Ledger Warns Customers About Fake Security Letters Demanding Recovery Phrases

Ledger is alerting its customers about a new phishing scam that involves physical letters aiming to steal wallet credentials. The crypto hardware wallet company urges users to stay cautious and ignore any request involving recovery phrases.

Good to know

• Scammers are mailing fake letters requesting wallet validation.
• Ledger does not ask for recovery phrases under any circumstance.
• Some scammers are also impersonating staff on social platforms and phone calls.

A new scam targeting Ledger users is circulating by mail, according to an alert shared by the company on X. The Paris-based crypto wallet provider confirmed that fraudsters are sending letters directing recipients to a phishing website, asking them to input their recovery phrases under the pretense of validating their wallets.

One version of the letter, posted publicly, reads:

“We are contacting you regarding a critical security update that requires your immediate attention… all users are required to validate their wallets using their recovery phrase to ensure continued and secure access to their Ledger devices.”

Ledger quickly addressed the issue online, clarifying that the letter is fake and warning customers never to enter their 24-word recovery phrase, regardless of the communication channel. The company noted that these phrases are the single key to user funds and should never be shared.

Scammers have not limited their tactics to physical mail. Some have also attempted to reach Ledger users through impersonation on social media or by phone. The company warned that these impersonators may use real names, realistic bios, or professional language to mislead wallet owners.

Ledger stated that it does not contact customers by phone for support and does not send messages asking for wallet credentials. In the event of technical problems, users are encouraged to reach out only through Ledger’s official support team.

“Scammers impersonating Ledger and Ledger representatives are unfortunately common. While we actively report and block scammers, we can’t control what accounts – real or bots – choose to say in their emails, phone calls, bios or usernames on X,” the company wrote.

Ledger also reminded users to avoid interacting with any individual offering help to recover funds. Any such outreach is fraudulent.