Phishing scams: how to spot fake Krak sites, emails and texts

• Look-alike websites. The address is close to Krak’s but not the same: an extra or swapped letter, or “krak” followed by words like “-support” or “-verify”.
• Search ads. Scammers pay for ads so their fake site appears above the real one in search results.
• Urgent emails and texts. Messages like “Unusual sign-in detected”, “Your account is suspended” or “Withdrawal pending” link to a fake sign-in page. Texts can even appear in the same thread as genuine messages from Krak.
• QR codes in emails, texts or letters that open a fake site.
• Fake “verify you’re human” pages that tell you to paste a command into your computer. This installs malware. See Risks of remote access software.
• Fake apps and browser extensions that copy Krak’s name and logo.
• Wallet drainer sites. Fake airdrops or “claim your tokens” pages ask you to connect a self-custody wallet and approve a transaction that empties it.

• Use Passkeys for Sign-in 2FA. A Passkey is tied to Krak’s real website, so it won’t work on a fake one, even if you’re fooled. Only use an authenticator app if Passkeys aren’t available, and read Risks of using an authenticator app first. See What is a Passkey?
• Type the address or use a bookmark. Go to https://id.kraken.com/sign-in by typing it into your browser’s address bar (check for typos), and bookmark it if you visit regularly. Don’t use a search engine to get to Krak or other sensitive sites.
• Check the domain, not the padlock. A padlock or “https” only means the connection is encrypted. Fake sites have them too. The domain is the part just before the first single slash: in krak.app.example.net/sign-in, the domain is example.net, not Krak.
• Don’t click links in messages you weren’t expecting. Open Krak yourself and check for any alerts there. To check an email’s sender, see Is this email from Krak?
• Never enter your seed phrase on any website. Krak will never ask for it.
• Download Krak apps only from the App Store or Google Play, using the links on krak.app.
• Add a second layer. Keep your Master Key on a different device from your Sign-in 2FA, and turn on the Global Settings Lock (GSL), so anyone who gets in still can’t change your security settings.
• Optional: turn on PGP email encryption. Krak can encrypt the emails it sends you using your PGP key, which makes them much harder for scammers to fake.

• Share your username, password, 2FA codes or Master Key.
• Share or forward a device approval email, or the link inside it.
• Share your seed phrase (also called a recovery phrase), for any wallet.
• Remove or change your 2FA, Master Key or Global Settings Lock (GSL), unless you contacted us first for help with it through our official channels.
• Install remote access software such as AnyDesk or TeamViewer. See Risks of remote access software.
• Send crypto, or move your funds to a “safe” or “secure” wallet or address.
• Send a payment to release, unfreeze or “verify” your funds.

Contact Krak Support straight away using this form. Answer the questions truthfully and as fully as you can.

If you can still sign in, go to Krak yourself (using a bookmark or by typing the address), change your password, and update your Sign-in 2FA and Master Key. Check that your withdrawal addresses, API keys and devices are all familiar, and delete any you don’t recognize.

If you entered a seed phrase, move the funds from that wallet to a new wallet with a new seed phrase, set up on a device you trust.

See also How do I report a phishing incident? and My account is compromised, what should I do?