Phishing

In IcelandicVefveiðar

A scam where criminals pretend to be a trusted company or authority to get you to hand over passwords, card details or your seed phrase.

Phishing is a scam where criminals pretend to be a trusted company or authority. The aim is to get you to click a link and hand over a password, card details or your seed phraseSeed phraseA list of 12 or 24 words that backs up every key in your wallet, so whoever has the words can restore the wallet and take the crypto., or to approve a login with your electronic ID. Phishing is a form of social engineeringSocial engineeringWhen scammers manipulate people, rather than hacking computer systems, to get them to reveal information or send money. and arrives by email, SMS, social media and even search engine ads.

What does phishing look like?

The Icelandic police have, for example, warned about fake messages and websites in the name of Skatturinn, the tax authority. Common crypto examples include:

  • an email that seems to come from a crypto exchange, saying your account will be closed unless you confirm your details
  • a fake wallet app or website asking for your seed phrase to "sync" the wallet
  • a message about free crypto, a so-called AirdropAirdropWhen a project sends free tokens straight to people's wallets, often to promote itself, though fake airdrops are also a common scam., that you have to "claim" by connecting your wallet

How do you protect yourself?

The warning signs are often the same: time pressure, a threat to close your account, an offer that is too good, or a web address that is almost right, with one character changed.

  • Don't click links in unexpected messages. Open the app or the website you normally use instead.
  • If in doubt, call the company on its official phone number.
  • No legitimate service asks for your seed phrase or password by email.
  • Use two-factor authenticationTwo-factor authentication (2FA)A login that needs two different proofs of who you are, such as a password and a code from an app, so a stolen password isn't enough., ideally a security key or passkey, which won't work on a fake site.

Where to report it

Forward the email, or a screenshot of the message, to phishing@cert.is and send the police a tip through Ísland.is. If you have given out details or lost money, contact your bank straight away and report it to the police.

Everything in Myntkaup Learn is written and regularly reviewed by the Myntkaup editorial team. It is for education and is not investment advice. Editorial policy. Updated 18 October 2026.