You receive a phone call from someone claiming to be a crypto exchange customer service rep, saying your account has security risks and asking you to download a meeting app for "remote operation guidance". If you follow their instructions, every single thing displayed on your phone screen will be shared with them.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
We will cut straight to the point: Whatever you can see on your phone, the scammer can see too. This includes your wallet mnemonic phrase, private key, transaction password, SMS verification code, and even the click path of your fingers when you enter passwords. This is not speculation, it is determined by the core working principle of the screen sharing feature.
Step 1: Understand Exactly What Screen Sharing Broadcasts
Core goal: Figure out what information this feature actually exposes.
Screen sharing does not only share the interface of the single app you are currently using. It broadcasts all real-time content displayed on your entire screen. Every time you switch apps, open your crypto wallet, or enter a password, the scammer sees all of it synchronously.
For crypto users, exposure of the following information means you have completely handed over control of your assets to others:
Mnemonic phrase / Private key: If you view your mnemonic phrase or private key in the wallet while sharing the screen, the scammer can take a direct screenshot, and your wallet will no longer belong to you.
Transaction password: When you enter a 6-digit password in the exchange app, every click you make on the screen is clearly visible to the other party.
SMS verification code: If the verification code pop-up appears on your screen, the scammer will see it at the same time.
App switching process: When you switch from your email to the crypto wallet after copying a verification code, all interfaces displayed during the switch are fully exposed.
Checkpoint: You can clearly state that "Screen sharing means every single frame on my phone is sent to the other party in real time".
Step 2: The Full Attack Flow Scammers Use With Fake Customer Service and Screen Sharing
This is the full step-by-step process of the scam:
Step 1: Create panic. The scammer will tell you your full name, phone number, and even which crypto exchange you registered on, then claim "your account is abnormal and about to be frozen", "your unregistered loan needs to be canceled", or "you have subscribed to a paid membership that will be charged soon" to make you anxious.
Step 2: Guide you to download the app. They will ask you to download a regular, well-known meeting app, join a meeting with the provided ID, and turn on the screen sharing feature. Note that these meeting apps are not malware, they are legitimate office tools. But when misused by scammers, these normal tools become the most dangerous weapons.
Step 3: Watch you operate. The scammer will ask you to open your exchange app, crypto wallet, email and other apps under the excuse of "guiding you to verify your account". The passwords you enter, the mnemonic phrases you view, and the verification codes you receive will all be exposed in real time.
Step 4: Steal your assets. After getting all the key information, the scammer will log in to your account or wallet without your knowledge and transfer all your assets away. The whole process may only take a few minutes.
Step 3: List of Critical Information You Must Never Expose During Screen Sharing
Core goal: Clarify what information must never appear on your screen when you turn on screen sharing.
The following information counts as fully exposed as soon as it appears on your phone screen during screen sharing:
| Information Type | Consequence of Exposure | Risk Level |
|---|---|---|
| Crypto wallet mnemonic phrase / private key | Your wallet is fully taken over, scammers can transfer all assets away freely | Extremely High |
| Exchange login password | Scammers can log in to your account without permission | High |
| Screen pop-up SMS verification code | Scammers can bypass login or withdrawal verification | High |
| Email login password | Scammers get access to the password reset entry for your other accounts | Medium-High |
| Google Authenticator 6-digit code | Scammers can pass 2-factor authentication checks | High |
Checkpoint: You can go through this table and judge whether any of your recent operations have exposed sensitive information to the other party.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 4: Emergency Handling Steps If You Accidentally Turn On Screen Sharing
Core goal: Minimize your loss before all your sensitive information is fully leaked.
Follow these steps in order, do not skip any step:
Turn off sharing immediately: Open the meeting app you are using, find the "End Sharing" or "Stop Sharing" button and click it explicitly. Do not just switch back to your phone home screen, as that does not mean you have exited the screen sharing session.
Turn on airplane mode or power off your phone: If you are not 100% sure you have fully exited the sharing session, turn on airplane mode or power off your device directly to cut off the connection physically.
Transfer your assets first (highest priority): Use another completely safe, uncompromised device to log in to your wallet and exchange accounts, and move all your assets to a new wallet address that only you control. Transfer assets first, then change passwords, because changing passwords takes time, and the scammer may already have your passwords.
Change all passwords + reset 2FA: After you confirm all your assets are safe, update the passwords of all your related accounts, and reset your Google Authenticator settings.
Remove your SIM card: If you suspect the scammer has already accessed your verification codes, take your SIM card out of the phone to stop scammers from receiving future verification SMS with your number.
Checkpoint: All assets have been transferred to a secure new address, and passwords for all related accounts have been updated.
High Risk Reminder: Law enforcement and financial regulators have released multiple recent warnings that scammers induce users to turn on screen sharing under the pretext of "canceling paid subscriptions" or "verifying accounts", then steal bank card numbers, transaction passwords, SMS verification codes to transfer funds. Private keys and mnemonic phrases for crypto accounts are far more sensitive than bank card details, and their exposure will cause irreversible losses. Hang up directly if any person claiming to be customer service asks you to turn on screen sharing.
Verification after handling: After transferring your assets, confirm the new wallet address has received all your funds. Check your exchange account login records to make sure there are no unknown access devices. Monitor the login logs of all related accounts for 7 days after the incident.
Next action: Go to your phone settings right now, find the permission management page for "screen sharing" or "cast screen", and check which apps have this permission. The next time any stranger asks you to turn on this feature, you should immediately realize: They are trying to steal my mnemonic phrase.
