Phishing scams: how to spot fake Kraken sites, emails and texts

• Look-alike websites. The address is close to Kraken’s but not the same: an extra or swapped letter, or “kraken” followed by words like “-support” or “-verify”.
• Search ads. Scammers pay for ads so their fake site appears above the real one in search results.
• Urgent emails and texts. Messages like “Unusual sign-in detected”, “Your account is suspended” or “Withdrawal pending” link to a fake sign-in page. Texts can even appear in the same thread as genuine messages from Kraken.
• QR codes in emails, texts or letters that open a fake site.
• Fake “verify you’re human” pages that tell you to paste a command into your computer. This installs malware. See Risks of remote access software.
• Fake apps and browser extensions that copy Kraken’s name and logo.
• Wallet drainer sites. Fake airdrops or “claim your tokens” pages ask you to connect a self-custody wallet and approve a transaction that empties it.

• Use Passkeys for Sign-in 2FA. A Passkey is tied to Kraken’s real website, so it won’t work on a fake one, even if you’re fooled. Only use an authenticator app if Passkeys aren’t available, and read Risks of using an authenticator app first. See What is a Passkey?
• Type the address or use a bookmark. Go to https://id.kraken.com/sign-in by typing it into your browser’s address bar (check for typos), and bookmark it if you visit regularly. Don’t use a search engine to get to Kraken or other sensitive sites.
• Check the domain, not the padlock. A padlock or “https” only means the connection is encrypted. Fake sites have them too. The domain is the part just before the first single slash: in kraken.com.example.net/sign-in, the domain is example.net, not Kraken.
• Don’t click links in messages you weren’t expecting. Open Kraken yourself and check for any alerts there. To check an email’s sender, see Is this email from Kraken?
• Never enter your seed phrase on any website. Kraken will never ask for it.
• Download Kraken apps only from the App Store or Google Play, using the links on kraken.com.
• Add a second layer. Keep your Master Key on a different device from your Sign-in 2FA, and turn on the Global Settings Lock (GSL), so anyone who gets in still can’t change your security settings.
• Optional: turn on PGP email encryption. Kraken can encrypt the emails it sends you using your PGP key, which makes them much harder for scammers to fake. See What is PGP/GPG encryption?

• Share your username, password, 2FA codes or Master Key.
• Share or forward a device approval email, or the link inside it.
• Share your seed phrase (also called a recovery phrase), for any wallet.
• Remove or change your 2FA, Master Key or Global Settings Lock (GSL), unless you contacted us first for help with it through our official channels.
• Install remote access software such as AnyDesk or TeamViewer. See Risks of remote access software.
• Send crypto, or move your funds to a “safe” or “secure” wallet or address.
• Send a payment to release, unfreeze or “verify” your funds.

Contact Kraken Support straight away using this form. Answer the questions truthfully and as fully as you can.

If you can still sign in, go to Kraken yourself (using a bookmark or by typing the address), change your password, and update your Sign-in 2FA and Master Key. Check that your withdrawal addresses, API keys and devices are all familiar, and delete any you don’t recognize.

If you entered a seed phrase, move the funds from that wallet to a new wallet with a new seed phrase, set up on a device you trust.

See also How do I report a phishing incident? and My account is compromised, what should I do?