Anti-Phishing Code
Common Email Phishing Techniques
Phishing attacks occur when bad actors impersonate a trusted source — such as official Safeheron communications — to trick you into clicking malicious links, downloading malware, or disclosing sensitive information like account credentials, seed phrases, or key shards, with the goal of stealing your digital assets. Common tactics include:
Spoofed senders and domains
Attackers register addresses that closely resemble the official domain (an extra letter, a swapped suffix) or exploit email protocol weaknesses to forge the sender's display name, making an email appear to come from an official Safeheron account.
Imitation templates and messaging
Attackers copy the logo, layout, and tone of official emails, pairing them with urgent language — "account irregularity," "verification required," "assets at risk," "compliance review" — designed to create panic and push you into acting before you've verified anything.
Fake links and phishing pages
Emails contain links to login or verification pages that closely mimic the real ones. The moment you enter your credentials or 2FA code, that information is captured in real time.
Social engineering using leaked information
If attackers already have basic details about you — your email address, your team name — they can craft more targeted, harder-to-detect phishing content.
Because the visible elements of an email — the logo, the copy, the formatting — can all be copied, appearance alone isn't a reliable way to verify authenticity. This is exactly the problem the anti-phishing code is designed to solve.
What Is the Anti-Phishing Code
The anti-phishing code is a personalized string that you set yourself in Safeheron's security settings. It's known only to you and Safeheron — attackers have no way to obtain or replicate it.
Once set, every official email Safeheron sends you will display this code in a fixed location. In other words:
If an email claiming to be from Safeheron is missing your code, or shows the wrong one, treat it as a likely impersonation attempt — don't click any links or provide any information.
If you haven't set an anti-phishing code yet, official emails will show a prompt in that same location encouraging you to enable it, rather than leaving the space blank or hidden. This prevents any confusion between "the feature isn't turned on" and "this is a phishing email."
Setting Up Your Anti-Phishing Code
You can set this up from the mobile app under Security Center → Anti-Phishing Code.
Steps:
Go to Security Center, find Anti-Phishing Code, and tap Set Up.
Enter your code. Once set, you'll receive a confirmation email containing the code itself, so you can verify it was saved correctly.
Last updated