1. Home
  2. 🔒 Security & Anti-Scam
Log in to post
Load new posts
  • J

    Must-read: MotePay security & anti-scam

    Pinned
    1
    0 Votes
    1 Posts
    47 Views
    J
    MotePay is self-custody — your keys, and the funds they control, are yours alone. That also makes security a shared responsibility. Please read this once; it protects your money. We will NEVER ask for your secrets No one from MotePay — staff, "support", or anyone in this forum — will ever ask for your private key, seed/recovery phrase, wallet / withdrawal / signer password, activation code, API keys, or 2FA codes. Anyone who asks is a scammer. No exceptions. Self-custody means backups are on you Because we can't touch your funds, we also can't recover them. Lose your seed phrase or keys and the funds are gone for good. Back them up offline, in more than one safe place. Never keep them in a screenshot, email, cloud note, or chat. How scams usually reach you Fake "support" that messages you first, or a lookalike account offering to "help recover funds." "Urgent: verify your account / your funds are at risk — click this link." A site that looks like MotePay on a slightly-wrong domain. We never message you first to make you verify or click a link. Only trust official staff accounts and pinned posts, and only ever log in on the official MotePay domain. If something feels off Don't act on urgency. Ask here or through official channels before you click, sign, or share anything. Stay safe — it keeps your business running. — The MotePay Team
  • J

    Make sure you're on the real MotePay — not a lookalike

    1
    0 Votes
    1 Posts
    24 Views
    J
    Fake sites are one of crypto's oldest tricks: a page that looks exactly like the real thing, on a domain that's off by one letter — "m0tepay", an extra word, a different ending. Type your password in, and it's gone. How to never fall for it: Bookmark the official site and always open it from the bookmark — never from a search ad, a DM, or a link in an email. Check the address bar letter by letter before you log in. Lookalikes rely on you glancing, not reading. Be extra wary of "urgent" links and "you must verify now" messages. Real security never works by rushing you. No login page should ever ask for your seed phrase or private key. If one does, it's fake — leave. One careful look at the URL beats any amount of cleanup afterward. Make the bookmark habit now.
  • J

    Two wallets, not one: hot for receiving, cold for savings

    1
    0 Votes
    1 Posts
    14 Views
    J
    Once real money starts flowing in, a simple habit protects most of it: don't keep everything in the wallet you use every day. Split it: Hot wallet — the one connected and used for daily receiving and payouts. Keep just a working balance here. Cold storage — a hardware wallet or an offline wallet for the bulk of your funds. It rarely connects to anything, so it's rarely exposed. Sweep the excess from hot to cold on a schedule that fits you. If your everyday device is ever compromised, the loss is capped at your working balance, not your whole treasury. Banks keep the vault separate from the cash register for a reason. Same idea — your money, your control.
  • J

    Test your backup before you need it — do a recovery drill

    1
    0 Votes
    1 Posts
    8 Views
    J
    You wrote down your seed phrase (right?). But have you ever confirmed it actually works? A backup you've never tested is a backup you're only hoping is correct. Do a quick recovery drill: In a wallet app, use the "restore / import from recovery phrase" option with your phrase. Confirm it loads the right wallet/address. Then remove and set things back up as normal. Why it's worth 10 minutes: Catches a mis-written word, a wrong order, or a missing word — while it's still fixable. Proves your device isn't the single point of failure. Phone dies? You can restore. The worst time to discover a bad backup is the day you actually need it. Test it now, on a calm afternoon, and never worry about it again.
  • J

    If a team touches your payments, don't share one login

    1
    0 Votes
    1 Posts
    38 Views
    J
    Solo, this doesn't apply — but the moment more than one person touches your payments, how you set up access matters a lot. Good habits: One person, one account. Never share a single login. If you can't tell who did what, you can't catch a problem. Least privilege. Give each person only what their job needs. Not everyone needs the power to move funds. Guard the sensitive actions. The stuff that touches money or security settings should sit with the owner, ideally behind an extra check. Off-board fast. Someone leaves, their access goes the same day. The goal isn't distrust — it's that one mistake or one bad actor can't quietly become a big loss. Structure your team's access like it matters, because it does.
  • J

    A 5-minute security checklist before you go live

    1
    0 Votes
    1 Posts
    26 Views
    J
    Before you take your first real payment, run this quick checklist. Five minutes now saves a very bad day later. ☐ Seed phrase backed up — offline, on paper/metal, in two safe places. Never a screenshot or cloud note. ☐ 2FA on — for your MotePay account and your email, using an authenticator app. ☐ Official site bookmarked — you log in from the bookmark, never from a link in a message. ☐ Backup codes saved — the ones that get you in if you lose your phone. ☐ Device clean — OS updated, no sketchy extensions or cracked software. ☐ Address habit set — you verify receiving addresses, and test large payouts small first. All six ticked? You're on solid ground. Save this post and re-run it whenever something changes.
  • J

    Where MotePay will (and won't) ever contact you

    1
    0 Votes
    1 Posts
    43 Views
    J
    Impersonation is the #1 scam playbook: someone poses as "MotePay support" and walks you into handing over access. The fix is simple — know our real channels, and treat everything else as suspect. We WILL: Post official news here, in this forum, from staff accounts and pinned posts. Communicate through our official website and email domain (check the spelling, letter by letter). We will NEVER: DM you first out of nowhere to "verify," "secure," or "recover" your funds. Ask for your keys, seed phrase, passwords, or 2FA codes — anywhere, ever. Contact you from random Telegram/WhatsApp/Discord accounts claiming to be us. Bookmark the official site. If a message doesn't come through a channel above, assume it's a scam and check here first.
  • J

    Always check the address — clipboard malware swaps it

    1
    0 Votes
    1 Posts
    55 Views
    J
    A quiet but nasty attack: malware watches your clipboard, and the moment you copy a crypto address, it swaps in the attacker's address. You paste, it looks fine at a glance, you send — straight to the thief. Protect yourself: After pasting any address, check the first 4 and last 4 characters against the source. Better yet, check more. For a new or large payout, send a tiny test amount first, confirm it arrived, then send the rest. Use address book / whitelist features so you reuse verified addresses instead of copy-pasting fresh each time. Keep your device clean: updates on, no sketchy browser extensions or cracked software. Two seconds of checking beats an irreversible mistake. On-chain payments don't come back.
  • J

    Before you sign: how approval scams drain wallets

    1
    0 Votes
    1 Posts
    43 Views
    J
    One of the sneakiest crypto scams doesn't steal your keys — it tricks you into signing an approval that lets it take your funds later. How it works: a fake site or "airdrop" asks you to connect your wallet and sign something. The signature isn't a harmless login — it's a token approval that hands an attacker permission to move your assets. Stay safe: Read what you're signing. If a request wants approval/allowance over your tokens, stop and understand why. Don't connect your wallet to sites you reached from a DM, an ad, or a random link. Periodically review and revoke approvals you no longer use (tools like Revoke.cash). "Free" claims and urgent "act now" pressure are red flags. When in doubt, don't sign. Ask here first.
  • J

    Turn on 2FA — the 30-second lock that stops most account theft

    1
    0 Votes
    1 Posts
    48 Views
    J
    Passwords leak. 2FA (two-factor authentication) is the cheap insurance that makes a leaked password almost useless to a thief. How it works: after your password, you enter a 6-digit code from an app on your phone. No code, no entry — even if someone has your password. Do it right: Use an authenticator app (Google Authenticator, Authy, 1Password) rather than SMS. SIM-swap attacks can steal SMS codes. Save the backup codes somewhere safe when you set it up — they get you back in if you lose your phone. Turn it on for your email too. Your email can reset everything else. Takes 30 seconds. Blocks the most common way accounts get stolen.
  • J

    How to store your seed phrase safely

    1
    0 Votes
    1 Posts
    42 Views
    J
    Your seed phrase is the master key to your funds. Store it right once, and you're set. Do: Write it on paper (or stamp it in metal), kept offline. Two copies, in two separate safe places. Treat it like cash that can't be cancelled. Never: Photograph or screenshot it. Put it in email, notes apps, cloud drives, or a chat. Type it into any website or send it to "support." Remember: no one — including MotePay — can recover it for you. That's the point of self-custody, and why these habits matter.
  • J

    Spot a fake MotePay in 3 seconds

    1
    0 Votes
    1 Posts
    34 Views
    J
    Scammers copy logos, names, even whole websites. Before you trust anything claiming to be MotePay, run this 3-second gut-check: Real MotePay never asks for your keys, seed phrase, passwords,activation code, or 2FA codes — ever. Real MotePay never DMs you first, and never sends a "click here to verify / recover funds" link. Real MotePay lives only on our official domain — check the address bar,letter by letter. Real news comes from official staff accounts and pinned posts here —not a stranger's private message. If even one of these fails, stop. It's a scam. When unsure, ask here first.