Today I stupidly got scammed out of my ETH savings after someone from the “australian federal police” called, reported a hack, and transferred the call to “trezor support”.
They got me anxious talking about identity theft so that I was more susceptible once they moved on to talking about crypto wallets.
They used a fake “trezorscan[dot]io” site to collect my seed phrase after a “wireless diagnostic”.
Absolutely devastated
I was rung today by the AFP and all seemed legit. As OP had happened to him, I then had Trezor ring and they sent me to trezorassist[com]io. They wanted me to enter my key words to I could get new key words in case I was Trezor was compromised. This was after a wireless diagnostic. How can they diagnose a Trezor wirelessly? Maybe the new ones are wireless but mine isn’t. He put a lot of pressure on me to enter my key words. I lost it and hung up.
I apolgize for above 2 replies I deleted. I wanted to add more information.
@JoeKing It is good that you did not enter the seed phrase. Never under ANY circumstances would ANY concerned party need to know this information unless they were planning to drain your wallet. If someone called you saying we are the police and in order to secure your savings we need the username and password to your online banking, would you provide it? Of course not.
@pseudoku Sorry this happened, really hope it was not a significant amount of money!? May I ask what specifically at the time did you think to yourself? I am genuinely curious about your thoughts as it was happening. And exactly when did you realize that you have been scammed? During the phone call did you think to yourself this could be a scam? Or did this thought never cross your mind because of how “professional” these lowlife scammers sounded?
Generally, majority of things with a sense of “urgency” are a scam. If somebody on the phone has a strange response to you asking for a phone number to call them back later at a time that is suitable to you then more than likely it is a scam. Take their phone number, their website etc and do your research before interacting with them. Only download the Trezor app or use the web wallet on trezor[dot]io never any other domain. Only use the official apps (confirm the publisher, website URL, contact info etc listed in your app store are only the official records.) In any case nobody under any circumstance should know your seed phrase except those you’ve entrusted with your money. This also includes websites where entering your keys on a form appears to you as if you are typing a password. This is just a trick they do, and they can read what you submit on the form even if on to you, on your side, your typed words appears as ***********
In the future you may want to consider using unique, good pass phrases for different wallets. For example one is for your spending money, another is for large amount of savings and so on.
If somehow you are tricked out of your seed phrase (I pray this does not happen again) they would still need the passphrase to reach that specific wallet. Without it, the scammers are still missing an essential part of your seed. Think of the passphrase as an additional word/numbers/symbols to your seed phrase. And on top of this, if your main wallet (the one that appears when you plug in your Trezor, without any password)…if this main wallet is empty, well there is nothing for them to steal, is there?
You can have as many different wallet passwords as you like. Each of your passwords will always take you in to the wallet belonging to combination of your seed+your password.
It is a good way to compartmentalize your funds and security. But do keep these written securely somewhere, offline, just as you do with your seed. Because if you ever forget your passwords and you did not write them down, you cannot recover these.
When you create a new wallet with a password, you’ll generate a brand new, empty wallet. Before sending any funds into wallets secured with a password, it is a good idea to have a look at the receiving address, eject the wallet and go back into it. But this time, type the password exactly how you have written it down on your paper. Have a look at the receiving address again. Is it the same as before you ejected? If yes, great, you remembered to write down the correct password. You can even try just sending $1 to 1 or 2 of your password wallets, and then unplugging your Trezor and plugging it back in and accessing these wallets again before you begin to send larger amounts of crypto into them. This will teach you the ins and outs of using wallets secured with a password.