Scams and signing

To move funds out of your account, someone needs your secret or your signature. Each scam below is a way to get one of them.

Secret grabs. A message says your wallet needs "validating," an airdrop needs "claiming," or support needs to "fix" something. Each ends with a request for your secret. Real airdrops never ask for it. Xaman and Joey never ask for it.

Spam and fake airdrops. You may receive 1 drop of XRP from a stranger, a memo with a link, or an NFT offer you never asked for. The tiny amount is not the point. The memo or link is. Ignore it. Do not click the link, reply, or send anything back.

Anyone can issue a token with any name. A token called "USD" or a famous project's name proves nothing. Only the issuer address tells you who stands behind it. Adding a trust line to a token you do not know usually locks 0.2 XRP of reserve as well.

Phishing sign requests. A fake site, sometimes one letter off from a real one, sends a sign request to your wallet. The page may say "claim" or "verify," while the transaction does something else. If you did not start it, do not engage.

Key-change hijacks. Some transactions do not move funds at once. They hand over control:

• SetRegularKey names another key that can sign for you.
• SignerListSet names other accounts that can sign together for you.
• AccountDelete sends your remaining XRP to a destination and removes the account.

Sign one of these for a stranger, and they can drain the account. Transactions cannot be reversed.

Verify before you sign. Read these fields in every request:

Account-control transactions deserve the most care: SetRegularKey, SignerListSet, AccountDelete, and AccountSet with asfDisableMaster. A regular key can sign most transactions for the account. Signers whose weights reach the quorum can authorize transactions for the account, including payments. If you sign a SetRegularKey to an attacker's key and then disable your master key, you are locked out.

If something went wrong.

1. Check your account with account_info: look for an unknown RegularKey, a signer list ("signer_lists": true) or disableMasterKey.
2. If your master key still works, it can replace or remove a regular key with SetRegularKey.
3. If your secret leaked, assume the account is compromised. Xaman's guidance: re-key and disable the master key, or move funds to a new account and delete the old one.
4. Report theft to local police and keep the chat history.

Official support for Xaman is the Support xApp inside the app. Joey does not message you first. A stranger offering "recovery" for a fee is another scam.