DIRECT MESSAGES
If you’re on Discord, immediately disable your DMs. There are so many scams happening that it’s just best to avoid them entirely. It takes three clicks. Do it now. Even if you think you won’t fall for a scam (like me) someone can catch you right in a moment when you’re rushed or not concentrating or are expecting an update from a channel.
Also beware of anyone you don’t know sending you a friend request.
Also beware of anyone who says they can help you with a scamming issue or help you get money back after a hack. I learnt the hard way that it’s possible they’re trying to scam you further.
Look for official announcements in-server instead, created by the founders or moderators. This will be the only source of accurate information. Spend several days in the channel navigating and reading and triple check and ask around in the channel chat before you pay for anything.
The same applies for Instagram, Twitter, Facebook or literally anywhere DMs are possible.
Crypto influencer Lea Thompson has had people create fake versions of her account and message her friends with scams.
AIRDROPPED CONTENT
Scammers will try to simply drop an NFT into your account, often with something like ‘unlockable content’ in the name. To entice you to explore your “gift” which usually has some kind of trick to access your wallet key.
Unfortunately (from my knowledge) you can’t get rid of these. Just don’t even open them and leave them ‘hidden’.
You could also be airdropped tokens - or a small amount of ETH directly into your wallet with an encouragement to click a link to access the rest. Anything that requests your secure key is a scam.
I’ve also heard of more complicated variations where they send you an unknown token - and when you move it to your trading account to exchange it into a currency you know of, they somehow have access via the tokens themselves into your exchange account.
CONNECTED SITES
There are many sites your wallet will need to connect to over time: Etherscan, PolygonScan, OpenSea, collab.land, etc, etc. They will all ask you to sign to grant them access to view your wallet or suggest transactions for you.
This is fine, if the site is real.
The fakes can look exactly the same and pop up an extra question: “to verify connection please enter your secure key” - or something along those lines. This is fake; real connected sites would never ask for this.
The way to always quickly check you’re on the real site is the url. Are you on metamask.io or some dodgy looking url?
You should also practice ‘locking’ your MetaMask - so that when it’s not you logged in nothing can happen, and weekly have a check of your connected sites just to make sure there isn’t anything suspicious in there. Prepare in advance by checking out your wallet’s safety options and guidelines.
My biggest learning from this experience is a big reminder that Web2 is not like Web3 in terms of our attitudes and wired habits.
We need to reprogram the way we are used to behaving online…
1
We’re used to one of our apps needing an upgrade, and just clicked yes-yes-yes-yes to get it up and working as soon as possible. This happened to me last week when I was about to join a Zoom meeting but it said I needed to upgrade - I just wanted to get on the call so I clicked as fast as possible to get myself there.
Never move this fast with new Web3 dapps and protocols. Read it all, understand it all, know what you are signing. It could also be a scam - something pretending to be an upgrade that actually makes you sign away access to your wallet.
2
We’re used to a banking system where if someone does hack your account and steal money, you call your bank and tell them it wasn’t you and they’ll most likely refund you and then protect your account.
In Web3 that responsibility is yours. You are sovereign. Which sounds regal, but actually means there’s nothing anyone else can do for you when your money is gone, and no way to re-secure your account if they have access. You just have to ditch that wallet and make a new one.
This is not something we are used to, which means we can find ourselves being quite relaxed when making payments, we aren’t used to repercussions of losing not just that money, but all our money, and perhaps art in connected sites or even our identity that is tied to that wallet.
This is totally new ground. (The other weird side note is that the compromised account doesn’t get deleted or closed. It just lives on forever. I’m not sure how this works on a sustainability front if billions of accounts forever exist in the ether, but this is a separate problem for another day).
3
If your email is hacked you can usually request to change the email on file to a different one for most of the service providers you use online. To update your Amazon email you just go into settings and request an email change. Because ultimately: you are the person that has the identity, and you can change your email and still exist.
Not in Web3.
Your wallet IS your identity. So if that wallet is connected to, say, OpenSea and you have collections of NFTs there, if your wallet is compromised, you can’t just switch your OpenSea to connect to a new wallet. No. It’s stuck, connected to that wallet and nothing else. So everything you made in that account is compromised, unless you want to pay the gas fees to move your art to a new collection page, tied to a new wallet address. All the current options are messy and expensive.
4
The scams are simply WAY better. This isn’t a poorly written email from a dodgy account asking you for your bank details. These can be exact replicas of entire websites you often use, fake accounts of your friends DMing you…. It’s endless. Don’t have the mindset of “I’m smart, I’m internet savvy, they can’t trick me” like I did.
5
When faced between looking through reams of content in a Discord group, or one simple DM of two sentences, our brains default to the DM. It’s less work. It cuts through. We are used to DMs being much more personal and important than, say, the comments section on someone’s Instagram post. They’re easier to process and somehow have a false intimacy. I fell for this.
Learn from my mistakes. As women, we are used to being locked out of conversations and networks, and Web3 is the same story. It’s on us to educate ourselves around safeguarding and scams like these. Web3 already has women at a disadvantage, let’s not allow ourselves to be susceptible to scams whilst we fight to carve out our own paths within the space.
