The most convincing crypto phishing email may not look homemade. It may copy a real exchange notice you received last week, reuse the same branding and legal footer, mention a believable support case and change only one link or reply address. This technique is called clone phishing. It exploits familiarity: instead of asking you to trust a completely new message, the attacker makes a dangerous message resemble one you already trust.
Last reviewed: October 29, 2026. Email providers, exchanges, wallet interfaces and NordPass features change. Confirm sensitive actions through the provider’s current official application or website. This independent educational guide is not financial, legal or incident-response advice, and no password manager can guarantee protection from phishing or asset loss.
What is clone phishing?
Clone phishing is an attack in which a criminal copies a legitimate email and replaces a safe element with a harmful one. The changed element might be a sign-in button, an attachment, a QR code, a telephone number, a wallet address or the address that receives your reply. The attacker may claim that the original message contained an error and that the replacement is the corrected version.
The copied message can preserve the sender’s display name, subject line, formatting, logos, timestamps, signature and unsubscribe footer. If the attacker has seen a real email or compromised one participant in a conversation, the clone may also include accurate details. Good grammar and correct branding therefore do not establish authenticity.
Clone phishing versus ordinary phishing
| Attack | How it gains trust | Typical crypto example |
|---|---|---|
| Generic phishing | Sends the same urgent message to many recipients | “Your exchange account will be closed today.” |
| Spear phishing | Uses information about one person or organization | A message names your employer, role or known holdings. |
| Clone phishing | Copies a legitimate message or conversation | A familiar withdrawal notice is resent with a different cancel button. |
| Thread hijacking | Replies inside a genuine conversation after an inbox is compromised | A real support thread suddenly requests a login or wallet connection. |
| Sender spoofing | Makes header information or the display name resemble a trusted sender | “Exchange Support” appears above an unrelated address. |
These categories can overlap. A targeted clone may be spear phishing, and a cloned message can be sent from a compromised real mailbox. The practical lesson is that appearance alone cannot tell you which situation you are facing.
Why crypto users are valuable targets
Crypto accounts combine urgency with potentially irreversible actions. An attacker may not need to defeat every security control. A password and current one-time code may be enough to establish a session. A malicious attachment may steal an existing session. A wallet signature may approve token access, and a fake “safe address” may persuade the owner to authorize the transfer personally.
Exchange emails also follow predictable patterns: login alerts, withdrawal confirmations, deposit updates, identity checks and support replies. Criminals can copy these templates and time a campaign around market volatility, a widely reported outage or a provider migration. A message can sound plausible even when the attacker knows nothing about your actual account.
How attackers obtain a believable original
An attacker does not always need access to your inbox. Transactional email templates can be collected by opening an account, found in screenshots, copied from previous campaigns or reconstructed from public branding. Marketing and support platforms may also be breached. If an inbox, support agent or business partner is compromised, the attacker can obtain genuine subjects, signatures and conversation history.
Data from an unrelated breach can improve the clone. An email address, name, phone number or knowledge that someone uses a particular exchange may be enough to make a mass-produced message feel personal. Do not assume that a correct name or account reference proves the sender controls the provider’s systems.
Scenario 1: the “corrected” withdrawal notice
You receive a familiar withdrawal notification followed by a second message claiming that the first confirmation or cancellation link was defective. The new button opens a copied exchange login page. After collecting the password, the page may request an authenticator code and display a false error while the attacker uses the credentials elsewhere.
Do not approve or cancel a withdrawal from an email link. Open the official application or a saved bookmark and inspect withdrawal history. If the event does not exist there, preserve the message and report it. If an unauthorized withdrawal is pending, use the exchange’s official lock or support route immediately.
Scenario 2: fake KYC or account migration
A cloned compliance message may say that identity verification has expired, a regional entity is changing or an account must migrate before a deadline. The destination can collect credentials, identity documents and facial images. Those records may then support account recovery fraud or identity theft.
Regulated services can require legitimate verification, but complete it only after independently entering the official account. The request should be visible in the provider’s own interface. A deadline does not justify uploading documents to a domain reached from an unsolicited message.
Scenario 3: wallet update or token migration
A cloned wallet announcement may replace a legitimate download with malware or direct users to connect a wallet and “migrate” assets. The website may request a signature, token approval or seed phrase. A real wallet update never needs recovery words merely to install software, and legitimate support cannot validate a wallet by asking for its private key.
Get wallet software from a previously verified official source. Confirm announcements across more than one official channel, especially when a message concerns a security emergency. Read the transaction or signature request rather than relying on the description shown by the website.
Scenario 4: a reply inside a genuine support thread
A reply in the correct conversation is especially persuasive. The attacker may have compromised the customer’s email, a support mailbox or a third-party ticketing account. The earlier messages are real, and only the latest instruction is malicious. It may ask the user to move funds, install remote-access software, disclose a code or continue the conversation on Telegram.
When the requested action is unusually sensitive, verify it through a new channel. Open the provider’s help center independently and create a fresh case that references the old ticket number. Do not use the phone number, form or chat account supplied by the suspicious reply.
Anatomy of a cloned crypto email
| Element | What may be manipulated | What to do |
|---|---|---|
| Display name | Any sender can often type “Exchange Security” | Expand the sender details and read the complete address. |
| From address | Lookalike domains can replace, add or transpose characters | Compare the domain with a known official domain. |
| Reply-To | Replies may go somewhere different from the visible sender | Inspect it before replying, particularly in support cases. |
| Button or text link | The visible wording can hide a different destination | Do not follow it; enter through a bookmark or verified app. |
| QR code | The destination is difficult to inspect before scanning | Treat it like an untrusted link, not as proof of authenticity. |
| Attachment | A “statement” or “update” may install malware | Retrieve documents from the signed-in account instead. |
| Ticket or transaction number | It can be copied, guessed or obtained from a breached inbox | Confirm it in the provider’s official interface. |
| Urgent deadline | Pressure reduces independent verification | Pause and use a separate route to investigate. |
The display name is not the sender
Mail applications emphasize a friendly display name and may hide the complete address on a small screen. “Coin Exchange,” “Wallet Team” or even a colleague’s name can be chosen by the sender. Expand the message details and compare the address character by character.
Look for swapped letters, added words, unexpected country-code domains and misleading subdomains. In exchange.security-example.com, the registrable domain is normally security-example.com, not exchange.com. A padlock only means the browser encrypted its connection to that site; it does not mean the site belongs to the exchange.
From, Reply-To and Return-Path are different
The visible From field identifies who the message claims to be from. Reply-To can direct your response to another address. Return-Path is used for delivery failures and can differ for legitimate mailing infrastructure. A difference is not automatic proof of fraud because providers use specialized email services, but an unexplained mismatch deserves investigation.
Never “test” a sender by replying with account information. A reply confirms that the address is active and may continue the social-engineering conversation. Verify the matter inside the account or through contact information you found independently.
What email headers can—and cannot—tell you
Full headers show the servers involved in delivery, authentication results, message identifiers, dates and routing information. They can help a provider or investigator understand where a message came from. Save the original message or headers when reporting a campaign instead of relying only on a screenshot.
SPF, DKIM and DMARC results are useful but not a personal authenticity certificate. A message may pass authentication for an attacker’s lookalike domain. It may also be sent through a compromised legitimate account or authorized marketing platform. Conversely, forwarding and unusual mail infrastructure can complicate otherwise legitimate results. Headers support an investigation; they do not replace verification inside the crypto service.
A safe verification workflow
- Stop. Do not click, scan, reply, download or call from the message.
- Identify the claim. Is it about a login, withdrawal, deposit, KYC request, support case or software update?
- Open a trusted route. Use a saved bookmark, a verified mobile app or a manually checked official address.
- Check the account. Look for the same alert, transaction, case or required action after signing in independently.
- Inspect history. Review login sessions, devices, security changes, withdrawals and API activity as applicable.
- Verify support separately. Start a new request through the official help center rather than replying to the email.
- Preserve evidence. Keep the original message, headers, URL, attachment name and time received.
- Report and remove. Send it to the provider’s documented abuse route, then mark it as phishing.
This workflow avoids a circular mistake: asking a potentially fraudulent message to prove that it is genuine. Independent verification is the central defense.
Use bookmarks and applications as controlled entry points
Create bookmarks only after verifying the service address from trustworthy documentation. A bookmark is valuable because it avoids search advertisements, mistyped addresses and email links. It is not permanent proof: providers can change domains, browser synchronization can be compromised and a device can contain malware. Recheck important bookmarks periodically.
Official applications provide another controlled route, but install them from the provider’s verified listing rather than an advertisement or message. Review the publisher, update history and requested permissions. Do not install an “emergency security update” delivered as an email attachment.
How NordPass can help
NordPass can generate and store a different password for every exchange, email account and wallet companion service. If a password is stolen from one site, uniqueness prevents the same value from directly unlocking other accounts. Password Health and exposed-password features can help identify credentials that require attention, depending on the current plan and product configuration.
Save the verified login URL with the credential. When NordPass does not offer the expected item on a page, treat that absence as a reason to inspect the domain. Email Masking can create a separate address for a service, which can reduce exposure of a primary address and provide context when an alias receives an unexpected message.
Autofill is a signal, not a verdict
Password-manager autofill generally associates a credential with a domain. A lookalike page should not receive the item saved for the genuine domain, making missing autofill a useful warning. Do not respond by opening the vault and pasting the password manually. Close the page and navigate independently.
Autofill is not infallible. A saved URL can be too broad or incorrect, the legitimate site can include third-party identity flows, and a compromised genuine domain can still be dangerous. A stolen session can also bypass the need for a password. Use autofill after checking the address, not instead of checking it.
Email masking can reveal context, not authenticity
A unique masked email for a crypto service can make account correlation more difficult and show where an address was used. If an alias created only for one provider receives an unrelated pitch, the event may indicate sharing, guessing or exposure that deserves review.
However, a message sent to the correct alias is not necessarily genuine. Attackers can obtain addresses through breaches and compromised mailboxes. Protect access to the forwarding destination, document which alias belongs to which service and make sure the alias can be recovered before relying on it for an important account.
What NordPass cannot verify
- It cannot certify that an email sender, support agent or transaction is legitimate.
- It cannot make a wallet signature or token approval safe.
- It cannot protect credentials copied from an infected device or stolen session in every case.
- It cannot reverse a cryptocurrency transfer.
- It cannot replace exchange withdrawal controls, hardware-backed authentication or clean devices.
- It should not be treated as an ordinary storage location for seed phrases or raw private keys.
A password manager is one layer. The larger system includes the primary email, devices, MFA, recovery methods, exchange settings, wallet-signing habits and offline backups.
Configure exchange email defenses before an incident
Some exchanges provide an anti-phishing code that appears in genuine transactional email. Enable it where available and choose a value that is not public. A missing or incorrect code is a warning, but a correct code should not override other concerns: copied historical emails and compromised provider infrastructure remain possible.
Enable alerts for logins, security changes, API keys and withdrawals. Use withdrawal-address allowlisting and a delay for newly added addresses where appropriate. Prefer phishing-resistant authentication such as a hardware security key or supported passkey over SMS when the provider and recovery plan allow it. Keep backup codes offline and separate from the password.
Protect the email account that controls recovery
The primary email may be more powerful than the exchange password because it receives reset links and device approvals. Give it a unique generated password, strong MFA and current recovery information. Review active sessions, connected applications, forwarding addresses and inbox rules. An attacker may hide exchange alerts by automatically archiving or deleting them.
Consider a dedicated address for financial accounts that is not used for newsletters or public profiles. Do not publish it, and do not place the exchange password in an email draft. If you suspect takeover, secure the email from a trusted device before changing dependent exchange credentials.
If you clicked but entered nothing
Closing the page may be enough when it was an ordinary credential-harvesting site and no information, download, browser permission or wallet connection was provided. Still record the URL, report the message and check whether anything downloaded automatically. Remove unexpected notification permissions and review browser extensions.
If the device showed unusual behavior, the page requested software, or an attachment was opened, treat the event as more serious. Update security software and consider professional assistance. Do not use the same potentially compromised device to rotate every high-value credential.
If you entered a password or one-time code
Use a known-clean device. Secure the controlling email, then change the affected password through the official service. End other sessions, remove unknown devices and inspect recovery settings. If the password or a recognizable variation was reused, replace it everywhere else with a different generated value.
A one-time code can be relayed immediately, so assume the attacker may already have a session. Changing the password does not always revoke active sessions. Use the provider’s global sign-out controls, review trusted devices, replace compromised MFA enrollment where required and check for newly created API keys or withdrawal addresses.
If you downloaded a file or installed an update
Disconnect the affected device from sensitive activity. Do not open exchanges, email or NordPass there until the risk has been assessed. Record the file name and source without sending the suspected malware to other people. Use a separate trusted device for containment actions.
An infostealer can copy browser cookies, saved credentials, wallet extension data and files. Deleting the downloaded file does not prove the device is clean. Depending on the evidence and value at risk, a professional assessment or clean operating-system reinstall may provide more confidence than one antivirus scan.
If you connected a wallet or signed something
Connecting a wallet normally reveals addresses but does not by itself transfer assets. A subsequent signature or transaction can have consequences that are not obvious from the website’s button. Determine exactly what was signed: a login message, token approval, permit, contract interaction or transfer.
Use trusted blockchain tools and wallet documentation to inspect and revoke unwanted token approvals where possible. Revocation does not undo transfers that already occurred, and moving assets may be appropriate when a private key or seed phrase was exposed. Network fees, contract behavior and urgency create room for more mistakes, so seek qualified help without sharing the recovery phrase.
If you disclosed a seed phrase or private key
Do not merely change a wallet application password. The exposed recovery material can recreate the wallet elsewhere. From a trusted device, generate a new wallet with new recovery material and move remaining assets after verifying the destination. Consider tokens, NFTs, pending transactions and assets across every network derived from the exposed secret.
Never send the phrase to someone who promises recovery, validation or tracing. Do not store the replacement phrase in an email, screenshot, cloud note or ordinary password entry. Use an intentional offline backup method and test the new receiving setup before moving a significant amount.
Incident response order for a suspected clone
- Move to a known-clean device if malware or session theft is possible.
- Secure the primary email and remove hidden forwarding or recovery changes.
- Lock or restrict the exchange account through verified controls.
- Change exposed passwords and revoke active sessions.
- Review MFA methods, passkeys, trusted devices and backup routes.
- Delete unknown API keys and inspect their permissions and activity.
- Review withdrawals, address allowlists and recent trades.
- Analyze any wallet signature or approval and protect remaining assets.
- Contact official support and preserve case numbers and evidence.
- Replace every other credential that reused the exposed password.
Containment should follow dependencies, not panic. Securing an exchange while leaving its recovery email under attacker control allows another reset. Conversely, spending hours analyzing a header while an unauthorized withdrawal is pending is the wrong priority.
Evidence worth preserving
- The original email file or full headers, not only a screenshot.
- The sender, Reply-To address, subject and received time.
- The visible link text and actual destination URL.
- Attachment names and cryptographic hashes if collected safely by an expert.
- Exchange login alerts, device records and security-change notices.
- Support case numbers and the official channel used.
- Wallet addresses, transaction hashes, contract addresses and timestamps.
- A chronological record of actions you took after discovery.
Do not publish evidence containing identity documents, session tokens or account details. Provide it only through appropriate official or law-enforcement channels. Evidence cannot guarantee recovery, but it can help providers investigate and prevent conflicting accounts of the timeline.
Red flags that deserve an immediate pause
| Message claim | Primary risk | Independent check |
|---|---|---|
| “Cancel an unknown withdrawal here” | Credential and MFA theft | Open withdrawal history in the official app. |
| “Verify KYC before midnight” | Identity and account theft | Check the signed-in compliance dashboard. |
| “Download this wallet security patch” | Infostealer or counterfeit wallet | Use the verified official download channel. |
| “Reply with your authentication code” | Real-time account takeover | Never disclose the code; contact support independently. |
| “Move funds to a protected wallet” | Irreversible transfer to the attacker | Lock the account and open a new official case. |
| “Connect and sign to reactivate assets” | Malicious approval or transfer | Confirm the event through the project’s official channels. |
| “Continue with our agent on Telegram” | Impersonation and isolation | Stay inside the documented support system. |
A five-minute pre-click routine
- Ask whether you expected the message and whether the claimed event exists.
- Expand the sender details, but do not treat a familiar address as final proof.
- Read the destination without opening it, if your mail client can reveal it safely.
- Open the provider independently and inspect the account notification center.
- If anything conflicts, stop and create a new official support request.
The purpose is not to become an email-forensics expert. It is to avoid letting the suspicious message control the verification process.
Monthly prevention checklist
- Confirm that exchange and financial-email passwords remain unique.
- Review NordPass Password Health and exposed-password warnings.
- Check email sessions, recovery methods, connected apps and forwarding rules.
- Review exchange devices, API keys and withdrawal protections.
- Remove browser extensions and mobile applications you no longer need.
- Verify important bookmarks and official application publishers.
- Test access to offline backup codes without copying them into the vault.
- Discuss the “verify through a new channel” rule with anyone sharing financial responsibilities.
Frequently asked questions
What is clone phishing in crypto?
It is a phishing attack that copies a legitimate exchange, wallet or support message and replaces a safe link, attachment, reply address or instruction with a malicious one. The copied design and context make the message more believable.
How can I verify an email from a crypto exchange?
Do not use the message’s link or contact details. Open the official app or a verified bookmark, check the event inside the account and contact support through a new request if the claim cannot be confirmed.
Can a phishing email pass SPF, DKIM or DMARC?
Yes. An attacker’s message can pass for the attacker’s own lookalike domain, and a message sent through a compromised legitimate account or authorized system may also authenticate. These checks provide evidence about delivery and domain authorization, not a guarantee that every instruction is safe.
Does NordPass protect against fake exchange websites?
NordPass can associate saved credentials with the correct domain, so missing autofill may warn you about a lookalike site. It cannot certify a website, protect every compromised device or evaluate wallet transactions. Always inspect the domain and use an independent route.
Is a message genuine if NordPass autofill works?
Not necessarily. The saved URL might be broad or wrong, and a legitimate domain or device can be compromised. Autofill is one signal, not a security verdict.
Will a real support agent ask for my MFA code or seed phrase?
No legitimate support process requires your seed phrase, private key, NordPass Master Password or current one-time authentication code. Stop the conversation and contact the provider through its official help center.
What should I do if I entered my exchange password on a cloned page?
From a trusted device, secure the recovery email, change the exchange password, revoke sessions, inspect devices, MFA, API keys and withdrawal settings, and contact official support. Replace the password anywhere it was reused.
Should I report a cloned email?
Yes. Preserve the original and full headers, then use the exchange’s documented security or abuse channel and your mail provider’s phishing-report function. Do not forward sensitive material to unofficial helpers.
Official sources and further reading
The following primary sources explain the security concepts and product features used in this guide:
- NordPass — Clone phishing: how hackers weaponize trusted emails — the main official reference for how cloned messages work and how to recognize them.
- NordPass — How do hackers get others’ passwords? — an overview of phishing, social engineering, credential theft and related account risks.
- NordPass Support — What is autofill and how does it work? — official information about supported autofill environments and browser-extension behavior.
- NordPass Support — How to use Email Masking — official setup and usage guidance for masked email addresses.
- NordPass Support — Exposed Passwords FAQ — explains exposed-password detection and the need to change affected credentials on the original service.
- CISA — Recognize and Report Phishing — official public guidance on identifying, resisting and reporting phishing attempts.
Final thoughts
Clone phishing succeeds when familiarity replaces verification. A copied logo, accurate ticket number or genuine previous message can make a harmful instruction feel routine. The safest response is procedural: leave the message, open the service independently and confirm the event inside the account.
NordPass can make unique passwords, known login URLs, breach review and masked email workflows easier to manage. Keep its role precise. It protects and organizes credentials; it does not authenticate every sender, inspect every wallet signature or reverse a transfer. Combine it with a secured recovery email, strong authentication, exchange withdrawal controls, clean devices and a rule that no urgent message gets to define its own verification channel.