SecurityHeroblog
Security Basics2views

Anyone Who Asks for the Family Password Isn't Family — Crypto Impersonation Texts

Text messages impersonating crypto exchanges and wallet companies use 'protect your assets' as the hook to get you to tap a link. Follow the link and you land on a screen asking for your wallet recovery words. Based on the advisory KISA issued on October 16 and a case reported by AhnLab ASEC, here is what to do right now.

These days a lot of households agree on a “family password.” If a stranger says “your mom sent me,” you ask them to say the password. It’s a promise that you’ll only trust someone as family if they know it.

But picture the situation in reverse. Someone calls you and says: “Something’s happened to your mom. I need to verify it, so tell me your family password.”

Is this person family? No. Real family already knows the password. The person asking you to say it is precisely the person who needs it.

Today’s story is about a text message shaped exactly like that scene.

It starts with a single text message

FACT On October 16, 2026, KISA’s Boho Nara issued an advisory. KISA is the Korea Internet & Security Agency, the public body responsible for internet incidents in South Korea. The advisory says this: smishing texts impersonating crypto exchanges and wallet services are on the rise. Smishing is a blend of SMS and phishing. It’s the technique of tricking someone by text into tapping a fake link.

FACT The texts contain phrases designed to make people hurry. KISA pointed to four of them.

  • ‘reward payout’
  • ‘claim immediately’
  • ‘unusual activity detected’
  • ‘protect your assets’

FACT Tap the link and it branches two ways. One is a phishing site. A fake page dressed up to look like the real company’s homepage. The other is a prompt to install a malicious app. A malicious app is a program that installs on your phone and does harmful things.

FACT The phishing site branch goes like this. “Enter your wallet recovery words and you can get your assets back.” Believe it and type the words in, and those words are used to take your wallet.

Picture the scene. A text arrives on your phone: “Unusual activity detected on your account.” Worried, you tap the link. A screen that looks exactly like the exchange’s homepage appears. You see a field saying “To recover your wallet, enter your recovery words in order.” You pull the piece of paper out of the drawer and type in the words you wrote down, one by one.

It’s the same as that phone call. “Something’s happened — tell me the family password.”

What are recovery words, anyway?

When you first create a crypto wallet, several words appear on screen in order. These are called recovery words. In English they’re also called a seed phrase. The instruction that comes with them is “write these on paper and keep them somewhere safe.”

INFERRED Recovery words are your wallet’s family password. But they’re far stronger than an ordinary family password. A family password is used to check “can I trust this person?” Recovery words don’t stop at checking. Whoever knows these words counts as the wallet’s owner. So the moment you tell someone else the words, that person becomes an owner of your wallet too.

FACT That’s why a real exchange or wallet company never asks for your recovery words, under any circumstances. If a page you opened from a text link asks for your recovery words or demands you install an app, you can call it a scam right there.

Why does this work?

INFERRED First, the text frightens you up front. Words like ‘unusual activity’ and ‘protect your assets’ make it feel like your money is leaking away right now. When you’re rushed, you skip the verification step.

INFERRED Second, there’s another lure. ‘Reward payout’, ‘claim immediately’. For people fear doesn’t work on, they dangle something free. One technique carrying two different lures.

INFERRED Third, the sequence of entering the words feels natural. “To recover, enter your recovery words” sounds correct if you just look at the words. After all, when you created the wallet you were taught these were “the words you use to recover.” It’s the same as how “it’s about your mom, tell me the password so I can verify” sounds plausible.

By the numbers

There aren’t many numbers to lean on here. So I’ll stick precisely to the ones that exist.

FACT ASEC, the analysis team at the security company AhnLab, separately reported a similar case on September 30. It was a text impersonating an account protection notice from Pi Network. The text took people to a page mimicking the official site. That page asked them to enter all 24 recovery words.

INFERRED Twenty-four means “all of them.” It’s asking for every single word written on that paper, with none left out. In family-password terms, it’s not a hint about the first letter. It’s asking you to recite the entire password sentence to the end.

FACT ASEC stated that this fake page supported multiple languages. It also said that since 2025 there has been a continuing series of cases drawing people in through ads in the United States, Europe, China, India, Vietnam and elsewhere.

FACT The KISA notice contains neither a victim count nor a loss figure. So this post doesn’t contain those numbers either. How many people were hit is not yet known.

FACT Whether the ASEC case and the KISA notice are the work of the same group has not been confirmed either. All that can be said is that the techniques are of the same family.

What to do right now

There are two things to do. Both can be done today.

1. Don’t tap links in crypto texts. FACT If a text arrives under the name of an exchange or wallet, open the official app already installed on your phone directly. Or type the official address into the address bar yourself. ASEC recommended the same thing. Check directly in the official app or on the official site, not through the link. It’s the same as getting a call saying something happened to your family and then dialing your mom’s number yourself instead of trusting that call.

2. Never enter recovery words into any input field. FACT Web page or app, it makes no difference. If a screen asking for your recovery words appears, leave immediately. ASEC’s advice is the same. Leave any page demanding recovery words at once.

If you’ve already entered them FACT Create a new wallet on a different device. Then move your remaining assets to that new wallet right away. If a family password has leaked, you have to set a new one. This is the same thing. The old words are now words that other people know too, so that wallet is no longer only yours.

INFERRED Boiled down to one line: Whoever is asking for your recovery words, that party is not family.

What We Don’t Know

This post wrote only what has been confirmed. Below is what we still don’t know.

  • We don’t know which exchange or wallet was impersonated. The body of the KISA notice gives no name. We could not read the images inside the body or the attached PDF. So we did not write any specific company name as the impersonation target.
  • We don’t know the scale of the damage. The notice contains no victim count and no loss amount. Nor is there any number for how much it has increased.
  • We don’t know what the malicious app does. What the malicious app — the link’s other branch — specifically does on the phone is not in the text of the notice.
  • We don’t know whether the ASEC case and the KISA notice are the same campaign. We only know the techniques are of the same family. The ASEC report is from September 30, roughly two weeks ahead of this notice.
  • We don’t know what this looks like for people who only use exchange accounts. People who only use an exchange app usually don’t have separate recovery words. For them this might take the form of going after login credentials or verification codes. But we could not confirm that in the text of the notice.
  • We could not confirm the sample texts or KISA’s detailed prevention guidelines. That content is inside the images and the PDF, so we could not read it.

This post was compiled from the body text of the KISA Boho Nara notice and the AhnLab ASEC report. The name of the impersonated company, the scale of the damage, and the behavior of the malicious app have not been confirmed.

Sources

We could not find any press coverage of this KISA notice.

Brief reference date 2026-10-17. This post is a news piece re-compiled from a public agency advisory and a security company report, not from our own honeypot observations. For that reason it does not cover IPs, credentials, or malicious addresses, and it includes no commands or procedures that could be followed. We did not reproduce sentences from the originals; we rewrote only the facts in our own words.