak.

What actually helps, stated as controls rather than as a pitch:

• Do not use SMS as the only second factor on an email account that can reset a token platform.
• Prefer an authenticator app or a hardware security key for the platform login, if the firm offers it.
• Keep the telco account itself behind a strong credential and, where the operator offers it, a port-out PIN or equivalent.
• A reused password from an old forum leak is a gift to the person who already has your number.

A licensed Singapore platform will still ask you to pass a risk-awareness assessment and will still refuse a retail credit-card purchase. Those rules do not fire when the person at the keyboard is no longer you. Login hygiene is a different layer from the consumer-access regime.

Approval drainers: the permission you signed and forgot

On networks that use smart-contract allowances, a wallet can grant another contract permission to move tokens later. The design is how a genuine exchange or a genuine application takes tokens without asking you to sign every wee transfer. It is also how a drainer empties a wallet on Tuesday for a click you made last month.

The phishing page looks like a mint, an airdrop, a “security update”, or a cloned app. You connect the wallet — which, by itself, is often harmless — and then you sign an approval or a permit. The page thanks you. Nothing moves. A week later the allowance is used and the balance is gone.

Changing the platform password does nothing. The permission is on-chain. Revoking it is a separate transaction, when there is still something left to protect.

Practical education, not a complete security manual:

• Read what you are signing. “Set approval” or “increase allowance” is not “log in”.
• Unlimited allowances are convenient and expensive when they go wrong.
• A brand-new site that needs an approval to “verify your wallet” is reciting a line that honest products do not need.
• A hardware device will still show an approval if you press the button. The screen is only useful if you look at it.

This desk will not name a preferred revocation tool. Tools have their own phishing clones. The point is the object: an approval is a standing instruction, closer to a direct-debit mandate than to a cookie.

Fake support: the desk that is not a desk

Fake support is the social layer that turns a confused customer into a compromised one. The banner on Twitter or Telegram says the official account is “here to help”. The first reply in a search result is an advertisement dressed as a help article. The on-site chat widget was injected by malware. The voice on the line has your ticket number, because you posted the ticket number in a public thread.

What the desk is after

What fake support wants, in order:

1. The seed phrase, “to resync the wallet”.
2. A screen-share session, so they can watch you sign or read a one-time code.
3. A “test transfer” to their address, to “whitelist” you.
4. Remote-access software on the laptop that also holds the password manager.

Real support at a licensed Singapore firm has a published process, a record, and no need for your seed. It may ask for identity documents. That is customer due diligence, and it is supposed to feel bureaucratic. It is not supposed to feel like a countdown. If you are unsure whether a contact is the firm, hang up and start from the URL on the customer agreement or from the MAS directory — not from the link in the chat.

Screen-sharing with a stranger while a wallet extension is unlocked is an invitation. So is pasting a “diagnostic seed” into a form. There is no diagnostic seed.

Platform takeover and self-custody takeover are different jobs

It is worth keeping the two failures separate, because the fix people reach for is often the wrong one.

If you hold an account at a firm, the attacker wants the login. Password managers, unique passwords, non-SMS second factors, and scepticism towards reset messages are the job. The firm may freeze an account if you reach it in time. That is one reason some people use licensed platforms. It is not a reason to treat the account as a bank deposit.

If you hold the keys, the attacker wants the words or the approval. The firm cannot freeze a chain it does not control. There is no ticket that restores a drained non-custodial wallet. That is the job described in the wallets explainer. People who do not want that job are not morally inferior. They are customers.

Hybrids exist: you withdraw from a platform to a new address the thief gave you on a support call. The platform did its job. The address was the attack.

What this page will not do

It will not rank wallets, devices or antivirus brands. It will not tell you to move funds. It will not pretend that a well-chosen gadget cancels a signature you did not read.

The durable habits are short. Do not type the words. Do not treat SMS as a vault. Do not sign an approval to satisfy a stranger. Do not let a help desk that found you become the help desk you trust. For the stories that deliver the stranger, stay with the scam briefing. For the object that holds the secret, stay with the wallets explainer. For the rest of the operational map, stay in the security hub.

A token can go to zero without a thief. A thief is the additional way it goes to zero. This newsroom’s job is to name the objects. The refusal is yours.