A user opens their browser, searches for a wallet extension, finds what appears to be the official store listing, and clicks install. Within minutes, the wallet is active and ready to receive a seed phrase. This routine action contains a critical vulnerability: phishing attacks against browser wallets succeed precisely because they replicate the installation experience so closely that casual verification becomes impossible. The difference between a genuine Alby, Ambire, or Coinbase wallet extension and a counterfeit one may be only a single character in the URL, a logo variant, or a listing buried among similar results.

Anti-phishing protection begins before installation, not after. It requires a specific operational discipline: authenticating the domain, verifying the extension signature, cross-checking the official source, and understanding which security warnings matter. This checklist translates that discipline into a repeatable process that works across different wallet types, browsers, and threat levels. The goal is not to become paranoid. It is to encode skepticism into the sequence of steps taken before entering a recovery phrase or authorizing high-value transactions.

Why standard app store browsing creates phishing risk

Browser extension stores—Chrome Web Store, Firefox Add-ons, Microsoft Edge Add-ons—are designed for usability, not for cryptographic identity verification. Listings are ranked by popularity, rating, and relevance rather than by cryptographic proof of authenticity. A scammer can create an extension with a similar name, a passable logo, and enough positive fake reviews to appear legitimate to someone unfamiliar with the official project. The store itself performs some automated scanning, but that process does not verify that the listed developer is the actual wallet team.

This gap exists because extension stores serve general consumers, not specialized cryptocurrency users. A user installing a weather app or ad blocker faces limited loss from installation mistakes. A user installing a wallet extension faces total loss of cryptocurrency if the extension is fake. The stores’ baseline security assumptions do not account for that asymmetry. Phishing prevention therefore cannot rely on store curation alone. It requires personal verification at the point of installation.

Real wallet projects publish official installation guidance, verify their developer accounts, and maintain consistent branding across their websites. But scammers can replicate website layouts, use domain names that differ by a single letter (alby.io vs alby.io-security, for example), and register developer accounts with email addresses that look similar to official ones. The only reliable anti-phishing protection at this stage is direct cross-reference against the official project documentation rather than reliance on visual similarity or store placement.

Step one: Locate the official project documentation

Before opening an extension store, navigate to the official wallet project website using a direct bookmark, a trusted search result, or a URL you have verified in previous sessions. Do not click links from emails, ads, social media posts, or browser suggestions. For Ambire, that means visiting ambire.com directly. For Braavos, braavos.app. For Fastset, fastset.xyz. If you have not visited the site before, use a search engine and look specifically for the official project’s social media accounts (Twitter, GitHub, Discord) to confirm the website domain.

On the official site, look for a “Downloads,” “Install,” “Get Started,” or “Security” section. This section should contain a direct link to the extension store listing, not a redirect. The page should also display the official extension name, the publisher’s verified account name, and a warning about fake copies. Wallet projects that have experienced phishing attacks often maintain this guidance prominently because they understand the risk.

Copy the extension name and developer name from the official source, then open the extension store in a separate browser tab. Do not search for the wallet by name alone. Instead, navigate directly to the extension store and search for the exact publisher name provided on the official website. This is anti-phishing protection in its most concrete form: matching two independent sources before any installation occurs.

If the official website does not provide an installation link or developer name, contact the project through official channels (their verified Twitter account, Discord support, or GitHub issues) before proceeding. Legitimate wallet projects respond to these queries because they depend on user security. A project that cannot or will not provide clear installation guidance should be treated as a higher risk, regardless of its reputation.

Step two: Verify the extension store listing against official information

Once you have located the extension in the store, compare every visible field to the official documentation. This includes the extension name, developer name, description, icon, and the URL of the store listing itself. Copy the store listing URL into a text editor and examine it carefully. Chrome Web Store listings follow the pattern chrome.google.com/webstore/detail/[NAME]/[ID]. The ID is a long string of letters unique to that extension. If you have installed the wallet before, you can verify this ID has not changed.

The developer name is the most important field to verify because it is harder to counterfeit than a visual logo. If the official source says the developer is “Ambire Dev,” check that exact spelling in the store listing. Common phishing tactics include using similar names such as “Ambire Developer,” “Ambire Labs,” or “Official Ambire Wallet.” These variants look similar enough to pass casual inspection but are not the official account. Wallet authentication at this stage means exact matching, not approximate similarity.

Read the extension description and check that it matches the tone and content of the official project. Scam extensions sometimes copy the description but introduce minor errors, awkward phrasing, or spam links hidden in the fine print. Scroll through all visible information and look for inconsistencies. Then scroll to the “Reviews” section and check the most recent reviews. A newly published extension with several five-star reviews from accounts created in the same week is a warning sign. Genuine popular wallets accumulate reviews over months or years, with a natural distribution of one, two, three, four, and five-star ratings.

If anything appears questionable, do not install. Wait until you can contact the official project to confirm the listing. The delay is inconvenient but far less costly than installing malware.

Step three: Perform domain authentication before recovery phrase entry

After installation, the extension will prompt you to create or import a wallet. This is the moment when anti-phishing protection becomes irreversible. Before entering a recovery phrase or allowing the extension access to sensitive operations, verify that the extension’s interface is communicating with the correct domain. Open your browser’s developer tools (usually F12 or right-click > Inspect) and navigate to the Network tab. Perform an action in the wallet extension that makes a network request, such as fetching the current exchange rate or loading your account balance.

In the Network tab, examine the requests to see which domains are being contacted. A legitimate wallet extension communicates with specific API endpoints that belong to the official project or trusted third-party services. Alby contacts alby.com and related domains. Coinbase Wallet communicates with coinbase.com and approved infrastructure. If the extension is attempting to contact unknown domains, unusual IP addresses, or URLs that do not match the official project, stop using the extension immediately and uninstall it.

This step requires some technical comfort, but it is not optional for high-value wallets. If you are uncomfortable using developer tools, an alternative is to search the official project documentation or GitHub for the list of approved API domains, then manually verify that the extension’s requests match that list. This is genuine wallet authentication because it verifies behavior rather than relying on visual inspection.

Another safeguard is to create a new Ethereum address or test account in the wallet before importing significant funds or entering a recovery phrase. Send a small test transaction, verify that it appears on the blockchain using a public explorer, and confirm that the address shown in the wallet matches the address on the blockchain. This procedural check catches fake wallets that display addresses correctly but never actually transmit transactions or that alter the address at signing time.

Step four: Cross-reference extension ID and verify signatures where available

Browser extensions are identified by a unique ID within each store. For Chrome, this ID appears in the store URL and also in your browser’s extension management page (chrome://extensions). If you have previously installed the wallet, you can verify that the ID remains the same. A different ID means it is either a different extension or a phishing copy, and you should uninstall it immediately.

Some wallet projects, particularly those managed by security-focused teams, publish the cryptographic signatures of their extensions. These signatures prove that the published code has not been tampered with and originates from the official project’s build process. Check the official GitHub repository or documentation for a published signature file. If available, you can verify the signature using command-line tools (shasum, GPG), but this requires technical knowledge. The key point is that genuine projects with high security standards make this verification possible.

For wallets without published signatures, the extension ID verification and domain authentication become more important. Cross-reference the ID with any previous installation, check the project’s official channels to confirm the ID, and look for mentions of the correct ID in their security documentation or support pages. This multi-source verification is anti-phishing protection through redundancy: if one source is compromised, others should catch the discrepancy.

Step five: Enable security features and set recovery boundaries

After the extension is installed and authenticated, configure its security settings immediately. Most wallet extensions offer options for confirmation timeouts, session locks, and approval permissions. Enable the strictest settings compatible with your intended use. If you plan to connect the wallet to a decentralized application (dApp) such as a trading platform or NFT marketplace, restrict permissions to specific sites rather than allowing blanket approval for all websites.

Before signing any transaction, understand the recovery boundary. Cryptocurrency transactions are irreversible once confirmed on the blockchain. The wallet cannot undo a transfer or restore funds sent to the wrong address. This is not a wallet limitation; it is a property of blockchain technology. Set a personal rule: never approve a transaction without a five-second pause to verify the recipient address, the amount, and the gas fee. Do not trust the wallet interface to show the correct information; open a separate tab and verify the destination address independently if the amount is significant.

Phishing prevention also includes vigilance after installation. Some malicious extensions may not steal the recovery phrase immediately. Instead, they wait until the wallet holds significant funds, then request an “update” or “security verification” that attempts to extract the recovery phrase or private key. Never share a recovery phrase with anyone, including extension developers. No legitimate wallet support team will ask for it. If an extension requests the recovery phrase under any circumstance, uninstall immediately and consider the wallet compromised.

Step six: Bookmark the official site and avoid re-searching

One of the strongest anti-phishing protection measures is to reduce the number of times you search for the wallet. Create a browser bookmark folder labeled “Crypto—Official Only” and save the official websites for each wallet you use. Reference this bookmark folder whenever you need to verify information or access installation guidance. This simple habit eliminates the attack surface created by search results, misleading ads, and phishing sites designed to intercept searches.

Apply the same discipline to your browser wallet guides. A comprehensive resource such as a browser wallet guides app can serve as a reference point for installation procedures across multiple wallet types, but you should still verify that the resource itself is genuine before relying on its links. Check whether the site is listed in the official documentation of the wallets it covers. Look for security indicators such as HTTPS, absence of pop-up ads, and consistency in design and tone.

Before each use, verify that your bookmarked site has not been spoofed. Phishing campaigns sometimes redirect users to fake versions of previously legitimate sites. If anything appears unusual—different layout, unexpected login requirement, requests for seed phrases—leave immediately and contact the official project through a verified channel to report the issue.

Step seven: Stay informed about phishing campaigns targeting your wallets

Wallet projects regularly update their communities about phishing campaigns and new scam techniques. Subscribe to official project announcements through verified channels: GitHub releases, official Twitter accounts, and Discord security channels. This is not about entertainment or general news; it is operational security. When a new phishing campaign emerges, knowing the specific tactics used helps you recognize and avoid similar attacks.

Phishing prevention is not static. Scammers adapt to new protections, and wallet projects continuously update their guidance. A technique that was common two years ago may have been superseded by a more sophisticated approach. Staying informed means you are always working with current threat models rather than assuming that one-time verification is sufficient forever.

If you encounter what you believe is a phishing extension or website, report it to the official wallet project, the browser extension store, and the browser manufacturer’s security team. Detailed reports—including the fake URL, extension ID, and specific details of the scam—help authorities remove malicious content faster. You may also post a warning in community forums, but do so without linking to the phishing site, as this could increase its exposure.