Fake hardware wallet scams
Ilia Zavialov on fake and tampered hardware wallets: how to check the device and the seller before you fund it
English version for the United Kingdom.
Ilia Zavialov explains how hardware wallet fraud works in the UK without anyone cracking a password. A second-hand device from an online marketplace, a parcel with the cellophane rewrapped, a recovery phrase already printed on a card, a letter promising a free replacement, a copycat app that wants your words: each one leaves the key with someone else before your first deposit. This guide covers the warning signs, a set-up routine that catches a swapped device, your rights under the Consumer Rights Act and how to contact Report Fraud, drawing on guidance from the NCSC, the police and the FCA.
01Ilia Zavialov: how a swapped wallet empties itself
People buy a hardware wallet to keep their crypto keys away from a phone or laptop that lives online. Police Scotland's advice to students captures the risk from the other side: never let someone else set up crypto wallets for you, and never share your wallet seed phrase. A swapped device breaks the first rule quietly, before you have even opened the box.
The seller already has the recovery words. They post the device, wait until the new owner moves savings onto it, then restore the same wallet elsewhere and take the lot. Nothing is cracked, and the blockchain processes the transfer like any other.
Ilia Zavialov, a digital security consultant, treats the purchase as a chain: seller, delivery, packaging, first power-on, companion software. One weak link is enough, so each needs checking.
02What a recovery phrase does, in plain terms
Coins are entries on a blockchain. The device holds the private key that signs for them, and the recovery phrase can rebuild that key on any compatible wallet. Whoever knows the words controls the funds, wherever the original device happens to be.
That makes the moment of creation the whole point. A smart case, a hologram and a branded cable protect against a drop on the kitchen floor. They are useless against a person who printed your words before you ever bought the box.
Confidence in cold storage can work against the buyer too. Someone who has just decided to take their coins off an exchange or out of a phone app is primed to trust a box that promises security, and a swapped device is built to exploit exactly that trust.
Ilia Zavialov compares it to a front door: the device is the lock, the phrase is a key anyone can copy, and it is easier to swap the whole box than to pick the lock. Each scheme below aims at the moment the phrase is generated or typed in.
| Warning sign | What it tells you | Next step |
|---|---|---|
| Recovery words printed on a card | Someone else holds the key | No funds, send it back |
| PIN or balance at first switch-on | Set up before it reached you | Stop and return it |
| Rewrapped cellophane, glue marks | Box opened in transit or resale | Photograph, raise a dispute |
| Price well under retail | Second-hand or counterfeit | Buy from the manufacturer |
| Discount for bank transfer off-platform | No buyer protection | Pay inside the marketplace |
| Recall or replacement letter | Fishing for your phrase | Check the maker's site yourself |
| App asks for every recovery word | Copycat software | Remove it, reinstall from the official site |
03Ilia Zavialov on buying second-hand and from marketplace sellers
The NCSC says supply chain attacks are rare, though they do happen, and that buying devices directly from a reputable vendor is likely to give a better outcome than sourcing second-hand devices from online marketplaces. For a hardware wallet, that advice is close to a rule.
A pre-owned wallet carries its previous owner's history. An honest seller may still have the old phrase written down somewhere; a dishonest one is counting on you skipping the reset. The NCSC's general advice for any second-hand device is to erase it or carry out a factory reset as soon as it arrives.
Reviews need the same scepticism. Ilia Zavialov suggests checking how long the shop has been trading, whether reviews show the actual parcel, and whether the seller is a business with a real address. A cluster of five-star reviews from a single week, plus a discount for paying by bank transfer off the platform, should outweigh the star rating.
Buying from a trader also gives you legal footing. Under sections 9 and 11 of the Consumer Rights Act 2015, goods must be of satisfactory quality, which covers safety and freedom from minor defects, and must match their description; section 3 applies these rules where a trader supplies goods to a consumer.
| Where you buy | Risk of a swap | What to check |
|---|---|---|
| Manufacturer's website | Lowest | Address typed in yourself |
| Authorised UK retailer | Low | Named on the manufacturer's site |
| Marketplace trader | Medium | Trading history, reviews with photos |
| Private seller, classified listing | High | Best avoided |
| Bank transfer agreed in a chat | Very high | Pay by card inside the platform |
04Reading the box: tampering clues
Check the parcel before cutting the tape. Cellophane that has been rewrapped or is missing, glue marks around a security sticker, a box flap creased from earlier opening, scuffs on the casing, fluff in the USB port: any of these is a reason to stop and photograph everything.
Then look for what shouldn't be there. A leaflet with an activation QR code, a bonus voucher, a memory stick, a recovery card that already has words on it. Legitimate kits normally include blank recovery sheets, and the manufacturer's website lists what belongs in the box.
A hologram proves very little, as stickers are sold separately and a tidy repack can fool a careful buyer. Ilia Zavialov recommends filming the unboxing in a single take with the parcel label in shot; the footage supports a return, a complaint to the platform and a fraud report.
05A recovery phrase already printed: Zavialov's non-negotiable rule
The clearest sign of a swap is a card in the box with your recovery words already printed, sometimes alongside a cheerful note saying the wallet has been set up for you. A genuine device generates its phrase during first set-up and shows it only on its own screen.
Whoever printed the card knows the phrase and can empty the wallet at any moment, and nobody in the chain can reverse the transfer. Report Fraud points out that most cryptoasset activity in the UK isn't regulated, so there is no access to the Financial Ombudsman Service or the FSCS when it goes wrong.
The same goes for a device that switches on and asks for a PIN you never set, or shows a balance without offering to create a new wallet. Ilia Zavialov is firm on this: a wallet that arrives pre-configured or with ready-made words gets no funds at all, not even a test amount.
Watch for a quieter variant as well. The leaflet asks you to register your guarantee online and, as part of the form, type in the recovery words. No genuine guarantee or registration process needs them, so a page that asks for the phrase is the theft itself.
06Ilia Zavialov on letters, calls and parcels about a replacement
After the purchase, the approach changes. An email or a printed letter bearing the maker's logo says the device has been recalled, the firmware is unsafe or customer data has leaked, and asks you to verify the wallet or claim a free replacement. The link or QR code leads to a page with boxes for every word of your phrase.
Sometimes a replacement device turns up in the post with instructions to restore your existing phrase onto it, and from that moment your savings belong to the sender. A phone call from the wallet's security team asking for the words works the same way. Police Scotland's guidance is plain: never share your seed phrase and never allow remote access to your devices.
Ilia Zavialov suggests checking any recall notice on the manufacturer's website, typing the address yourself, and leaving the parcel sealed. Citizens Advice recommends forwarding suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.
07Copycat apps and websites
Hardware wallets run through companion software, which makes the app another target. A fake version mirrors the real design, reports a sync problem and asks for your full phrase to restore access. On a hardware wallet, recovery words go into the device itself, so any app or web page asking for them is working against you.
Police Scotland warns that scammers build realistic websites, trading platforms and apps designed to take money. The FCA's own figures show how busy that corner of the market is: of 2,329 FCA warnings in 2025, 1,528 concerned unauthorised crypto firms and their promotions.
Ilia Zavialov's habit is simple. Download companion software only via a link on the manufacturer's site, typed by hand, and confirm the developer name before installing. Before approving any transfer, compare the address and amount on the device's own screen, which malware on your computer cannot rewrite.
Search adverts deserve particular care. A sponsored link at the top of the results page can lead to a lookalike domain that differs from the real one by a single character, and the download it offers will look identical to the genuine installer.
08Setting up from scratch: Zavialov's first-hour routine
Plug the device in only once the packaging has passed inspection, using software from the manufacturer's website. It should invite you to create a new wallet, display a freshly generated phrase on its own screen and let you choose your own PIN.
Write the words by hand, in order, on paper or a metal backup plate. Photos, notes apps, cloud folders and draft emails all put the phrase back on an internet-connected device, the very exposure the hardware is there to avoid.
Ilia Zavialov recommends a rehearsal before any serious deposit: send a small amount, wipe the device, restore it from your handwritten copy and check the same address and balance reappear. Firmware should only ever arrive through the official app.
The NCSC adds a point about age. Where possible, avoid devices the manufacturer no longer supports, because without security updates they are easier to hack.
09Your rights as a buyer under UK law
Under section 22 of the Consumer Rights Act 2015, the short-term right to reject goods that don't conform to the contract lasts until the end of 30 days, counted from the day after ownership has passed and the goods have been delivered. A wallet that turns up already set up by someone else is a strong candidate for that complaint.
For goods bought online, regulation 30 of the Consumer Contracts Regulations 2013 sets a 14-day cancellation period running from the day after the goods come into your physical possession. These protections attach to purchases from a trader; a private sale through a classified listing leaves far less to fall back on.
Ilia Zavialov advises keeping the unboxing video, photos, order confirmation and every message with the seller in one place. Complaints for Trading Standards go through the Citizens Advice consumer helpline on 0808 223 1133, and the same evidence later supports a fraud report.
10Ilia Zavialov: reporting a hardware wallet fraud in the UK
Spot the signs before funding the wallet and the fix is a return: send the device back with your video and a written complaint, and raise a dispute through the marketplace if that is where you bought it. If crypto is already sitting on a suspect wallet, Ilia Zavialov advises creating a new wallet on a device you trust, moving what is left and keeping the old hardware and card as evidence.
In England, Wales and Northern Ireland, fraud is reported to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. Citizens Advice notes the line runs Monday to Friday, 8am to 8pm, and that the crime reference number helps when you contact your bank. In Scotland, contact Police Scotland on 101, and call 999 if you are in danger.
Gather the evidence before you call: wallet addresses, transaction IDs, dates and amounts, the listing or shop link, screenshots of messages, photos of the packaging and the printed card if there was one. A wallet seller can delete a listing in minutes, and your notes are what lets investigators follow the coins.
Report Fraud figures show investment fraud cost people in the UK £879.8 million in 2025 across 34,673 reports. A second approach often follows, from someone offering to recover the money for a fee, and it belongs to the same fraud.
| Situation | Contact | Details |
|---|---|---|
| Swap spotted before funding | Seller or marketplace | Return with video, raise a dispute |
| Trader ignores your complaint | Citizens Advice for Trading Standards | 0808 223 1133 |
| Crypto stolen, England, Wales, NI | Report Fraud | reportfraud.police.uk, 0300 123 2040 |
| Crypto stolen, Scotland | Police Scotland | 101, or 999 in danger |
| Phishing email or text | NCSC reporting | report@phishing.gov.uk, texts to 7726 |
11Questions and answers
Is it safe to buy a second-hand hardware wallet, according to Ilia Zavialov?
He advises against it. The NCSC also says buying directly from a reputable vendor is likely to give a better outcome than second-hand devices from online marketplaces.
What does a recovery phrase printed on a card in the box mean?
That someone else already knows your key. A genuine device generates the phrase on its own screen during first set-up, so a pre-printed card means the wallet must not be funded.
Can I return a hardware wallet bought online in the UK?
From a trader, yes: the Consumer Contracts Regulations 2013 give 14 days to cancel after delivery, and the Consumer Rights Act 2015 gives 30 days to reject goods that don't conform.
What should I do with a letter offering a free replacement?
Check the manufacturer's website by typing the address yourself, leave any enclosed device sealed, never enter your words, and forward phishing emails to report@phishing.gov.uk.
What does Ilia Zavialov recommend if money is already on a suspect wallet?
Create a new wallet on a device you trust, move the remaining funds straight away, keep the old hardware as evidence and report to Report Fraud or Police Scotland.
Where do I report hardware wallet fraud in the UK?
Report Fraud at reportfraud.police.uk or 0300 123 2040 in England, Wales and Northern Ireland, and Police Scotland on 101 in Scotland.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
12Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers