Most people who lose crypto on a phone are not hacked in the way films imagine it. Nobody breaks an encryption scheme. They tap a button, usually in a hurry, on a claim page they reached from a reply under a post, and the wallet does exactly what it was told to do.
That matters because the phone is now where airdrops happen. The announcement arrives as a notification, the claim page opens inside the wallet’s own browser, and the signature is approved with a thumb while you are standing in a queue. The whole process is fast, and that speed is exactly what scammers rely on.
This guide covers the habits that make the biggest difference: how to treat airdrops, how to arrange your wallets, and how to keep the device itself in good order.
Why the phone is the soft spot
A laptop gives you room to be suspicious. You can see the full address bar, hover over a link, open a second tab and compare. A phone takes most of that away. In-app browsers shorten or hide the URL, signature prompts are squeezed into a small sheet, and long contract addresses are cut down to a few characters at each end.
There is also the problem of concentration. On a typical phone, the wallet sits beside the email account that can reset your exchange password, the authenticator app, and the SIM that receives your text codes. One compromised device can open several doors at once.
How airdrop scams work in practice
The patterns repeat, which is good news, because it means you can learn to recognise them.
- Lookalike claim pages. A copy of the real project site on a domain that is one letter off, promoted through paid ads, replies and direct messages around the time of a genuine launch.
- Signature requests dressed up as claims. The button says “Claim”, but the request asks for permission to spend your tokens or move your NFTs. Approving it hands over control without any coins leaving your wallet at that moment.
- Tokens you never asked for. A strange token appears in your wallet with a website in its name. The token is bait, and the site it points to is where the damage happens.
- Address poisoning. Someone sends a tiny transaction from an address that starts and ends like one you use. Later you copy it from your history by mistake.
- Helpful strangers. You ask a question in a community chat and “support” messages you privately within a minute.
One rule cuts through all of them: no legitimate airdrop needs your recovery phrase. Any page, form or person asking for it is trying to steal from you. No exception to that rule exists.
Give each wallet one job
The most effective change costs nothing. Stop using one wallet for everything.
Keep a vault for long-term holdings, ideally on a hardware wallet, and never connect it to an app you are trying for the first time. Keep a daily wallet with a modest balance for the services you already trust. Then keep a burner: a fresh address that holds only enough for network fees, used for new claims and experiments.
If the burner signs something malicious, the loss is limited to what was in it. When a claim does go through, move the tokens to your daily wallet or vault and carry on. It adds a minute of effort, and it turns a potential disaster into a minor annoyance.
Device hygiene: the boring part that works
None of this is exciting, and almost all of it is a one-time job.
- Install updates when they arrive. Operating system and browser patches close holes that are already being used.
- Get wallet apps from the project’s own website link. Searching the app store by name is how people end up with a convincing imitation. Avoid installing app files sent through chat groups.
- Keep the recovery phrase off the phone entirely. No screenshots, no notes app, no photo that syncs to the cloud, no email to yourself. Write it on paper or stamp it in metal and store it somewhere sensible.
- Lock the wallet separately. A screen lock protects the phone. A PIN or biometric check inside the wallet app protects you when the phone is already unlocked in someone else’s hand.
- Move away from text message codes. Use an authenticator app or a hardware key for exchanges and email, and ask your carrier to add a PIN that blocks number transfers. SIM swapping works because a phone number is easier to steal than a phone.
- Review old permissions. Tools such as Revoke.cash show which contracts can still spend from your address. Clearing them out every month or so is worth the small fee.
- Sign on a connection you control. Café and airport Wi-Fi are fine for reading the news. For anything involving a signature, switch to your own mobile data.
- Check pasted addresses properly. Compare characters in the middle as well as at both ends. Scammers generate addresses that match the parts people usually glance at.
Read the request before you approve it
The signature prompt is the last checkpoint, and it is the one most people skip. Slow down for five seconds and ask three questions. Which site is asking? What exactly is it asking for? Does that match what I am trying to do?
A claim should send tokens to you. If the prompt mentions approval, permission, “set approval for all”, or an unlimited spending amount, you are being asked to give something away. Many modern wallets now simulate the transaction and show the expected result in plain language. Use one that does. And if a prompt is a wall of unreadable data that the wallet cannot explain, reject it. The real project will still be there tomorrow.
Where mobile proxies fit, and where they do not
It is worth being straight about this, because the topic comes up in every airdrop community. A proxy does not protect a recovery phrase and it will not stop you approving a bad signature. Personal security comes from the habits above.
Where proxies earn their place is on the other side of the screen, with the people building and defending these products. Scam campaigns are often filtered by country, device type and network, so a fake claim page may appear only to phone users in certain regions while everyone else sees something harmless. A security researcher on an office connection can look straight at the link and find nothing wrong.
To see what a real user sees, wallet teams, dApp developers and brand protection analysts load pages through mobile proxies, which send requests over genuine carrier connections instead of data centre addresses. ProxyEmpire, for example, runs a rotating pool on real 3G, 4G, 5G and LTE networks in more than 170 countries, with country, region, city and carrier targeting. That makes it practical to confirm that a claim page loads correctly for a user in Germany, that a regional restriction behaves as intended in another market, or that an advert carrying your project’s name really leads where it should.
What they are not for is posing as a crowd of separate users to collect an airdrop many times over. Projects screen for exactly that behaviour, it breaks their terms, and addresses flagged for it are typically removed from the distribution. It is a poor use of money and a worse use of time.
A two-minute routine before any claim
- Find the claim link from the project’s official website or verified account. Do not use a link from a reply, an advert or a message.
- Open it with your burner wallet, not your main one.
- Read the signature prompt. If it asks for spending permission, stop.
- Claim, then move the tokens out to a wallet you trust.
- Revoke any permission the claim left behind.
The takeaway
Staying safe on mobile comes down to accepting that you will be rushed, distracted and occasionally fooled, and arranging things so that a single mistake stays small. Separate wallets, a clean device, a recovery phrase that lives on paper, and five seconds of attention before each signature will protect you from most of what is out there. The airdrop can wait while you check.
