How do I spot a fake swap site on a mobile browser before I connect my wallet

21 September 2026

Check the URL yourself, by hand. Do not tap a link from a search result, a social media post, or a message. Type the exchange's known domain into your browser's address bar. If the name has a misspelling, an extra character, or a different top-level suffix (like .co instead of .com), you are on a fake site. That is the single most reliable test, and it works because forgers count on you rushing.

Fake swap sites exist to drain wallets. They copy the look of legitimate exchanges exactly - logos, colors, layout, even copy. The only reliable difference is the address bar. On a mobile browser, the address bar is small and easy to ignore. Forgers exploit that. They buy domains that differ by one letter (wpay.sg vs wpay-sg.com, for example) and push them through ads or SEO poisoning. If you connect your wallet, the site will request a transaction that hands over your tokens or gives it permission to spend them later.

Look for the padlock icon. A legitimate swap site should have an HTTPS certificate, shown as a padlock in the address bar. But this is not a guarantee. Fakes can also get HTTPS. The padlock means the connection is encrypted, not that the site is honest. Use it as a quick filter: no padlock, stop. Padlock present, still verify the URL.

Read the domain name slowly, character by character. Common tricks: replacing a lowercase 'l' with an uppercase 'I', using 'rn' to look like 'm', or adding a hyphen where none belongs. On a phone screen these substitutions are hard to catch. One method: tap the address bar to select the full URL, then read it aloud. If you would not say it that way, it is wrong.

Check the site's behavior before you connect. A legitimate swap site will show you a swap form, a price quote, or at least a clear interface. A fake site often pushes you to connect your wallet immediately. It may display a large "Connect Wallet" button before anything else. Real exchanges let you browse, read about fees, or check supported tokens first. If the only action offered is connecting, be suspicious.

Do not use the browser's autocomplete or saved bookmarks from an unknown source. Malicious sites can register domains that match a partial typed address. If you type "swap" your phone may suggest a fake site. Clear your browser's autocomplete history for swap-related terms if you use them often. Better yet, use a dedicated bookmark you created yourself, and only that bookmark.

Test with a small action if possible. Some fake sites will show a real-looking interface but inject a different contract address when you confirm the swap. On mobile, you cannot hover over a link to see where it leads. If the site asks you to connect, but you are not certain, disconnect immediately and check the URL again. Do not approve any transaction while you are unsure.

The hub page for this set is "Mobile wallet swap mistakes with carbon credit tokens." That page covers the broader errors that happen when swapping these tokens from a phone. The URL check is the first line of defense; the hub page explains what else can go wrong after you have confirmed the site is real.

A final note: fake sites sometimes work by copying the legitimate site's code and hosting it on a lookalike domain. They will show the same swap interface, the same price quotes, even the same warnings. The only thing they cannot copy is the domain you intended to visit. So verify the domain before you do anything else. Type it yourself. No shortcuts.

Back to carbon credits