Phishing scams
Fake emails, texts, websites, or ads that look like RockWallet or another trusted brand and try to trick you into giving up sign-in details, codes, or crypto.
How it works
- 1A message arrives that looks official: "unusual sign-in", "verify your account", or "claim your reward".
- 2It links to a lookalike website, or you land on one through a search ad.
- 3The site asks you to sign in, enter a one-time code, approve a passkey prompt, or connect your wallet.
- 4The scammer uses what you entered to take over your account or move your crypto.
A realistic example (fictional)
Omar searches for the RockWallet app login and taps the top result, which turns out to be an ad. The page looks right, but the web address has an extra letter. He closes it, opens the app from his home screen, and sees no messages from us.
Warning signs
- An urgent message about a locked account, an unusual sign-in, or a prize
- A sender address that doesn't end in our official domain
- Links with extra letters, numbers, or hyphens in the address
- A site you reached through an ad or a link, rather than by typing the address or opening the app
- Requests for one-time codes, passkey approvals, or any recovery details
- Spelling or design that's slightly off
What to do
Haven't sent anything?
Don't click links or reply. Open the app yourself or type our address directly. Mark the message as spam or phishing, and use Contact Support to report it.
Already sent something?
- Stop. Don't enter anything else on the site.
- Secure your account: check that your passkey is on (Preferences, then Passkey) and don't turn it off.
- Change any password you reused on other accounts, starting with your email.
- Contact Support to report it, and tell us exactly what you entered.
Protect yourself
- Open the app yourself or type our address. Don't use ads or search results to find a login page.
- We only email from official addresses (see our hub page). Download the app only from the Apple App Store or Google Play.
- Keep passkeys on. They're designed to work only on the real site, which makes them harder to phish.
Report it
Tell us first, then the authorities. See all the ways to report.
Authorities: FBI IC3 (ic3.gov) · your local police · your bank or card issuer if you paid that way.