The part you tick comes in three groups: account security, sites and downloads, funds and wallets. Work from the top down and tick each item once it is done; the ticks are saved in the browser on this device and will still be there next time. The four things to check when you deposit, withdraw or send coins are listed under the checklist. Come back and go through it again from time to time, the wallet-approval item above all.
Four things to check when you deposit, withdraw or send coins
Go through these each time you move money onto a platform, take it out, or send coins to another address.
- Do the whole thing on the platform. Deposits and withdrawals go through the channels the platform itself provides. If someone asks you to pay them privately, to deal one to one over a messaging app, or offers a better rate off the platform, don't. Off the platform the trade has no protection, and money of unknown origin can pull you into a money-laundering case; see Paid to Forward USDT? China Prosecutes It as Paofen.
- Don't have anyone deposit or withdraw for you. Both are things you do yourself on the platform. No middleman is needed.
- Selling peer to peer (P2P): release the coins only after you see the money arrive. “Arrived” means you can see it in your own bank or payment app. A transfer screenshot from the buyer doesn't count.
- Check the whole address before you withdraw. Compare the start, the middle and the end, use the withdrawal whitelist, and don't copy an address out of your transaction history. The reason is in 0 USDT in Your Wallet? How Address Poisoning Works.
What each ticked item guards against
The four account-security items
Turn on authenticator 2FA. With a password alone, once it leaks on a fake site the account has no other protection. The codes an authenticator app generates don't travel by SMS; an SMS code can be taken through a SIM swap or relayed in real time from a fake site, so use an authenticator app first.
Set a withdrawal address whitelist. Once it is on, withdrawals can only go to addresses you added beforehand. Even with your login, someone else can't send the coins straight to an address of their own.
Use a strong login password that is used nowhere else. Don't share the exchange password with your email or any other site, so that one leak doesn't take the other accounts with it. A password manager can generate and store it.
Remove API keys and logged-in devices you don't recognize. Check the account security page from time to time for unfamiliar device sessions and API keys. Remove any you find and change the password.
The four items on sites and downloads
Bookmark the official site and go in only from the bookmark. Check the official domain once, save it as a bookmark, and stop searching for the site or opening links other people send. This depends on the domain being right when you first save it; the domain checker can run that comparison.
Download the app through the link on the official website. Open the exchange's official website first, follow its link to the App Store or Google Play, and check the developer name there. Don't install an installer file, or use a download page, that someone sends you.
Don't open unfamiliar links or scan unfamiliar QR codes. With a link or QR code from a private message, a group or a poster, you can't see the real address before it opens. Leave them alone by default.
Treat an “opportunity” that comes to you as fake until checked. When someone calling themselves support, a mentor or an account manager messages you about an “inside channel” or a “limited-time event”, assume it is fake first, then check through the official channel.
The five items on funds and wallets
Keep large holdings in a cold wallet. Don't leave all the coins you won't touch for a long time on an exchange or in a hot wallet. A cold (hardware) wallet keeps the private key offline; signing the wrong approval can still get the coins moved, which is the next item.
Check and revoke wallet approvals regularly. If you are tricked into signing an “approval”, a contract can move your coins without your private key. These approvals have no expiry date (ethereum.org's guide to revoking token access says the same), so check regularly and revoke the ones you no longer need. How to check and revoke is in Fake Airdrops: Wallet Approvals and How to Revoke Them.
Tell no one your private key or seed phrase, and type it into no website. Whether they call themselves support, the official team or an event page, anyone who asks for a seed phrase or private key gets nothing.
When rushed, stop for 24 hours. A transfer or approval you are pushed to do “now, immediately, or you'll miss it” can wait until tomorrow.
Don't believe “capital protected, guaranteed high returns”. When someone promises a few percent a day or steady doubling, put the rate through the compound return calculator to see what it comes to over a year.
The checklist covers settings and habits you put in place ahead of time. If there is something in front of you right now that you can't judge, use the scam self-check.