Spotting fake DappFactory emails
What we will never ask you for, which addresses we send from, and what to do with a message that looks wrong.
What we never ask for
No email, chat message or phone call from DappFactory will ever ask for your password, a seed phrase, a wallet's private key, a card number or a two-factor code. Anything that does is not from us, whatever the logo looks like.
What a real email looks like
- It comes from an address ending in @dappfactory.io (account notices from one address, newsletters and event mail from another, both on that domain).
- Its links open dappfactory.io or one of its subdomains: instance.dappfactory.io (the Creator console), app.dappfactory.io (the farmer app), docs.dappfactory.io (the Help centre). Hover a link, or look at the address bar after it opens, before you type anything.
- It addresses you by the name on your account and refers to something you did: a sign-in from a new device, a withdrawal you submitted, an invoice, an invite.
What to do with a suspicious message
- Do not click its links or open its attachments.
- Forward it to [email protected] and we will tell you whether it is ours.
- If you already entered your password on a page you now doubt, change it under My Profile → Security, sign out other sessions there, and turn on two-factor authentication.
- If you shared a seed phrase or private key, move the wallet's assets to a new wallet immediately; nobody, including us, can reverse a transaction once it is signed.
Fake sign-in pages
The most common trick is a copy of the sign-in page on a lookalike address: an extra word in the domain, a different ending, or the real name buried inside a longer one. The page looks right because it was copied from ours. Before you type a password, read the whole address in the address bar; the Creator console is only ever at instance.dappfactory.io. A bookmark you made yourself is safer than any link in an email.
What we do on our side
Our account notices tell you about something you did, so an unexpected one is worth a second look. Sign-in alerts email you when your account is signed into from a new device. If you get one you do not recognise, change your password and sign the other sessions out from Active sessions. Reports sent to [email protected] help us warn other creators, so send the message on even if you did not fall for it.