If an unexpected email, letter, call, message, or website claims to be BitBox and asks you to act, stop. Do not use its links, QR codes, downloads, phone numbers, or reply details. The next step depends on what you have already done.

Phishing does not always start with a request for recovery words. Attackers may try to steal account credentials, install software that gives them control of your computer, or persuade you to approve a transaction. They may ask for your wallet backup later. A message can be dangerous even if it says that BitBox will never ask for your recovery words.

If someone unexpectedly calls claiming to be BitBox Support, end the call. BitBox does not provide wallet-security support through phone calls, callbacks, live sessions, or remote access.

Already shared recovery words or a wallet backup? Open What to do after interacting with a phishing attempt immediately and select You entered recovery words or shared a wallet backup. Do not reset your BitBox before meeting the backup and access prerequisites in the linked guidance.

Choose what happened

If several situations apply, choose the most consequential action you took rather than stopping at the first match. Shared recovery words or a backup require the urgent response above. Also follow any other applicable account or device guidance; one response does not resolve every kind of exposure.

You only received the message, letter, or call

Receiving suspicious contact does not by itself give the sender access to your wallet. Do not reply, scan a QR code, open an attachment, call a supplied number, or follow the sender's instructions. No wallet reset, fund transfer, or Support inquiry is required solely because you received the communication.

If you want to check it, follow Check whether a BitBox contact is genuine. For comparison with documented examples, see Known BitBox phishing and scam attempts.

You clicked a link or scanned a QR code but entered nothing

Close the page. Do not download or install anything, connect your BitBox, or approve an action requested by the page. A click alone does not establish that your wallet or computer is compromised.

Follow the click-or-QR-code section of What to do after interacting with a phishing attempt. If a file downloaded or opened automatically, use the corresponding file section as well.

You entered a password or other account information

Stop using the suspicious page. From a separate trusted device, independently open the official website of the affected email, exchange, broker, payment, or other account provider. Follow the account-information section of What to do after interacting with a phishing attempt to secure the affected account through that provider. Never send BitBox Support a password or authentication code.

You downloaded a file, ran software, connected your BitBox, or approved an action

Disconnect your BitBox and approve nothing further. Open What to do after interacting with a phishing attempt and choose the section matching what happened:

• Downloaded a file without opening it: do not open or run it. An unopened download does not by itself establish that the computer is infected. If you are unsure whether it opened automatically, follow the uncertainty guidance in that section.
• Opened or ran a file, installed software, or allowed remote access: software presented as a document viewer or legitimate installer may silently install a remote-access tool. Follow the software and remote-access section even if you saw no remote session and entered no recovery words. If remote access may be active, disconnect the computer from the network, stop sensitive activity, and use a separate trusted device for further contact.
• Connected your BitBox: close the suspicious website or application. The response depends on whether you also entered information, ran software, or approved an action; connecting the device alone does not establish that the wallet backup was exposed.
• Approved an unexpected action or transaction: follow the approved-action section and contact Support through an independently opened official channel. Do not approve another action while investigating.

You entered recovery words or shared a wallet backup

If you entered recovery words into a phishing site or shared your wallet backup with an attacker, treat the wallet and all accounts derived from it as compromised. Anyone with those recovery words can control the wallet and move funds from any of its accounts without your BitBox or device password.

If you use an optional passphrase, access to that separate wallet also requires the passphrase. Never disclose it; tell Support only that you use one so the exposure can be assessed.

Follow the recovery-words section of What to do after interacting with a phishing attempt immediately. It explains when funds must be moved to a newly created wallet and which prerequisites must be met first. Do not reset your BitBox before meeting those prerequisites, or send funds back to addresses from the exposed wallet. Contacting Support does not replace this urgent response.

What BitBox will never ask you to do

Stop if someone claiming to be BitBox asks you to:

• share recovery words, a wallet backup, private keys, passwords, passphrases, PINs, or authentication codes, or enter wallet secrets into a website or application;
• send funds to a supposed “safe” or “secure” wallet supplied by a caller or message;
• install remote-access software or unsolicited wallet software;
• continue a wallet-security case through a phone call, callback, live session, or remote access;
• connect your BitBox to a website to verify, synchronize, restore, or secure the wallet; or
• update BitBox02 firmware outside the BitBoxApp.

Moving funds after a backup exposure is different from sending them to a scammer's supplied destination: the migration procedure guides you to create your own new wallet with new recovery words and verify its backup and receiving addresses.

BitBox02 firmware updates are delivered through the BitBoxApp. For a legitimate update, use the official BitBox02 firmware update guide.

Verify BitBox contact independently

Use Check whether a BitBox contact is genuine for the verification steps, or compare an address with Official BitBox websites, email addresses, and support channels. Do not use information from the suspicious communication to verify that same communication.

If you remain uncertain, manually enter contact.bitbox.swiss in your browser and create a completely new inquiry. Do not reply to the suspicious contact or reuse its ticket number. A genuine automated confirmation does not authenticate a separate caller or message: someone else can submit a real form using your email address.

BitBox Support can help verify communications and product behavior, but it cannot access, freeze, move, or recover funds in your self-custody wallet.

For background on how fraudulent emails imitate trusted senders and lead to malicious downloads or requests for wallet backups, read Staying secure: understanding and identifying scam emails.

Reduce exposure of your main email address

For future newsletter and tutorial subscriptions or orders, use an email alias that forwards messages to your main inbox without revealing its address to the service. Use a separate alias for each service where practical, and keep newsletter or tutorial subscriptions separate from orders so that blocking unwanted marketing mail does not interrupt order communication.

Choose an alias that conceals your main address. Adding a tag such as name+newsletter@example.com can help organize mail, but still reveals name@example.com. Check your email or alias provider's documentation for how forwarding, replies, and disabling an alias work.

Keep an order alias active for delivery updates, invoices, returns, and future support. You depend on the forwarding service to receive these messages. Before disabling an alias, make sure you will not lose needed communication or account-recovery access.

Aliases reduce exposure of your main address and let you block mail to an individual alias, but phishing can still reach an alias. Knowing the alias does not prove that a sender is genuine. An alias does not secure a compromised inbox or hide other order details, such as your name or delivery address.

Report a phishing attempt

Reporting is optional if you only received the contact. If you interacted, follow the applicable response above first and use the reporting guidance in What to do after interacting with a phishing attempt.

To report the attempt or ask BitBox to verify it, independently open the official BitBox Support contact form and create a new inquiry. Use a separate trusted device if you ran suspicious software or allowed remote access.

Include the sender address or phone number, website address, date, communication channel, and a short description of what you did. For a phishing email, you can export the message as an EML (.eml) file or save a PDF or text file using your email application's export or print function. Include the sender address, subject, date, and message text. Do not click links or open attachments to prepare the report. EML exports can include the original attachments; if the export contains suspicious attachments, use a sanitized PDF or text file instead.

Remove unrelated personal information and all wallet secrets before sending evidence. If you include screenshots or photographs, neutralize QR codes. Never send recovery words, wallet backups, private keys, passwords, passphrases, PINs, authentication codes, suspicious attachments, or software.