Fake Phantom Wallet scams and how to spot them
The most common Phantom scams are fake download pages and apps, fake support numbers and DMs, drainer sites disguised as airdrops or mints, fake Phantom pop-ups and address poisoning. Almost all of them end with you typing your recovery phrase or signing a malicious transaction. Phantom never asks for your phrase, never contacts you first, has no phone support and has no token.
Phantom is one of the most popular crypto wallets, which makes its users a favourite target. Search results for "Phantom wallet download", "Phantom extension" and "Phantom support" are heavily polluted with fake pages, as we found when researching this site in October 2026. This guide explains each scam, what it looks like and how to check what is real.
Four facts that defeat most scams
- Phantom never asks for your recovery phrase. Phantom's help centre says its support will never ask for your Secret Recovery Phrase, private keys or wallet PIN, or ask you to move funds.
- Phantom never contacts you first. "Phantom Support will never contact you first," and it will never send you a direct message on social media (Phantom help centre, 2026).
- Phantom has no phone support. Phantom says it has no support phone number or public email address. Support runs through in-app chat.
- There is no Phantom token. Phantom said in January 2025 that it has no plans to launch one.
1. Fake download sites, extensions and apps
How it works: you search for Phantom and click an ad or a page that looks official. It offers a download, or a copy of the Chrome Web Store or Firefox page. The fake wallet looks normal until you create or import a wallet, then sends your recovery phrase to the attacker. Funds may disappear minutes or weeks later.
What we saw in October 2026: fake "Phantom" pages on free hosting and course platforms (Teachable, wasmer.app, Daftpage, Umso, Google Sites), PDF files uploaded to university and archive sites, and look-alike domains with extra or swapped letters.
Fake apps in official stores: in June 2024, a fake Phantom app from a developer called "Meta Voxify" appeared at the top of App Store searches through a search ad, listed under Education instead of Finance; a victim reported losing more than 100,000 dollars (CryptoSlate, 2024). Phantom itself warned in 2022 that it has "lots of fraudulent impersonators in the Google Play Store" (Phantom blog, March 2022).
How to check:
| Where | Official identifier |
|---|---|
| Website | phantom.com (older address phantom.app); downloads at phantom.com/download |
| Chrome Web Store | Extension ID bfnaelmomeimhlpmgjnjophhpkkoljpa |
| Apple App Store | App ID id1598432977, seller Phantom Technologies Incorporated |
| Google Play | Package app.phantom, developer Phantom Technologies, Inc. |
| Firefox, Edge Add-ons | No official listing; any "new Firefox version" or Edge-store Phantom is suspect |
Paste any link or ID into our Phantom download checker, and follow how to download Phantom safely.
2. Fake support numbers, chats and DMs
How it works: pages promising a "Phantom support phone number" or "24/7 helpline" lead to a scammer who asks for your recovery phrase, remote access to your computer or a "verification" payment. On X, Discord and Telegram, accounts reply to anyone who complains about Phantom and invite them to a "support ticket" site.
How to check: Phantom has no phone number and never DMs you. Real help is only through the chat inside the Phantom app or extension, and articles at help.phantom.com, which you should type yourself. Details in the Phantom support phone scam.
3. Drainer sites: fake airdrops, mints and claims
How it works: a site promises free tokens, an NFT mint, a "Phantom token" or a reward. When you connect and click "claim", it asks you to sign a transaction that transfers your tokens, or on EVM networks grants an unlimited approval. Some drainers split the theft across several requests so each one looks small.
Where they come from: airdropped tokens or NFTs with a link in their name, hacked or fake project accounts on X, search ads and Discord messages.
How to check: read Phantom's preview. If it shows tokens leaving that you did not intend to send, warns that the dapp could be malicious, or cannot simulate the transaction, reject it. Never interact with tokens you did not expect. See Phantom's malicious dapp warnings and the Phantom token airdrop scam.
4. Fake Phantom pop-ups and "update" requests
How it works: in early 2025, Scam Sniffer reported sites that draw a fake Phantom window inside the page and ask for the recovery phrase to "connect", and a campaign of fake "update extension" requests followed by a phrase prompt (Cointelegraph, February 2025).
How to check: a real Phantom pop-up is a separate window with a chrome-extension:// address that you can move and resize. Phantom updates through the browser's extension store and never needs your phrase to update.
5. Address poisoning, including through chat
How it works: the scammer creates an address whose first and last characters match one you use, then sends you a tiny or zero-value transfer from it, or a message. Next time you copy an address from your activity list, you may pick the fake. In February 2026 a user lost 3.5 wBTC, about 264,000 dollars, in an address-poisoning attack that on-chain investigator ZachXBT linked to Phantom's built-in chat feature (Cointelegraph, 2026).
How to check: copy addresses from the recipient or your Phantom address book, never from your history or a chat, compare the whole address, and send a small test first for large amounts. Our address checker compares two addresses side by side.
6. "Recovery" services
How it works: after a theft, people post about it and are contacted by "recovery experts", "blockchain investigators" or fake lawyers who charge an upfront fee. The FBI warned in August 2023 that private recovery companies cannot issue seizure orders for cryptocurrency and that these scams target victims who have already lost money (FBI, 2023).
How to check: you can't. Treat any unsolicited recovery offer as a scam. Real steps are in what to do if your Phantom wallet was drained.
7. Scams around the 2026 network changes
When Phantom ended Sui support on 24 September 2026, it said it would not contact users about the change or ask for recovery phrases, and that unsolicited offers to help move Sui assets are scams (Solana Compass, 2026). Phantom's help centre says the same about Monad, dropped on 26 August 2026. Expect fake "migration" or "activate BNB Chain" pages around new networks too. See Sui and Monad removed from Phantom.
8. Fantom look-alikes
Fantom (now Sonic) is a different crypto project. Some scam pages and reviews mix the two names, especially in Turkish and Arabic. A "Fantom wallet" site is not Phantom.
Quick checklist before you act
| Red flag | What to do |
|---|---|
| Any request for your recovery phrase, private key or PIN | Close it. Always a scam. |
| A phone number, email or WhatsApp contact for "Phantom" | Ignore it. Phantom has no phone or public email support. |
| Someone from "Phantom" contacted you first | Block them. Phantom never contacts you first. |
| Urgency: "your wallet will be suspended", "claim within 24 hours" | Stop and verify through phantom.com, typed yourself. |
| A red warning in Phantom | Reject the request. |
| A token or NFT you did not expect | Do not visit its link or try to sell it; hide it. |
| A download link from an ad, DM or video description | Check it with our download checker. |
Reporting a fake
You can report fake apps to Apple or Google from the store listing, fake extensions from the Chrome Web Store listing, and phishing sites to Google Safe Browsing. You can also tell Phantom through the in-app chat. If you lost funds, see our drained wallet guide for reporting to the police.
Frequently asked questions
How do I know if my Phantom extension is fake?
Open your browser's extensions page, turn on Developer mode and compare the extension ID with bfnaelmomeimhlpmgjnjophhpkkoljpa. If it differs, remove it and treat any phrase you typed into it as compromised.
Someone from Phantom messaged me. Is it real?
No. Phantom says its support will never contact you first or send you a direct message on social media. Use the chat inside the real Phantom app instead.
I received a free token in Phantom. Can I sell it?
Be careful. Unexpected tokens are often bait that leads to a drainer site or a malicious transaction. It is safest to hide it and not interact with it.
Is there a Phantom token airdrop?
No. Phantom said in January 2025 that it has no plans for a token. Every Phantom token claim is a scam.
Can Phantom block scam sites?
Phantom warns about sites on its blocklist and simulates transactions to flag likely drainers. New scam sites appear constantly, so warnings can be missing; a missing warning does not mean a site is safe.