Phishing targets people, not encryption
Phishing is an attempt to trick you into revealing credentials, approving a login, installing software, or sending money. A strong password cannot help when it is entered into a convincing fake page. Attackers often create urgency by claiming that an account will close, a payment failed, or suspicious activity requires immediate action.
Check the destination before entering secrets
Open important services from a saved bookmark or by typing the known address yourself. Do not trust the visible text of a link because it can differ from the real destination. Check the full domain carefully, including spelling and the final registered domain, not only familiar words placed earlier in the address.
Common warning signs
- Unexpected requests to confirm a password or recovery code.
- Pressure to act immediately or keep the request secret.
- Attachments or downloads you did not expect.
- Messages claiming that support needs your passphrase.
- Login pages opened from advertising, chat, or shortened links.
- Requests to scan a QR code to “restore” access.
Protect Kardix inputs
Enter your Kardix passphrase only on the authentic Kardix site and on a device you trust. Kardix support should never need the phrase, optional password, generated credential, or QR code. Treat any request for those values as suspicious.
Browser password prompts and familiar design are not proof of authenticity. A fake page can copy logos, colors, and wording. Verify the address independently.
Multi-factor authentication helps, but can also be phished
One-time codes can be captured by real-time phishing proxies. Hardware security keys and passkeys tied to the correct website provide stronger resistance because they verify the domain. Never approve an unexpected login notification.
What to do after entering information on a fake page
- Use a clean device to change the affected password.
- Revoke active sessions and connected applications.
- Replace recovery codes and review recovery addresses.
- Contact the service through its official support channel.
- Scan the device if you downloaded or ran anything.
- Monitor related accounts for unusual activity.
Related guidance
Review QR and clipboard risks and why unique credentials limit damage.