---
title: "Safety: Phishing Attacks & Social Engineering"
publishedAt: '2026-02-23'
badges:
  - Intermediate
  - Safety
hiddenBadges:
  - Phishing
  - attack
  - impersonation
  - impersonate
---

## Safety: Phishing Attacks & Social Engineering

Phishing in crypto works the same way it does in traditional banking: someone impersonates a trusted source to trick you into handing over credentials or approving a malicious action. The difference is that onchain, there is no chargeback. Once a transaction is signed and confirmed, it is final.

Social engineering is the human side of this: it involves building trust (sometimes over days or weeks) before making a move. In the crypto space, this most often shows up in Discord, Telegram, and Twitter DMs, where bad actors pose as project moderators, support staff, or even helpful community members.

![Phishing](https://static.academy.jup.ag/images/illustrations/phishing.avif)

### Common Phishing Attacks
* Fake websites: A cloned version of jup.ag or another trusted platform, with a URL that differs by just one character (e.g. jup-ag.com, jupit3r.io). The page looks identical but is designed to steal your wallet approval. 
* Fake support DMs: Someone reaches out to "help" you after you post a question in a public channel. They will direct you to a fake site or ask for your seed phrase under the guise of troubleshooting.  
* Fake giveaways: "Send 1 SOL, receive 2 <Term id="sol">SOL</Term> back" or "Connect your wallet to claim your exclusive airdrop" - these are always scams. Legitimate projects do not require you to send funds to receive funds.  
* Fake offers: Scammers may offer you <Term id="sol">SOL</Term> to buy your old, empty wallets. These are also scams - the chances of you getting paid are practically zero. Furthermore, these old, empty wallets can be used by the scammers for more sophisticated attacks (i.e. hyping a token up before a [rugpull](/lessons/safety-rugs)).
* Impersonation accounts: Fake Twitter or Telegram accounts with usernames and profile pictures nearly identical to official Jupiter accounts. They will reply to your posts with urgent-sounding links.

### How to Protect Yourself
* Bookmark the official Jupiter URLs and only use those bookmarks - never click links from DMs or social media.  
* Verify URLs carefully before connecting your wallet. Look for subtle misspellings or character swaps.  
* Remember: nobody from the Jupiter team will ever DM you first. If someone does, assume it is a scam.  
* Turn off direct messages from strangers on Discord and Telegram.  
* When in doubt, ask in the official Jupiter Discord public channel - never in a private message thread opened by someone else.