Spain
Mexico
Brazil
Poland
Taiwan
Philippines
South Korea
The essentials
- Card details, account credentials, and wallet recovery secrets need different protections.
- A card freeze does not revoke blockchain permissions; revoking permissions does not repair an exposed seed phrase.
- Keep spending funds separate, use official support, and prepare recovery access before a device is lost.
Know which access you are protecting
Your card number, expiry date, and security code authorize card payments. Your app password and authentication methods protect account access. A self-custody wallet’s seed phrase or private key can control crypto independently of the card. Never give recovery secrets to a merchant, support agent, refund form, or person offering to recover funds.
A custodial card account may use provider-managed recovery rather than a seed phrase. Some self-custody wallets use passkeys or other recovery designs. Identify your actual setup before an emergency: who can restrict the card, who can restrict the account, and what restores wallet access? A card replacement alone does not change a wallet’s keys.
Limit everyday exposure
As a practical budgeting measure, keep only the funds you expect to spend, plus an appropriate authorization buffer, accessible to the card. Keep longer-term holdings outside the spending route where your setup permits. Check automatic funding sources: a small displayed card balance is not a hard limit if the card can draw from other assets.
Use unique account passwords and the strongest supported authentication, such as a passkey or security key. Secure the linked email account too. Enable transaction alerts and review devices and sessions. These measures reduce exposure but cannot guarantee safety. Separate accounts derived from one seed phrase remain exposed if that phrase is stolen.
Respond to the specific compromise
If card data is exposed or the physical card is stolen, freeze it where available, report unauthorized transactions, and arrange replacement through the issuer. Ask whether mobile-wallet tokens or recurring payments also need attention. If the provider account was accessed, use its account-lock and recovery process and remove unfamiliar sessions from a trusted device.
For a harmful wallet approval, review and revoke the relevant permission using a verified tool for the correct network. Disconnecting a website does not revoke existing blockchain approvals. If the seed phrase or private key leaked, revocation is insufficient: follow the wallet provider’s recovery guidance and move recoverable assets to a new, independently secured wallet. Do not add gas funds if a sweeper is suspected.
| Affected access | Immediate action | Separate follow-up |
|---|---|---|
| Card number or physical card | Freeze and notify issuer | Replace card; dispute unauthorized charges |
| Provider account | Use account lock and recovery | Secure email and remove unknown sessions |
| Token approval | Revoke the relevant permission | Review other approvals and activity |
| Seed phrase or private key | Use a clean recovery setup | New independent wallet; old keys remain exposed |
Recognize support and refund phishing
Open support from the installed app or an independently verified official website. An urgent message, convincing logo, familiar caller ID, or apparent case number does not establish identity. Verify an account alert inside the service before following instructions. Avoid sponsored support numbers and unsolicited private messages offering special help or guaranteed recovery.
Pause if someone requests a seed phrase, private key, one-time code, remote device access, or a transfer to “protect” your balance. Read the actual wallet signing request; a refund story can conceal permission to spend tokens. Share necessary receipts through the verified support channel, with unrelated personal details removed. Never include secrets in screenshots.
Prepare and use a recovery checklist
Before losing a device, confirm your account recovery methods and securely store the backup material your wallet requires. Keep official support access and essential account identifiers available somewhere other than that phone. Do not uninstall or erase a wallet casually: without the required recovery method, you may lose access to assets.
If the phone goes missing, use the platform’s lost-device controls, contact the mobile carrier, and restrict card or account access through official channels. Apple’s Lost Mode suspends Apple Pay cards on compatible devices; it does not revoke crypto permissions. From a trusted replacement device, restore access, review activity, replace compromised credentials, and keep incident evidence. Report losses without assuming that recovery is guaranteed.
Official sources
An editorial guide based on official materials, not a report of a payment test or an individual approval.
Official sources · 9
Coinbase Card: security for the Coinbase debit card ↗MetaMask: unauthorized transactions and compromised wallets ↗
Coinbase: make your account more secure ↗
Coinbase: lock or unlock your compromised account ↗
MetaMask: what is a token approval? ↗
Revoke.cash: token approval management and disconnecting a wallet ↗
Coinbase: technical support and impersonation scams ↗
Apple: use Find My to locate your lost Apple device ↗
Apple: if your iPhone or iPad was stolen ↗
