Protect your keys and recovery phrase
Private keys authorize transactions; a recovery phrase usually restores those keys. Keep both away from untrusted services.

Follow the checks
Review installation
Update your device and inspect permissions before opening an unknown package.
Protect access
Use a strong device lock and a distinct wallet access password on a trusted device.
Back up offline
Write the recovery words in order. Avoid screenshots, cloud sync and chat messages.
Check asset networks
Confirm the network, contract and address format before adding a token.
Review before signing
Recheck destination, amount, network, fees and approvals; stop when uncertain.
Make the final check count
Work through each check on a trusted device. A random website requesting your recovery phrase is a warning sign.
Recheck credentials, access controls and transaction details. Never treat a security prompt as a substitute for judgment.