Stop communicating with the sender. Do not use the suspicious message, call, website, or application to take further action, and do not approve anything else on your BitBox. Use the responses below for what you already did; several may apply.

Never send recovery words, wallet backups, private keys, passwords, passphrases, PINs, or authentication codes to BitBox Support or anyone else.

What happened?

You do not need to rank the risks. Follow every matching response. If the computer may be compromised, contain its access first, then use trusted equipment for wallet and account actions.

• Shared recovery words or a backup, approved an unexpected action, or connected your BitBox: use Protect your wallet.
• Opened or ran a suspicious file, installed software, allowed remote access, or are unsure whether software ran: use Contain computer access and arrange recovery.
• Entered a password, authentication code, or other account information: use Secure the affected online account.
• Only received contact, opened a link, or downloaded a file without opening it: use Received, clicked, or downloaded without further action.

Protect your wallet

You entered recovery words or shared a wallet backup

If you entered recovery words into the suspicious page or application, or gave someone your wallet backup, treat the wallet and all accounts derived from it as compromised. An attacker can move funds without your BitBox or device password. Access to a separate wallet protected by an optional passphrase also requires that passphrase.

If you also ran suspicious software or allowed remote access, first contain computer access as described under You opened or ran a file, installed software, or allowed remote access. Use trusted equipment for the wallet response.

If funds are held in a wallet exposed by those recovery words and you can still access them, move them to a newly created wallet with new recovery words and a new backup that have never been exposed. Follow How to move funds to a new wallet using a single BitBox02.

Do not reset the BitBox until you have met every prerequisite in the migration procedure. Do not send funds back to an address from the exposed wallet.

Contact BitBox Support from a separate trusted device if you cannot access the affected wallet, meet the migration prerequisites, or determine what was exposed. Never disclose an optional passphrase; mention only that you use one. Contacting Support does not replace the urgent wallet response. The exposure remains unresolved while funds remain in the affected wallet; after migration, stop using its receiving addresses and keep the new backup protected.

You approved an unexpected action or transaction

• Stop using the suspicious website or application.
• Check the affected account and transaction history in the official BitBoxApp. If the computer may be compromised, first follow the software and remote-access section and use trusted equipment; do not reconnect your BitBox to the affected computer to investigate.
• Record the transaction identifier and displayed status, but do not share wallet secrets.
• Do not approve another action while you investigate.

Contact BitBox Support with the transaction identifier, displayed status, and what you remember approving so it can help interpret BitBoxApp or device behavior. Do not approve another transaction to “cancel”, “verify”, or “secure” the first one at the sender's request.

If the action involved an exchange, broker, email, payment, or another external account, contact that provider through its independently opened official website. BitBox cannot freeze an external account or reverse a transaction confirmed on a blockchain.

If you cannot determine whether an action was approved or a transaction was broadcast, stop before further wallet activity and ask Support to help interpret the non-sensitive information. Finding a transaction in the history establishes its displayed status; it does not reverse it or resolve any separate account or computer exposure.

You connected your BitBox to a suspicious website or application

• Disconnect the BitBox.
• Close the website or application.
• Do not approve another action on the device.
• If the computer may be compromised, follow the software and remote-access section first and use trusted equipment. Check the wallet only with the official BitBoxApp obtained from the official BitBoxApp download page.

Connecting the BitBox alone does not establish that your wallet backup was exposed. If you also entered information, ran software, allowed remote access, or approved an action, follow those responses as well.

If you are unsure what the website or application requested or what the BitBox displayed, contact Support with those non-sensitive details before using it again. Disconnection stops further interaction with that computer; any other exposure still needs its own response.

Contain computer access and arrange recovery

You opened or ran a file, installed software, or allowed remote access

This section also applies if you ran a script or installer presented as a transcript, document viewer, or update. A remote-access client can be installed silently, so use this response even if you saw no remote session and did not enter recovery words. A genuine installer or official website appearing afterward does not prove that the download was safe.

Contain possible access before investigating or attempting cleanup:

1. If remote access may be active, disconnect the affected computer from the network: unplug its Ethernet cable and turn off Wi-Fi, as applicable. Do not wait for a visible remote-session window; closing a window does not establish that access has ended.
2. Disconnect your BitBox from the computer and do not approve further actions on the device.
3. Stop using the affected computer for wallet, exchange, broker, email, payment, or other sensitive activity.
4. Continue from a separate trusted device. Independently open official websites to contact BitBox and any affected account provider; seek qualified device-security assistance for computer recovery.

Network disconnection interrupts remote access while the computer remains offline. It does not remove installed software. Do not reconnect a computer suspected of remote access merely to download updates or seek help.

Recover the affected computer

Seek qualified device-security assistance before returning the computer to sensitive financial use. BitBox Support can help interpret wallet or device behavior, but cannot inspect or certify the computer. For a BitBox inquiry, describe the file or software and what you did; do not send the suspicious file.

If funds were stolen, law enforcement is involved, or the computer may contain evidence, agree how to preserve it with the responsible investigator or security professional before deleting files, resetting, erasing, or reinstalling.

Recovery may include updating the operating system and trusted security software and running a full or offline malware scan where supported. Deleting a file, clearing browser data, uninstalling the visible application, or receiving a clean scan does not prove that the computer is free of malware.

If malware cannot be removed, suspicious behavior continues, or a more thorough recovery is needed, a qualified expert may recommend erasing the computer and reinstalling its operating system from a trusted manufacturer source. This can erase data and evidence, and restoring an affected backup can reintroduce malware. It is not a routine response to a click or an unopened download.

Remote access does not by itself establish that recovery words were exposed. If account information, a wallet backup, or an approval was also involved, follow the relevant responses using trusted equipment. Keeping the computer offline contains possible access; computer recovery and any account or wallet response remain separate work.

Secure the affected online account

You entered a password or other account information

Do not send the password, authentication code, or other account secret to BitBox Support. The response belongs to the provider that controls the affected email, exchange, broker, payment, or other account.

1. Use a separate trusted device and independently open the provider's official website or application. Do not use a link or phone number from the suspicious contact.
2. Change the affected password and any other account that reused it.
3. Enable two-factor authentication and revoke unfamiliar or all active sessions where the provider offers these controls.
4. Review recent activity, recovery details, connected applications, forwarding rules, and pending withdrawals or payments.
5. Contact the provider through its official support route if access, a withdrawal, or another account action remains unresolved.

The account response requires completing the provider's security checks and resolving unfamiliar access or pending actions through that provider. If you cannot sign in, use its official account-recovery route from the trusted device. Changing a password alone may not end existing sessions.

Clearing cookies or browser history does not remove malware and does not replace changing the password or revoking sessions through the provider. BitBox cannot secure an external account or cancel its pending withdrawal.

Received, clicked, or downloaded without further action

You only received the message, letter, or call

Receiving suspicious contact does not by itself give the sender access to your wallet.

• Do not reply, click links, scan QR codes, open attachments, or call a supplied phone number.
• Block the sender or caller.
• Delete or safely archive the communication so that you do not interact with it accidentally.

If you only received the communication and did not interact further, no wallet reset, fund transfer, or Support inquiry is required. Reporting or asking BitBox to verify the contact is optional.

You received an unexpected support confirmation

A scammer may have entered your email address into a genuine support form. The resulting automated confirmation can be real even though you did not create the request.

• Do not treat a separate caller, message, or conversation as legitimate because of the confirmation.
• Do not reply to the unexpected confirmation or use case references, links, phone numbers, or employee details supplied by the other person.
• If you did not otherwise interact, no wallet action is required.

If you want BitBox to verify or close the request, create a new official inquiry and state that you did not submit it. This is optional if nothing else happened; the confirmation alone requires no wallet action.

You clicked a link or scanned a QR code but entered nothing

• Close the page.
• Do not download or install anything from it.
• Do not connect your BitBox or approve an action requested by the page.
• Open the official BitBox website manually if you still need to complete a legitimate task.

A click or page display alone does not establish that your email account, computer, BitBox, or wallet was compromised. No wallet reset or fund transfer is required solely because you opened the page.

If nothing downloaded or ran and you entered no information, connected no device, and approved no action, closing the page ends this interaction; reporting is optional. If you are unsure whether a file downloaded, check the unopened-download guidance. If it may have opened or run, follow the software and remote-access precautions before investigating.

You downloaded a file but did not open it

Do not open or run the file.

• Record the filename and the website or message it came from without revisiting the site.
• Do not upload or forward the suspicious file unless BitBox Support gives you a specific safe submission method.
• Delete or quarantine the file when it is no longer needed as evidence, and empty it from the download location or trash without opening it.

If you are certain that the file was not opened or run, downloading it does not by itself establish that the computer is infected. If the browser may have opened it automatically or you cannot establish whether anything ran, follow the precautions in the software and remote-access section before investigating.

Once the unopened file is removed or quarantined to prevent accidental use, reporting is optional. You can provide its filename and source address without forwarding the file.

Contact Support or report the attempt

Contain immediate access and follow the applicable wallet or account response. If you cannot meet a prerequisite or proceed safely, stop and seek help. To contact BitBox, independently open the official BitBox Support contact form and create a new inquiry. Use a separate trusted device if the computer may be compromised. Do not reply to the suspicious communication or reuse its phone number, link, ticket code, or supposed employee contact.

Include only non-sensitive evidence:

• sender address or phone number;
• website address;
• date and communication channel;
• redacted screenshots or photographs;
• filename of a suspicious download; and
• a short description of what you clicked, scanned, downloaded, installed, connected, entered, or approved.

Never include recovery words, wallet backups, private keys, passwords, passphrases, PINs, or authentication codes. Cover personal information that is not needed to identify the attempt, and neutralize QR codes in screenshots unless Support provides a specific safe submission method.

BitBox Support can help verify communications and interpret product behavior. It cannot secure an external account, certify a computer, recover wallet secrets, control your funds, or reverse a confirmed blockchain transaction.