Use these documented BitBox-related scam examples to compare a suspicious message, call, letter, website, or download without interacting with it. Do not follow its links, scan QR codes, call supplied numbers, or open attachments. The list is not exhaustive: wording, branding, filenames, and delivery methods can change, and an unfamiliar attempt may still be fraudulent.

Already interacted? Go to What to do after interacting with a phishing attempt and choose the section matching what you did. If you entered recovery words or shared a wallet backup, follow that section immediately; do not reset your BitBox before meeting its backup and access prerequisites.

Malicious downloads and hidden remote access

An unexpected message or download page may offer a transcript, security report, account statement, wallet update, or document viewer. Running the supplied file can install remote-access software without an obvious support session. An attacker may first target your computer and ask for recovery words or a transaction approval later.

Windows download with ScreenConnect and a DocuSign decoy

In a BitBox-related phishing download inspected by the BitBox team, a website supplied a ZIP archive containing a Windows batch script, a file that runs commands on the computer. When run, the script requested administrator rights. After permission was granted, it silently installed a ScreenConnect remote-access client configured to connect to the attacker's server.

The script then ran a genuine, digitally signed DocuSign print-driver installer and opened the official DocuSign website as a decoy. This made the visible activity look like a normal DocuSign installation. ScreenConnect and DocuSign are legitimate products being abused in this attack; a genuine signed installer or an official website opening afterward does not establish that the preceding download was safe.

Remote access can let an attacker watch the screen and control the computer. They may manipulate instructions or pressure you into confirming transactions or revealing recovery words later. Computer access does not by itself establish that they obtained your wallet backup.

Do not run scripts or installers from an unexpected document or wallet-update message, or grant them administrator rights. If you ran the file, follow the software and remote-access section of What to do after interacting with a phishing attempt, even if you saw no remote session and entered no recovery words. Filenames, tools, and decoys may change; this example is not a checklist for every malicious download.

Fake BitBox websites and BitBoxApp downloads

A fake website may copy BitBox branding, use a similar-looking address, or offer a malicious version of the BitBoxApp. It may ask you to restore, synchronize, verify, migrate, or unlock your wallet.

In one observed flow, a fake BitBox-branded “safety check” asked for the BitBox model and email address, declared the wallet compromised, and requested the 24 recovery words to generate a replacement backup. A website cannot safely check, replace, or generate new recovery words for an existing wallet.

Do not enter your recovery words or download software from such a page. Obtain the BitBoxApp only from the official BitBoxApp download page.

Fake calls and supposed support assistance

Scammers impersonate BitBox or another provider through calls, SMS, Telegram, WhatsApp, Discord, social media, forums, or direct messages. They may know personal details, use an employee name or ticket number, and ask you to keep the conversation private. The examples below describe different reported or observed patterns; they do not establish that the same people or campaign are behind them.

Reported exchange call and fake BitBox Support handoff

Reports describe callers pretending to represent a cryptocurrency exchange or broker. They claim there was a data leak, login, withdrawal, or transaction problem, then transfer the recipient to, or introduce, someone pretending to be BitBox Support. The steps vary; the exchange or broker is being impersonated, not shown to be involved.

The supposed support agent may direct you to a fake BitBox-branded “security”, “backup”, “entropy”, or exchange-to-wallet “API” check. They may request a code, account information, a download, remote access, a BitBox connection, recovery words, or a wallet action. End the call even if the person knows personal details or supplies a genuine-looking support confirmation.

Fake payment, transaction, or exchange alerts

A fraudulent email may imitate a payment provider, broker, or exchange. It can include a confirmation code for an unfamiliar transaction and a phone number to call if you did not request it. The person answering may claim there was access from another country, that your device password was bypassed, or that your wallet is under attack.

Do not call the supplied number. Independently open the provider's official website if you need to check its account.

Genuine support confirmations used to support a scam

A scammer may first contact you and learn which wallet, exchange, or broker you use. They then submit a real support form using your email address, causing you to receive a genuine automated confirmation. They use that confirmation, ticket number, employee name, or supposed direct extension to make the separate conversation appear legitimate.

A genuine confirmation does not authenticate a caller or message when you did not create the request. Do not continue through the other person's case references or reply to the unexpected confirmation. If you want BitBox to check it, independently open the official BitBox Support contact form, create a completely new inquiry, and state that you did not submit the earlier request.

Transfers presented as a “security lock” or “account recovery”

After learning where a victim bought cryptocurrency, a scammer may impersonate that exchange or broker and instruct the victim to convert assets into Bitcoin and send them to a wallet as part of a “security lock” or “account recovery”. They may describe the destination as a “safe” or “secure” wallet.

Do not send funds to a destination supplied by the caller. If the attacker already obtained the recovery words for the wallet receiving the funds, they may also be able to steal newly received funds. Moving funds after a backup exposure requires your own newly created wallet and the prerequisites in the response guide, not a destination chosen by someone contacting you.

Fraudulent security and policy notices

Claims of urgent security checks or restricted access

Scam notices claim that your funds are in danger, your wallet or “BitBox account” is compromised, your firmware is unsafe, or access will be blocked. They may demand an urgent verification, synchronization, migration, or security check through a supplied link, attachment, QR code, call, or chat.

BitBox cannot freeze or unlock your self-custody wallet. Stop if an unsolicited notice asks you to disclose wallet secrets, install supplied wallet or remote-access software, connect your BitBox to a website for a security check, approve an unexpected action, or send funds to a supplied destination. Check an update or security claim through an official channel you open independently.

Fake Terms of Service and Privacy Policy update email

An observed email claims that BitBox updated its Terms of Service and Privacy Policy following a supposed company-name transition. It asks you to review documents by a deadline and threatens temporary restrictions on a “BitBox account” if you do not acknowledge the update.

The email copies BitBox branding and genuine-looking company, product, partner, privacy, and support details. It reassures readers about self-custody and says BitBox will never ask for a password or recovery phrase. Its sender and document-review destination nevertheless use an unofficial lookalike domain, with a review button and supposed live-chat route.

Do not use the document-review button, chat, reply address, or other links in this email. Reassuring language and a genuine BitBox address printed inside a message do not authenticate it. BitBox cannot restrict access to your self-custody wallet because you did not acknowledge an email.

Fake “Quantum Resistance” security-update letter

An observed postal letter claims that BitBox users must complete a “Quantum Resistance security update”. It uses BitBox branding, the Shift Crypto AG company address, the recipient's name and postal address, a deadline, and a QR code. It threatens limited BitBoxApp access, unavailable Clear Signing, or restricted future functionality if the recipient does not complete the update.

Do not scan the QR code or follow the letter's update instructions. BitBox02 firmware updates are delivered through the BitBoxApp; they are not activated through a QR code in an unsolicited letter.

The letter has also reached people who reported that they had never heard of BitBox, used its products, or had a connection to cryptocurrency. A personalized copy does not establish that you are a BitBox customer, own cryptocurrency, or were targeted because of a customer relationship. Receiving it alone does not establish that your wallet or recovery words were compromised.

September 2026 Brevo phishing emails

On 10 September 2026, attackers exploited a security flaw at Brevo, BitBox's external newsletter provider. They accessed the BitBox Brevo account, sent two phishing campaigns, and downloaded its complete stored contact list. The emails falsely claimed a “Microcontroller Entropy” security flaw and directed recipients to a website requesting recovery words.

The exported contact data contained subscribed email addresses only, not subscriber names, postal addresses, payment details, or order data. The incident did not compromise BitBox's internal systems, BitBoxApp, or BitBox hardware wallets. See the official Brevo incident explanation for the full scope and response.

Because the phishing emails were sent through legitimate Brevo infrastructure, they could pass normal email-authentication checks. Those checks did not establish that BitBox authorized the messages. Receiving an email alone does not require a wallet reset or fund transfer.

The documented export contained email addresses only; it does not establish where a later caller obtained a phone number, postal address, or other personal details. Do not attribute another scam to the Brevo incident without case-specific evidence.

Verify, respond, or report

• You have not interacted: do not use the suspicious contact's links, attachments, QR codes, phone numbers, or reply details. Receiving it alone does not require a wallet reset, fund transfer, or Support inquiry. If you want to check it, follow Check whether a BitBox contact is genuine, which links to the official address reference.
• You clicked, scanned a QR code, downloaded or opened a file, installed software, allowed remote access, connected your BitBox, entered information, or approved an action: follow What to do after interacting with a phishing attempt. Choose the most consequential exposure and follow any other applicable account or device guidance. That article explains when Support assistance is needed and when reporting is optional.
• You shared recovery words or a wallet backup: use the urgent recovery-words section of the response guide immediately. Do not reset your BitBox before meeting its backup and access prerequisites, and do not send funds to a destination supplied by the suspicious contact.

To report an attempt or ask BitBox to verify it, independently open the official BitBox Support contact form and create a new inquiry. Use a separate trusted device if you ran suspicious software or allowed remote access. Reporting is optional when you only received the contact; address any exposure first if you interacted.

Include the sender, date, communication channel, website address, filename if relevant, and a short description of what you did. Remove unrelated personal information from screenshots and make QR codes unreadable. Never send recovery words, wallet backups, private keys, passwords, passphrases, PINs, authentication codes, suspicious attachments, or software.