Scammers are now sending physical letters right to people’s doors. Nearly 40,000 customers’ details leaked by SafePal in August are being used to send fake letters to Italian users. The letters have the right names, addresses, and order details, and claim there’s a security issue with their wallet firmware. They include a QR code and tell you to scan it.
Well, scan it and you’ll land on a phishing site. Enter your recovery phrase, and all the crypto in your wallet is gone. SafePal has confirmed it: the letters are fake, the wallets themselves haven’t been compromised, and SafePal will never send physical mail or ask for your recovery phrase. They’ve already taken down more than 30 fake websites.
The key point is that data leaks have a longer tail than you might think: order information from three months ago is still being used. Throw away any letter like this, and only trust the recovery phrase you wrote down yourself. Never give it to anyone who asks.
Well, scan it and you’ll land on a phishing site. Enter your recovery phrase, and all the crypto in your wallet is gone. SafePal has confirmed it: the letters are fake, the wallets themselves haven’t been compromised, and SafePal will never send physical mail or ask for your recovery phrase. They’ve already taken down more than 30 fake websites.
The key point is that data leaks have a longer tail than you might think: order information from three months ago is still being used. Throw away any letter like this, and only trust the recovery phrase you wrote down yourself. Never give it to anyone who asks.