Security checklist and what to do if something goes wrong

This final lesson has two parts. The first is a checklist of everything the course has taught. The second is what to do in the first hour after something goes wrong.

The checklist

Accounts

• Every exchange account has its own password, stored in a password manager.
• Two-factor login uses an authenticator app or security key, not text messages.
• Your email account is protected the same way.
• Withdrawal allowlists are on.

Keys

• Your seed phrase is written down offline, with no photo or cloud copy.
• A second copy is stored in a different place.
• You have restored from the backup to prove it works.
• Savings are in a wallet that does not connect to websites.

Habits

• You reach sites through bookmarks.
• You check the address and network before every transfer, and test with a small amount.
• You read what you sign and revoke old approvals.
• Your family knows a plan exists.

You can tick these off on your Achievements page.

When something goes wrong

Act quickly and in order. Thieves often use automated tools that empty a wallet within minutes.

Your seed phrase may be exposed

You typed it into a site, photographed it or found your backup disturbed.

1. On a clean device, create a new wallet with a new seed phrase.
2. Send everything from the old wallet to the new one, most valuable first.
3. Never use the old phrase again.

Do not wait to see whether anything happens. The phrase cannot be changed, only abandoned.

You signed something suspicious

1. Open a token approval tool from a bookmark or a block explorer.
2. Revoke the approval you just gave, and any you do not recognise.
3. Move remaining assets to a fresh wallet if you are unsure what you signed.

Your exchange account was accessed

1. Contact the exchange through its official site and ask it to freeze the account.
2. Change your email password first, then the exchange password.
3. Replace your two-factor method.
4. Check for unfamiliar withdrawal addresses, devices and API keys.

You sent money to a scammer

1. Stop. Send nothing more, including any "fee" or "tax" to release funds.
2. Tell the exchange you sent from. The US Federal Trade Commission advises contacting it immediately and asking for the transaction to be reversed. Success is rare, but speed helps.
3. Save the evidence: transaction IDs, addresses, messages and screenshots.
4. Report it. In the US, use ReportFraud.ftc.gov and the FBI's ic3.gov. In the UK, use Report Fraud. Elsewhere, use your national police or fraud service.

You let someone into your device

If you installed remote-access software or shared your screen: disconnect from the internet, remove the software and run a security scan. Then change your passwords from a different device. Treat any wallet on that device as exposed.

Your device is lost or stolen

Restore your wallet on a new device from your seed phrase. If the old device could be unlocked, move the funds to a new wallet with a new phrase.

Beware the second scam

After a loss, people will offer to recover your money for an upfront fee. The FBI warns that private companies "cannot issue seizure orders to recover cryptocurrency", and that police do not charge victims. Anyone who contacts you first with a recovery offer is a scammer.

Afterwards

Work out how it happened and close that gap. Tell someone you trust. Scams succeed on isolation and shame, and neither one helps you.

You have finished

You now understand how crypto works, how to buy it carefully and how to hold it yourself. Come back to this lesson once a year and run the checklist again.