Fake swap pages copy real interfaces to steal wallet access or approvals. They can mimic token lists, exchange rates, progress bars and error messages, so a familiar-looking page proves little. The real test is whether you can verify the site and understand the wallet request before signing.
- A wallet connection shares an address; a signature or transaction can authorize actions.
- Check the exact domain through a trusted source before connecting.
- If a prompt is unclear, reject it and restart from a verified address.
How do fake swap pages imitate the real thing?
Scammers copy the visible parts of a cross-chain swap: choose-source-and-destination fields, token logos, estimated output and a button to connect a wallet. They may also copy a service’s name with a misspelling or extra word in the domain, then promote the page through ads, fake support messages or social posts.
Think of the page as a shop window: a convincing display does not prove the shop behind it is genuine. Before using a thor swap service, save its official address from a source you already trust, such as its verified social account or documentation. For a practical comparison of transfer types, which thor swap route fits is useful context, but verify any service domain separately.
What can a wallet prompt let the page do?
A connection usually lets a site see your public wallet address and request actions; it does not, by itself, hand over your recovery phrase or private key. A signature is different: it can approve an action or, in some cases, authorize a token allowance that lets a contract spend tokens later. A transaction may transfer funds or set that allowance on a particular chain.
Read the wallet’s own prompt, not the page’s explanation of it. Check the network, asset, recipient or contract, and any spending limit shown. If you cannot tell what the request authorizes, reject it. Never enter a recovery phrase into a swap page; no ordinary swap requires it. MetaMask’s security guidance distinguishes connections, signatures and transactions, while the FTC advises checking a company through a known official channel instead of trusting an unexpected link.
How can you compare routes without trusting a lookalike?
Start from a verified address and check that the browser domain matches it character for character. A padlock only means the connection is encrypted; it does not show that the site is legitimate. Treat search ads, unsolicited direct messages and “support” replies as leads to verify, not proof.
Then compare what each route asks you to do. A swap service may coordinate the cross-chain transfer in one flow; a bridge plus a separate exchange can split it into multiple steps. Either way, a real quote can change with liquidity and network conditions, but a page demanding your recovery phrase or asking you to sign an unexplained message is a stop sign. For a thor swap, check that the wallet prompt matches the asset and network you intended to use.
What should you do if you already interacted?
If you only connected, disconnect the site in your wallet and close the tab; keep watching the address for activity. If you signed an approval, use a trusted wallet or block explorer for that network to inspect and revoke the allowance. Revoking may cost a network fee, and it will not reverse a transfer that already happened.
If you signed a transaction or sent funds, save the transaction hash and check it on the relevant block explorer. Do not trust anyone who contacts you claiming they can recover the funds for an upfront payment. I would use a route only when I can verify its domain independently and explain every wallet request it makes.
Decision rule: if you cannot verify the domain and understand the prompt, do not connect or sign.