Practical checks for self-custody. Verify the source, understand account permissions and review every transaction before signing.
Review the recipient, network, action and fee.
Never share a recovery phrase, private key or password.
You are sending
25.00 NEAR
Before you install, connect or approve.
A familiar logo is easy to copy. The source of your software matters more than its appearance.
Navigate to the download page yourself. Don't use installer links from messages, ads, search sponsorships or social posts.
When opening an installer, your operating system shows the publisher. If it's missing or unexpected, stop.
Install updates only through the same verified route you used originally. Be suspicious of pop-ups demanding urgent updates.
Take the conversation out of the decision. Verify the destination and request independently.
Look for urgent demands, look-alike domains, unexpected airdrops and unsolicited messages offering account support.
Phishing pages can reproduce familiar designs. Verify the complete website address before connecting or signing.
Impersonators copy wallet teams, ecosystem projects and public profiles. Verify the source independently. Keep private keys private and question unsolicited requests for deposits or signatures.
Sending tokens and granting an application access are different decisions. Review the whole request.
Read the full recipient. For named accounts check every character before .near; for implicit accounts compare at least the first and last six characters with the source.
Clipboard-swapping malware exists. Re-check after pasting.
Mainnet and testnet are different networks. Tokens from other chains need a supported bridge — sending them directly to a NEAR account can lose them.
A Transfer moves value. A FunctionCall executes contract code and can attach deposits. AddKey grants access to your account. Know which you're approving.
When an app asks to sign in, check which contract it requests a key for and the allowance. Treat requests for full-access keys with particular care.
Keep it offline and private. Never photograph it, store it in cloud notes, or type it into any website — including this one.
No legitimate support person, admin or app will ever ask for it.
No website, support chat or direct message needs your recovery information.