Red flags
Verification settles it, and recognising the shape early saves you from taking the bait seriously in the first place.
They are all the same flag
Every tell below is a variation on one thing, which is manufacturing hurry. Urgency is what stops people checking, and checking is the only thing that defeats any of this. So an attacker's entire job is to produce a reason you should act before you verify.
The six
| Tell | What it looks like | Why it is there |
|---|---|---|
| A deadline | Migrate within 24 hours, addresses retire tonight, act now | Real rotations run long overlaps precisely so nobody has to hurry |
| An address and nothing else | The whole message exists to move you to a URL | Genuine notices describe a situation. Forgeries route traffic. |
| An excuse for no signature | Key rotated, forum stripped it, on mobile, will sign later | All the same lie. The more elaborate the excuse, the more effort went into the rest. |
| Anything touching credentials | Log in to confirm, re-enter your seed to migrate, verify your account | Announcements inform. They never ask. There is no exception. |
| Perfect timing with an outage | A helpful address appearing while the real ones are down | Not coincidence. This is the window, and it is worked deliberately. |
| Emotional register | Written to make you feel something | Real operational writing is dull. Anything doing more than informing is doing another job. |
The one that is genuinely hard
A message announcing the signing key itself has changed. It is hard because it is self undermining. Anyone able to compromise the old key can sign a handover with it, so the signature proves less than usual, and a genuine key rotation does have to happen somehow.
No single message settles this. What does is consistency across independent places over time, so the correct response is to slow down rather than speed up. Nothing about a key change requires action inside an hour. Wait several days, look in places that would have to be compromised separately, and let agreement accumulate. Anything pressuring you past that wait is telling you what it is.
What genuine material looks like
- Boring. It states what happened, what it affects, and usually that you need do nothing.
- Dated inside the signature, so the date cannot be adjusted without breaking it.
- Signed, without commentary about being signed. It does not tell you how trustworthy it is.
- Unhurried. No deadline, because there is no operational reason for one.
- Asking for nothing. Not credentials, not confirmation, not a reply.
Use both
Tone is a heuristic and a signature is proof. The heuristic is useful because it works before you have done anything, and it is not a substitute. Run the check anyway, precisely because having proof available means never needing to rely on a feeling about how something was written.