Scammers are sending scam messages to Trezor users

[_act_]

I reported this some hours ago
https://bitcointalk.org/index.php?topic=5564862.msg66022430#msg66022430

This is another one that I saw just now:l which is about quantum threat notice. Just know that it is a lie, you can easily know from the link in the email that is not Trezor official site.

This is the fake link

Code:

https://find-trezor.com/?input_24=WsvjXUScmyWE6BNGsdThoJ+AWsRlbJTP+ryQyq62u9txUXUxvkXBXb93iKSna0/aKlQUcHGsP4JHknPKPpkJrHQjvP6E8788qQ1uRrtvFScbm/qnIAXDdh9SIVjydUZvkrYswTQsnkIWcnkRnrK/YpiAeKr/FhMLeOrHUfukhljAlrHcO6na9FEriPqEtLbQEvqSSsCR2Qyd5EvjSAFLotETatMukXVnkudx23EGdG7h8vJVpoqFJoczjBRJkb2MpnYlxaU/bM+Vu0lOy7nVteqkk76LkGxhmV7b4OrdfbCLLWRtZTiTmLD04J8svfrXHYNeLq34uoyPKV2px4yg4A==

This is the Trezor official website: https://trezor.io/

But this is fake:

Code:

https://find-trezor.com

It will be better for Trezor to address this issue.

This is one of the down sides of a hardware wallet as Trezor is not able to protect their users from receiving email like this.


This is the fake email


Another phishing email in less than one day

This makes it the third scam email I am receiving today which scammers want to use to deceive you to connect to your Trezor wallet.

This is the scam email


This is the scam site:

Code:

https://firm-trezor.com/?input_24=WsvjXUScmyWE6BNGsdThoJ+AWsRlbJTP+ryQyq62u9txUXUxvkXBXb93iKSna0/aKlQUcHGsP4JHknPKPpkJrHQjvP6E8788qQ1uRrtvFScbm/qnIAXDdh9SIVjydUZvkrYswTQsnkIWcnkRnrK/YpiAeKr/FhMLeOrHUfukhljAlrHcO6na9FEriPqEtLbQEvqSSsCR2Qyd5EvjSAFLotETatMukXVnkudx23EGdG7h8vJVpoqFJoczjBRJkb2MpnYlxaU/bM+Vu0lOy7nVteqkk76LkGxhmV7b4OrdfbCLLWRtZTiTmLD04J8svfrXHYNeLq34uoyPKV2px4yg4A==

Avoid this scam.

[tech30338]

This is why its very important to know the official websites, and also check the header of the email if its from the official website, check announcement and newsletters, never click links, from unknown source so that we can avoid being hack by the actors pretending or impersonations, if the message is just new and comes from out of nowhere block them or delete the message without click any links on that message.

[Perfectbaby]

That is how scammers function they try everything clone the original site just to deceive people to fall prey for them, maybe if they don't know well about the site you will see them following their instruction and got hacked as due to either fear of losing their funds. Of course you are right, they should be able to write and published addressing this issues before more users will fall victim of those messages, even if they update it on social handle it would go along way so that their users won't become victim of fake mails they sends to people.

[Cryptohygenic]

It will be better for Trezor to address this issue.

This is one of the down sides of a hardware wallet as Trezor is not able to protect their users from receiving email like this.

Unfortunately hardware wallets are offline storage system which is not connected online. So it is no way that it users could get the scamming alert or notifications unless they are connected to the online Trezor suit where the brand notifications and official updates are notifies users. It is also recommended to sign in emails and keep tracks on the wallets news even while your Wallet storage is offline.
And on the safer side, it is very advisable to be skeptic about any online link and verify before clicking on it.

[adaseb]

So where did this leak come from? Was it from Trezor? Or is it just that Ledger leak from a few years back?I dont see the point in targeting Trezor users using a Ledger leak because most have received so many phishing email scams by now that they don't fall for it anymore.

I wonder how far this scam will go. Many Ledger users actually receive fake snail mail with a Ledger letter head claiming something similar as this email. The amount of work that these scammer put into is crazy. I wondering if they will send fake Trezor, fake Coinbase, fake Gemini, fake Robinhood mail in the future to trick people.

This is getting as bad as going to any crypto Discord and instantly getting bombarded by bots which are all after your private keys.

[TravelMug]

So where did this leak come from? Was it from Trezor? Or is it just that Ledger leak from a few years back?I dont see the point in targeting Trezor users using a Ledger leak because most have received so many phishing email scams by now that they don't fall for it anymore.

I wonder how far this scam will go. Many Ledger users actually receive fake snail mail with a Ledger letter head claiming something similar as this email. The amount of work that these scammer put into is crazy. I wondering if they will send fake Trezor, fake Coinbase, fake Gemini, fake Robinhood mail in the future to trick people.

This is getting as bad as going to any crypto Discord and instantly getting bombarded by bots which are all after your private keys.

Most likely that was the case, leaks from other crypto services that this scammers was able to get hold of that data in the dark market. And taking advantage of spreading it and then hoping that someone will fall for that trick.

Hard to say how far this scam will go. If there is a Bitcoin addresses associated with this scam then we might able to found out how big or small they have made. But if there's not then sorry for those who blatantly believing in this scams.

[KiaKia]

This is nothing new, they have been doing this for months and it doesn't even bother me anymore, how they get hold of my email address doesn't even bother me either.

There are faster ways to get people's email address this day, unless you have never use your email address online before, they have ways of scanning for active email addresses online.

Trezor, Ledger, Coinbase, Binance, I have always received fake emails for these platforms and hardware companies, I would say let's ignore them, and hopeful newbies won't believe them.

There is no leak anywhere, because even people who don't own coinbase account and Trezor received the email, so this attackers are targeting any email address that they can find.

[Eternad]

Got this email today. I feel anxious when this email pop-up because I have my trezor that is not checked for a long time until I realized that I don’t remember connecting my email to a trezor.

What I’m surprised is how this scammer get my email and know that I have a trezor account. I purchased my trezor wallet on an official reseller on my country.

[Porfirii]

So where did this leak come from? Was it from Trezor? Or is it just that Ledger leak from a few years back?I dont see the point in targeting Trezor users using a Ledger leak because most have received so many phishing email scams by now that they don't fall for it anymore.

I wonder how far this scam will go. Many Ledger users actually receive fake snail mail with a Ledger letter head claiming something similar as this email. The amount of work that these scammer put into is crazy. I wondering if they will send fake Trezor, fake Coinbase, fake Gemini, fake Robinhood mail in the future to trick people.

This is getting as bad as going to any crypto Discord and instantly getting bombarded by bots which are all after your private keys.

That's what I've thought just after reading the OP: where these data about their users leaked by Trezor, or are the hackers using the data from other services (like Ledger's leak) like a machine gun, trying to get a bullet to hit the Trezor user?

I've also noticed that, although there is still room for improvement, the texts are much more elaborated lately (few spelling errors, elaborate design and layout,...) and, therefore, harder to notice the deception. Like said above, always check the header of the emails and be skeptic about any online links and verify before clicking.

[knowngunman]

This is one of the down sides of a hardware wallet as Trezor is not able to protect their users from receiving email like this.

Trezor is not to be blamed for this because the literally has no power to regulate the kinds of emails their users receive or not. From time immemorial, scammers have been impersonating genuine platforms to send a mischievous email and malicious link to random email addresses. It's hard to explain how they get these email addresses that usually match exact email address of people operating with the platform they impersonate. In some cases, people receive such messages from a platform they never registered with and the mail will address them as a registered customer. This prove that this messages are sent to random addresses and you have nothing to fear especially if you have no active account with the platform they claimed to be. Of course, one can be panic if they are active user of that platform but it is always advisable to verify before taking any further action that may be instructed.

[Peanutswar]

It seems hackers now are continuously trying to attack with the use of the Fake trezor emails. Ive seen this before posted here in the community,  reason why you must need to have a keen eye because one overlooked and a mistake to connect your wallet possible it will drain most of your hard earned assets. Another thing is if you didnt bind your email too with the trezor why would like get caught with this its just automatically a phish and needed to be reported so they cant victim other people.

[armanda90]

Nice catch OP you know about official and scam Trezor website, I think the scammer know well which the user holding their bitcoin assets at Trazer wallet and target most of them are using trazer wallet. Its important to us for saving website official link such Trezor website to avoid from scam website and if any scammer sent to us fake link we can detected which trust or fake website.
I think you need to show us the scammer email to avoid for all user if get the email from that scammer will deny and rejected it, right now the scammer have been smart sending us the email link similar with the official website. If not be careful I believe we can't differentiate between official websites and scam websites and usually the official website never sending us email firstly such as how did by scammer.
Always update the official telegram, social media account about Trezor to know any new update about their website, have change the website domain if won't avoid from scam website link, if some one sent us scam or similar website link better rechecking at official website to know any update domain or not?

[arwin100]

Got this email today. I feel anxious when this email pop-up because I have my trezor that is not checked for a long time until I realized that I don’t remember connecting my email to a trezor.

What I’m surprised is how this scammer get my email and know that I have a trezor account. I purchased my trezor wallet on an official reseller on my country.

You will really get anxious on why you receive such mail while the real fact is you don't need to provide or submit your email to set up your trezor wallet.

So what people receive is provably a scam mail spread by those hackers trying to confuse people and try to create panic so they can penetrate then hack their wallet. Maybe you sign up your email on other platform and that platform sell your data that's why you receive those kind of emails. Its hard to believe right now that problem goes with trezor that's why there's something like that happening, but for now we must pay attention carefully on what we are receiving on our emails to avoid hacking issues.

[Sticky Bomb]

That is how scammers function they try everything clone the original site just to deceive people to fall prey for them, maybe if they don't know well about the site you will see them following their instruction and got hacked as due to either fear of losing their funds. Of course you are right, they should be able to write and published addressing this issues before more users will fall victim of those messages, even if they update it on social handle it would go along way so that their users won't become victim of fake mails they sends to people.

It would be easy for scammers to replicate all Trezor online deliverables including their suite app and website since they're Open source, so anyone can make a clone of the website and attempt their own pattern of scamming people. Somehow I feel these data leaks that exposes it's users data are internal or it's same set of people who had access to them in the past exploring other scam attempts to catch vulnerable and less informed people and steal from them..

However, open source code approach remains the best since the code gets to be reviewed by lots of experts and security vulnerabilities are better spotted and fixed since it goes through the scrutiny of many experienced devs.

[salad daging]

I received this email 20 hours ago and ignored it knowing it was phishing, it's not strange anymore.
But apparently many people received the same email about this phishing attack, how did Trezor anticipate? Some users may not know this.

Now to want to know information about this it is better to X trezor directly whether there are updates or other notifications sometimes Trezor notifications to email are mostly phishing.

[Patikno]

Scammers continue to attempt to steal valuable assets from their potential victims, and it seems they are hoping their potential victims will be careless. I suspect their phishing emails are related to the data breach which ever happened. Therefore, I think everyone should be aware of the threat of phishing attacks, especially for Trezor users. As a reminder, Trezor actually already provides tips on how to be aware of scams and phishing on their website, and they even provide further guidance on how to avoid them. BTW, correct me if there is anything wrong about.

References :  -Trezor.io - Scams and phishing
                      -Dailysecurityreview.com - Trezor Security Breach Affects 66k Users in a Phishing Scam
                      -Forklog.com - Scams and phishing

[BlackBoss_]

This is another one that I saw just now:l which is about quantum threat notice. Just know that it is a lie, you can easily know from the link in the email that is not Trezor official site.

This is the Trezor official website: https://trezor.io/

But this is fake:

Code:

https://find-trezor.com

It is very basic scam method and people can feel something abnormal with find-trezor in the domain link.
The cryptocurrency scambook that has a first section for Phishing scams is very helpful for people in learning and having proper practice in order to avoid scams, and phishing scam in particular.

I believe that only newbies and very careless people can fall to phishing scams.

[Aanuoluwatofunmi]

By now I hope the Trezor developers team would have been aware of this going on too, which I also op they address on theat, we can't continue to watch other people get scammed and do nothing about it, all they do is to keep on investigating their next route of target, while we can't allow for what seeing other scammed and nothing is being done to create the awareness of what needs to be done, just as this thread addresses on such.

[Versatile_choice]

That is how scammers function they try everything clone the original site just to deceive people to fall prey for them, maybe if they don't know well about the site you will see them following their instruction and got hacked as due to either fear of losing their funds. Of course you are right, they should be able to write and published addressing this issues before more users will fall victim of those messages, even if they update it on social handle it would go along way so that their users won't become victim of fake mails they sends to people.

Sometimes I keep wondering why this scammers are building this knowledge from because they have about thousands of scamming strategies in thier memory which is why whenever they try using the first one to get something maybe if the thing persist then they will quickly come up with a different plan just to get what they want, it is only those who are clever enough that can easily follow them serially why newbies or even most of the old Investors may not likely have all it takes to overcome it. Thank goodness this information is coming from a high rank member who have been in this system for long probably decade. Because if it was a newbie I don't know what would have become of him, but know that we have received this information I believe we can be able to detect it when ever we see such.

[$crypto$]

By now I hope the Trezor developers team would have been aware of this going on too, which I also op they address on theat, we can't continue to watch other people get scammed and do nothing about it, all they do is to keep on investigating their next route of target, while we can't allow for what seeing other scammed and nothing is being done to create the awareness of what needs to be done, just as this thread addresses on such.

Trezor has announced this phishing attack and they say to stay vigilant and never give seed phrases to anyone.
https://x.com/Trezor/status/1987502241079541892
So keep an eye out for updates on Trezor's Twitter to get clearer information as this phishing attack is happening simultaneously.