Start with the source
Before installing an app or opening a download page, check the publisher, the exact domain and the origin of the file. A familiar logo, a prominent search result or an unsolicited message does not establish an official identity.
Recovery credentials and token approvals are different
Recovery credentials control access to a wallet. A token approval gives a particular contract spending access. Checking an allowance cannot prove that a recovery phrase was never exposed; checking a balance cannot explain account control. Keep these facts separate.
Build a timeline you can verify
Record downloads, imports, connections, signatures, permission changes and transactions in order. Separate public transaction IDs from personal recollection. Mark uncertain times as estimates, and do not present unverified losses as settled figures.
Sources and reading notes
This article is an editorial explanation of risks and ways to verify information. It does not make a factual finding about a particular wallet or person. Product behavior and rules may change; check the original documentation.