# Staying Safe

Crypto is irreversible and self-custodial, which is exactly why scammers target it: there's no bank to reverse a fraudulent transfer. The good news is that almost every theft comes down to a few repeatable tricks, and a handful of habits stop most of them.

## The golden rules

1. **Never share or type your recovery phrase.** Not into a website, a "support agent" chat, a wallet-import box, or an app. No legitimate person or tool ever needs it. This single rule stops the majority of thefts. ([Why →](/docs/learn/recovery-phrase))
2. **Verify every address and amount on the device screen.** Your computer can be lying; the KeepKey screen is a separate display that your computer does not draw. Read the whole address, not just the ends. ([How →](/docs/desktop/verify-on-device))
3. **Buy your device from official sources** and let it verify genuine, signed firmware on first boot. ([Why →](/docs/security))
4. **Keep firmware current.** Updates close known issues. Official releases are signed by KeepKey, and your KeepKey checks that signature and warns you when firmware is not official. ([How →](/docs/desktop/firmware))

## Scams to recognize

- **Phishing sites & emails** — fake "KeepKey" or "wallet" pages that ask you to "validate" or "import" your recovery phrase. Real setup shows the phrase *on the device*; it never asks you to type it into a browser.
- **Fake support** — someone in a chat, DM, or search ad posing as support, steering you toward entering your phrase or installing software. Real support will never ask for your phrase.
- **Address poisoning** — an attacker sends you a tiny transaction from an address that *looks* like one you've used, hoping you'll copy it from your history later. Always pull addresses from the source (or your Address Book), never from your transaction history, and verify on-device — see [Address poisoning & dust](/docs/guides/address-poisoning).
- **Clipboard malware** — software that swaps a copied address for the attacker's the instant you paste. Reading the full address on the KeepKey screen is how you catch it — see [Clipboard swapping](/docs/guides/clipboard-swapping).
- **Fake firmware / apps** — altered downloads. Download KeepKey Desktop only from keepkey.com/desktop. Official firmware is signed; a genuine KeepKey checks the signature and warns when firmware is not official — never continue past a warning you didn't expect.
- **"Send 1, get 2 back" / giveaway scams** — there is no free money. Anyone promising returns for a deposit is stealing it.

## Why a KeepKey helps

A hardware wallet doesn't make you immune — *you* are still the last line of defense — but it removes the easy attacks. Keys never leave the device, so remote malware can't read them. Every transfer needs a physical button press, so nothing moves silently. And the device's own screen is a second, independent view of what you are about to sign — one your computer does not draw.

## On your KeepKey

- The full, honest threat model and the fixes for every disclosed issue: [Security](/docs/security).
- The verification habit that defeats clipboard malware and address poisoning: [Verifying Transactions](/docs/desktop/verify-on-device).
- Quick answers to "did I mess up?" moments: [FAQ](/docs/faq).