Overview
The login process for hardware-wallet companion apps is a sensitive moment where account access and device integrity must be verified. This page explains how to approach that process safely, what to watch for, and how to reduce risk while using companion software to manage crypto assets.
Common Risks
Phishing & Fake Sites
Scammers often emulate official pages to capture credentials or trick users into revealing recovery data. Always confirm the address and provenance of the software you interact with.
Compromised Device
A computer or phone infected with malware can intercept or present false information. Keep operating systems and security software up to date and avoid using untrusted public machines for sensitive actions.
Social Engineering
Attackers may pose as support staff or contacts to persuade you to disclose private data. Genuine support never asks for secret recovery information or private keys.
How to Verify Authenticity
Before proceeding, take a moment to confirm the following:
- Install official releases from the vendor's verified channels and confirm checksums or signatures when provided.
- Verify the domain and certificate of any web page you are visiting; look for mismatched domain names or unusual subdomains.
- Use device-displayed confirmations: verify addresses and prompts that appear on hardware devices against what you see in the companion app.
Login Safety Checklist
Minimal exposure: Avoid entering recovery secrets on any app or web field. Recovery information should remain offline and only used in secure, controlled recovery procedures.
Two-device verification: When prompted to confirm an operation, compare values shown on your hardware device with the companion app view to ensure they match exactly.
Software integrity: Keep your companion app up to date and prefer downloads or updates from the vendor's official site or verified app stores. When available, check cryptographic signatures or published checksums.
Red Flags & Phishing Signs
- Unexpected prompts asking for your recovery phrase, private keys, or similarly sensitive information through chat, email, or forms.
- Typos, inconsistent branding, or odd layouts on pages that claim to be official.
- Requests to run unsigned helper applications or to install remote-control software.
Backing Up & Recovery
Store recovery phrases in secure, offline locations. Consider physical methods (metal backups) and multiple geographically separate copies. Never share recovery information, and be cautious with photos or digital copies which may be exposed.
If You Suspect a Compromise
Immediately move any assets you control to a new, uncompromised device or a new wallet whose recovery details you created securely, if possible. Contact official vendor support through verified channels for guidance. Do not follow instructions received via unsolicited messages.
Further Reading
This guide is an educational overview. Consult vendor documentation and official security guidance for comprehensive and up-to-date procedures.