Safety & scams
Last fact-checked 24 October 2026 (time-sensitive claims re-checked against the linked sources).
The ten rules
- Never type your seed into a website, app, computer, phone, chat or "validator". Only into the hardware wallet itself during recovery.
- Never photograph, screenshot, scan, email, message or cloud-store it. Cloud backups and photo libraries are prime targets (MetaMask iCloud warning).
- Nobody legitimate will ask for it — not support, not exchanges, not "blockchain authorities", not tax offices.
- Buy hardware direct; reject any device with a pre-written seed.
- Bookmark official sites; never use search ads or links in emails/DMs.
- Verify addresses on the device screen before signing.
- Don't blind-sign transactions you can't read.
- Keep quiet about holdings online and offline.
- Test recovery with small sums first.
- Slow down. Urgency is the scammer's main tool.
A quick check before you act on any message Beginner
Many of the thefts on the case files page began with a message, a link or a phone call rather than a technical break-in. Before you click, reply, install or sign anything, ask yourself these questions:
- Did I start this contact? If someone contacted you first (support, a "security team", a stranger who is helpful), treat it as hostile until proven otherwise.
- Is there a deadline or a threat? "Your wallet will be frozen in 24 hours" is pressure, not security.
- Does it involve my recovery words in any way? If so, the answer is always no, whoever is asking.
- Did I reach this site or app myself, from a bookmark or the maker's printed address? Not from a search ad, an email link or a QR code someone sent.
- Can I read and check what my device is asking me to sign? If not, stop and ask in the maker's official forum or support channel, which you open yourself.
If you are unsure, wait a day. A genuine request will still be there tomorrow; a scam usually will not.
Threats at a glance: what each attacker needs Intermediate Expert
The same seed can be lost in very different ways. This table shows what each attack needs from you and whether a hardware wallet helps on its own. Each row links to the detailed section and its sources.
| Threat | What the attacker needs from you | Does a hardware wallet stop it on its own? | Main defence |
|---|---|---|---|
| Seed phishing and fake support | Your recovery words, typed or spoken | No: anyone with the words can restore the wallet elsewhere | Never type or say the words to anyone or into anything except the device during recovery |
| Fake wallet apps and extensions | Your words, entered into the fake app | No, if you type the words into the fake app | Install only from links on the maker's own site |
| Search-ad look-alike sites | Logins, words or a malware download | Partly: it protects keys, not exchange logins or your judgement | Bookmarks; type addresses yourself |
| Clipboard malware | That you paste an address and do not check it | Yes, if you compare the full address on the device screen | Check every character on the device |
| Address poisoning | That you copy an address from history | Only if you check against a trusted source, not just the screen | Address book; test transaction |
| Approval and permit drainers | One signature on a malicious site | No: the device signs what you approve | Read what you sign; separate low-value wallet; revoke old approvals |
| SIM swap | Your phone number, moved to their SIM | Yes for self-custody keys; no for exchange accounts using SMS codes | App or security-key 2FA; carrier account lock |
| Social engineering after a data leak | Your trust, using your real name, address and order history | Only if you never act on the message | Hang up; contact the firm through its official app or site |
| Physical coercion | You, or someone close to you, under threat | No | Privacy; set-ups where you cannot move everything at once |
This is a summary of the sections below, which give the sources. It is not a complete list of threats.
Common scams and how they work
| Scam | How it works | Defence |
|---|---|---|
| Fake support | You post a problem; "support" DMs you, or a search ad leads to a fake helpdesk asking for your words | Real support never DMs first and never needs your seed |
| Phishing emails / letters | After the 2020 Ledger data leak, customers received emails, SMS and even posted letters urging them to "verify" seeds (Ledger) | Ignore; go to the official site yourself |
| Fake apps & extensions | Look-alike wallet apps in app stores or browser stores harvest seeds | Install from links on the maker's official site |
| Counterfeit / tampered devices | Modified hardware with known seeds (Kaspersky case) | Buy direct; run genuineness checks |
| Pre-filled seed card | "Your recovery phrase" already printed in the box | Never use; return the device |
| Wallet drainers | Malicious sites or compromised libraries trick you into signing approvals (Connect Kit 2023) | Read every signature request; revoke old approvals |
| Address poisoning | Scammer sends dust from an address that looks like yours so you copy it from history | Use your address book; verify full address on device |
| Clipboard malware | Swaps a copied address for the attacker's | Verify on the hardware screen |
| "Recovery" services | Promise to recover lost or stolen crypto for a fee or your seed | Legitimate recovery firms never need your active seed for advice; be extremely cautious |
| Romance / investment scams | Long-con persuasion to "invest" or connect wallets | Talk to someone you trust before moving funds |
What the official figures say Intermediate
The FBI's 2025 Internet Crime Report counted 181,565 complaints involving cryptocurrency, with reported losses of about $11.366 billion, up 21% and 22% on 2024. The average loss was $62,604, and 18,589 people reported losing more than $100,000. Cryptocurrency investment fraud was the largest single source of losses, at about $7.2 billion (IC3 2025 report, FBI press release). The report says these long cons usually start with a text, social media message, advert or dating app, move to a messaging app, show fake profits, and end with "taxes and fees" to withdraw. It also notes that victims are then targeted by recovery scams.
In the UK, the FCA says reports of crypto investment scams to it have more than doubled since 2020, and that most crypto activities are not regulated, so the Financial Ombudsman Service and FSCS generally do not apply (FCA: crypto investment scams).
These are reported complaints only; many losses are never reported. Figures are as published; this site has not adjusted them.
Current scam patterns in detail Beginner Intermediate
Each pattern below gives a real, sourced example, then what helps and what goes wrong. The Pros and Cons boxes describe the defences, so you can see their trade-offs.
Fake wallet apps and fake investment apps Beginner
In 2023 a fake "Ledger Live Web3" app sat in the Microsoft Store from about 19 October until it was removed on 5 November. It asked users for their 24-word phrase; at least $768,000 was stolen, including one person's $26,500 savings minutes after typing the words (BleepingComputer). Separately, the FBI warned in 2022 that criminals were persuading investors to download fake crypto investment apps using the names and logos of real firms: it identified 244 victims and about $42.7 million in losses, and victims were told to pay "taxes" before withdrawals, which never came (FBI/IC3 notice, 18 July 2022).
Pros
- Installing only from a link on the maker's own site, reached from a bookmark, defeats look-alike store listings
- A hardware wallet app never needs your recovery phrase to work
Cons
- App-store presence is not proof: the fake Ledger app passed store review
- Takes discipline after a computer rebuild, which is exactly when people go looking for the app again
Pitfalls
- An app that asks for your recovery phrase to "sync", "restore" or "verify"
- Developer names such as "Official Dev", few reviews and copied descriptions (red flags noted by BleepingComputer)
- Paying a "tax" or "fee" to unlock a withdrawal (FBI)
Defences (official) and community advice
- Official: the FBI advises not to download or use investment apps you cannot verify, and not to pay extra fees or taxes to withdraw (FBI)
- Community advice: after reinstalling an operating system, re-download wallet software from the maker's site before plugging the device in
Address poisoning Intermediate
A scammer sends a tiny amount, a token or an NFT from an address made to look like one you have used, often matching the first and last few characters, hoping you copy it from your transaction history next time (Ledger, Trezor). FBI Denver warns that criminals also create impersonation tokens that mimic well-known stablecoins such as USDT, and that wallet software's truncation of addresses hides the different middle characters (FBI Denver). Ledger and MetaMask both say poisoning does not compromise your keys or recovery phrase (MetaMask).
Pros
- Checking every character on the hardware wallet screen stops it
- Address books and saved contacts remove the need to copy from history
- Some wallets now warn: MetaMask says it shows a blocking warning when a destination closely resembles a previously used address
Cons
- Anyone can send to a public address, so it cannot be prevented, only defeated
- Long addresses make full checks tedious, and Trezor notes that even diligent people can fall for it
Pitfalls
- Copying an address from transaction history or a block explorer
- Checking only the first and last four characters
- Interacting with unknown tokens that appear in your wallet
Defences (official) and community advice
- Official: never copy from history; get your own address from the Receive screen and confirm on the device (Ledger, Trezor)
- Community advice: send a small test transaction first for any new destination, then check it arrived before sending the rest
Phishing and fake support Beginner
Fake support works by getting you to contact the scammer, or by them contacting you, then steering you to "verify" or "sync" your words. After Ledger's 2020 customer data leak, customers received emails, texts and even posted letters asking them to do exactly that (see the table above). The FTC says no legitimate business or government will email, text or message you on social media to ask for money, and warns against links in unexpected messages (FTC). The FBI warns to look out for domain names that impersonate exchanges, often with small misspellings (FBI).
Pros
- Opening support yourself, from the maker's site, removes most of the risk
- A simple rule: nobody legitimate needs your recovery phrase
Cons
- Scam ads can rank above real sites in search results
- Data leaks mean scammers may know your name, address and what you bought
Pitfalls
- Replying to someone who "saw your post" and offers help
- Following a QR code or link in a letter or email that claims to be from your wallet maker
- Screen-sharing with "support"
Defences (official) and community advice
- Official: report to Report Fraud (England, Wales and Northern Ireland), the FTC or IC3
- Community advice: post problems only in the maker's official forum, and ignore every direct message that follows
Recovery scams Beginner
Recovery scams target people who have already lost money. The FCA describes "recovery rooms" that cold-call victims, often impersonating the FCA, government or police, and demand upfront fees described as tax, solicitor or administrative charges; the people behind the first scam may run the recovery room or sell victims' details (FCA: recovery room scams). The FCA notes that fraud reports can only be shared between law enforcement agencies, not with private firms. The FBI has warned about fake "recovery" companies and fictitious law firms that target crypto scam victims (IC3 2023, IC3 2024).
Case files: fake "crypto recovery" law firms (FBI warnings 2023–2025) and the $230m fake-support theft (ringleader pleaded guilty in September 2026).
Pros
- Knowing the pattern makes the second contact easy to spot
- Genuine law enforcement does not charge a fee to return funds
Cons
- Victims are often desperate, which is what the scam relies on
- Some recovery websites look professional and claim UK offices they do not have (FCA)
Pitfalls
- Paying an upfront fee or "tax" to release recovered funds
- Giving a seed, wallet access or bank details to a "recovery agent"
- Trusting webmail addresses such as Gmail; the FCA says it never uses webmail to contact consumers
Defences (official) and community advice
- Official: the FBI says not to pay for services that claim to recover lost funds (FBI); the FCA says to end contact if asked for a fee or bank details, and to check firms only via the FCA Firm Checker
- Community advice: tell family members about this pattern too, because recovery scammers often call older relatives
Social engineering after customer data leaks Beginner Intermediate
Two leaks show why scammers can sound convincing. In 2020 an attacker reached Ledger's e-commerce and marketing database through a third party's API key. Ledger says about 1 million email addresses were taken, and that a dump published on 20 December 2020 showed about 272,000 records with names, postal addresses and phone numbers; its FAQ later puts the detailed records at about 292,000 across this and a related Shopify breach. Ledger says no payment details, passwords or funds were affected (Ledger CEO message, Ledger breach FAQ). Those details were then used for phishing emails, texts, posted letters and even tampered devices sent by post.
In May 2025 Coinbase disclosed that criminals had bribed overseas support contractors to copy customer data, then phoned customers pretending to be Coinbase; it said no passwords or private keys were taken (Coinbase SEC filing, Reuters; see the case file).
What this means: a caller or letter that knows your name, address, what you bought or roughly what you hold is not proof that it is genuine. Ledger says it almost never sends physical mail and will never ask for your phrase (printed letters case).
Pros
- Treating every unexpected contact as hostile works however much the scammer knows
- Calling back through the official app or website defeats caller-ID spoofing
Cons
- You cannot "un-leak" a postal address; the risk lasts for years
- Moving house or changing number is costly and only partly helps
Pitfalls
- Assuming a message is real because it quotes your order or balance
- Following a QR code in a letter; scanning it takes you straight to the scammer's site
- Moving funds to a "safe" or "vault" address someone gives you
Defences (official) and community advice
- Official: Ledger says it will never ask for your 24 words (Ledger FAQ)
- Community advice: buy hardware with a delivery address that is not your home where you can, and use a separate email address for crypto purchases
- Community advice: tell family members that no company will phone them about your wallet
Look-alike sites in search adverts Beginner
The FBI warned on 21 December 2022 that criminals buy search adverts using domains similar to real businesses, including cryptocurrency exchanges. The ads appear at the top of results "with minimum distinction" from real results, and lead to copies of the real site that collect logins or deliver malware named after the program you wanted (FBI/IC3 PSA, 21 December 2022).
Pros
- Bookmarks and typed addresses avoid the problem entirely
- The FBI also suggests an ad-blocking extension for searches
Cons
- Search is how most people find software after replacing a computer
- Ad blockers are themselves browser extensions, which need care (see fake extensions)
Pitfalls
- Clicking the first result for a wallet or exchange name
- Downloading wallet software from anything other than the maker's own domain
Defences (official) and community advice
- Official: check the URL before clicking an advert, and type the business's address yourself (FBI)
- Community advice: keep a printed note of your wallet maker's exact web address with your device paperwork
Fake wallet browser extensions Beginner Intermediate
In July 2025 Koi Security reported more than 40 malicious Firefox add-ons impersonating wallets including MetaMask, Coinbase, Trust Wallet, Phantom, Exodus and OKX. Many were clones of open-source wallets with added code that sent wallet secrets to the attackers, and many had hundreds of fake five-star reviews (Koi Security, BleepingComputer). Mozilla says it has built an early-detection system that flags risky wallet extensions for human review, and advises using only the extension your wallet's own website links to (Mozilla Add-ons blog, 30 May 2025).
Pros
- Installing from the link on the wallet maker's own site avoids look-alike listings
- A hardware wallet keeps keys off the computer, so a fake extension cannot read them unless you type your words into it
Cons
- Store listings, logos and reviews can all be faked
- Extensions can update silently and change behaviour after installation (Koi Security)
Pitfalls
- Typing a recovery phrase into any browser extension to "import" a hardware wallet
- Trusting an extension because it has many reviews
Defences (official) and community advice
- Official: use only the extension your wallet's website links to (Mozilla)
- Community advice: keep a separate browser profile with only the wallet extension installed, and review installed extensions now and then
Clipboard malware ("clippers") Beginner Intermediate
Crypto addresses are long, so people copy and paste them. A "clipper" watches the clipboard and swaps a copied address for the attacker's. ESET says this kind of malware first appeared on Windows in 2017 and in February 2019 found one on Google Play, posing as MetaMask, that both stole keys and swapped copied Bitcoin and Ethereum addresses; Google removed it after ESET reported it (ESET WeLiveSecurity).
Pros
- Comparing the full address on the hardware wallet screen against the intended address defeats a clipper
- Address books and saved contacts reduce pasting
Cons
- Checking every character is slow, and people tend to check only the start and end
- A software-only wallet on an infected device shows whatever the malware wants
Pitfalls
- Checking the pasted address against the copy on the same infected screen
- Assuming official app stores are free of malware
Defences (official) and community advice
- Official: ESET advises checking that what you pasted is what you meant to enter (ESET)
- Community advice: for a large payment, confirm the address with the recipient through a second channel, then send a small test first
Approval and permit drainers Intermediate Expert
On Ethereum and similar chains, a token approval gives an app permission to move a type of token from your wallet. MetaMask says many legitimate apps ask for effectively unlimited amounts, and that this is also how many malicious sites steal (MetaMask: what is a token approval?). A permit does the same with an off-chain signature: ERC-2612 lets a signed message set the allowance, and allows deadlines that effectively never expire (ERC-2612). MetaMask warns that permit-style signatures are not recorded on-chain when you sign, so the theft can come weeks later (MetaMask: signature phishing). The Inferno Drainer service used more than 16,000 phishing domains in this way (Group-IB; case file).
Key point: no seed phrase is needed. A hardware wallet faithfully signs whatever you approve.
Pros
- A separate low-value wallet for new apps limits what one bad signature can reach
- Revoking old approvals removes standing permissions (it costs a transaction fee)
- Custom spending caps limit the damage if an app turns out to be malicious (MetaMask)
Cons
- Approval screens are hard to read; MetaMask says transaction data is "so rarely readable by humans"
- Revoking cannot recover tokens already taken
- Permit signatures are not recorded on-chain when signed, so they may not appear in approval lists until used
Pitfalls
- "Claim your airdrop" or "compensation" links from social media
- Signing a "login" or "listing" message without reading what it grants
- Approving setApprovalForAll to claim a free NFT; MetaMask says you should not need to
Defences (official) and community advice
- Official: check what an app is requesting before approving, and revoke unwanted approvals (MetaMask)
- Community advice: keep long-term savings in an address that never connects to apps at all
SIM swaps and phone-number takeover Beginner Intermediate
In a SIM swap, a criminal persuades your mobile operator to move your number to their SIM, then receives your text-message codes. The FBI recorded 1,611 SIM-swap complaints with more than $68 million in losses in 2021 (FBI/IC3). In the US, FCC rules adopted on 15 November 2023 require wireless providers to authenticate customers securely before a SIM change or number port, to notify customers immediately of such requests, and to offer an account lock (Federal Register, 8 December 2023).
A SIM swap cannot reach a seed that is only on paper or metal. It matters for exchange accounts, email and anything that resets by text message.
Pros
- App-based or security-key two-factor authentication removes SMS codes from the chain
- In the US, providers must offer SIM-change and port-out locks (FCC rules)
Cons
- Account locks add friction when you genuinely change phone
- Some services still fall back to SMS for account recovery
Pitfalls
- Using the same phone number for the exchange, email and bank recovery
- Publishing the number linked to your exchange account
Defences (official) and community advice
- Official: the FBI recommends authenticator apps, security tokens or biometrics over SMS (FBI); the NCSC advises 2-step verification on your email (NCSC)
- Official (UK): the Metropolitan Police advises calling your network provider immediately if you unexpectedly lose service or get an unexpected message about your SIM being ported or a PAC request, telling your banks, and asking your provider what protection it offers (Met Police: SIM swap fraud)
- Community advice: ask your provider what SIM-change protection it offers, and record the answer
Supply-chain tampering: checks for a new device Intermediate Expert
A tampered or counterfeit device can come with a known seed or modified firmware. Kaspersky documented a fake Trezor with altered hardware (Kaspersky). Trezor's own checklist is a good model of what to look for, even if you use another brand (Trezor: is my device safe to use?):
- Buy from the official shop, the maker's official Amazon storefront or a listed authorised reseller (Trezor resellers). Trezor says never to buy from an unauthorised third party, because you cannot tell who has had access to it.
- Check the box contents and tamper-evident holographic seal against the maker's pictures.
- Trezor devices ship without firmware. If firmware is already installed at setup, Trezor says the device should not be used.
- The bootloader checks the firmware signature each time it connects, and unofficial firmware shows a warning on screen.
- The wallet backup must be generated during setup on the device. A pre-printed recovery card in the box is always a scam.
Pros
- Buying direct removes most interception risk
- Firmware signature checks catch modified software
Cons
- Seals can be faked; they are one signal, not proof
- Marketplace "new" listings can be returns or resold devices
Pitfalls
- Using a device that arrived already set up or with a PIN
- Skipping the maker's genuineness check because the box "looked fine"
- Buying second-hand to save money
Community advice (labelled: experience shared by users, not official guidance)
- Community advice: photograph the seal and packaging on arrival before opening, in case you need to raise it with the maker
- Community advice: consider delivery to a collection point or work address for privacy (see coercion below)
Coercion and physical attacks
Physical "wrench attacks" — kidnap, home invasion, threats — are increasing and documented in Jameson Lopp's public list.
Related case files: Paris abductions of relatives (2025) and a US home-invasion crew that hacked email first.
- Privacy is the first defence: don't flaunt wealth; take care with data shared at purchase; consider delivery to a non-home address.
- Geographic separation and multisig/timelocks make "I can't move it right now" true.
- Decoy wallets and duress PINs can satisfy an attacker.
- Your safety comes first. Comply if threatened, then contact the police.
A real example: the Balland kidnapping (France, January 2025) Expert
Ledger co-founder David Balland and his partner were kidnapped from their home in central France on 21 January 2025. The kidnappers mutilated his hand and sent a ransom demand in cryptocurrency to another co-founder; part was paid during police-led negotiations and most was later seized and frozen. About 230 police and gendarmes took part; both were freed, and seven people were held on charges including gang-related kidnapping (RFI, Reuters). Jameson Lopp's public list records many similar attacks worldwide (physical attacks list).
Pros
- Multisig with keys in different places, or timelocks, means you genuinely cannot move everything on the spot
- Privacy (not posting holdings, careful delivery addresses) reduces the chance of being targeted
Cons
- Distributed set-ups are slower and harder for you, too
- Decoy or duress wallets only help if the decoy is believable, and they do not protect family members
Pitfalls
- Talking about holdings online or at meet-ups
- Keeping the device, PIN note and backup together at home
- Assuming a public role (founder, influencer) does not raise your risk; the Balland case shows it does
Community advice (labelled: experience shared by users, not official guidance)
- Community advice: your safety comes before your coins; give attackers what they ask and contact the police afterwards
- Community advice: tell trusted family how the set-up works in outline, so a threat to them is not met with "I don't know"
More sourced coercion cases, UK, US and France Expert
Each row comes from the linked case file and its sources. The Manhattan case is an allegation only, and the defendants have pleaded not guilty.
| Case | What happened | How targets were chosen or reached | Source |
|---|---|---|---|
| Greater Manchester, 2023 | A man was held, attacked and drugged repeatedly for crypto; seven men received sentences totalling more than 75 years in January 2025 | The attackers knew he held crypto and where he lived | BBC News |
| US home-invasion crew, 2022–2023 | SIM swaps and armed home invasions in three states took more than $3.5m; the leader was sentenced to 47 years | An email account was hacked first and the house watched for days | US Department of Justice |
| Paris, 2025 | A crypto entrepreneur's father was abducted and mutilated; an attempt on another family failed | Relatives, not the holders, were targeted | Reuters |
| Manhattan, 2025 (alleged) | Prosecutors allege a man was held for about 17 days over a bitcoin password | According to prosecutors, the people knew each other through crypto investing | Reuters |
| Defence | Helps because | Costs or limits |
|---|---|---|
| Privacy (no public holdings, separate delivery address) | Most cases above began with someone knowing who held crypto | Hard to undo once you have been public; data leaks are outside your control |
| Securing email and phone number | The St Felix crew used email access to pick and reach targets | Needs ongoing care (see SIM swaps) |
| Multisig with keys in other places, or timelocks | "I cannot move it all now" becomes true | Slower for you too; attackers may not believe it |
| Decoy wallet or duress PIN | Gives an attacker something to take | Only works if believable; does not protect relatives |
Your safety comes first in every case. Jameson Lopp's public list records many more incidents; we have not checked each entry.
If you think your seed was exposed
- Do not panic and do not contact "recovery" accounts that reach out to you.
- On a new hardware wallet, create a new seed and back it up offline.
- Send all funds from the exposed wallet to the new one immediately (on all chains and accounts).
- Revoke token approvals from the old address where relevant.
- Report fraud: UK — Report Fraud (England, Wales & NI; online or 0300 123 2040). It replaced Action Fraud on 4 December 2025, and old Action Fraud links now redirect to it (Report Fraud, 4 December 2025). In Scotland, call Police Scotland on 101. US — FBI IC3, and the FTC at ReportFraud.ftc.gov.
Other situations, such as a lost device, a missing backup, a forgotten PIN or a death in the family: see the quick answers.
Primary sources for this page
- FBI and IC3: 2025 Internet Crime Report (PDF) · FBI press release on the 2025 report · fraudulent investment apps (2022) · liquidity mining scam (2022) · fake recovery companies (2023) · fictitious law firms (2024) · guidance for victims (2023) · crypto investment fraud tips · FBI Denver: address poisoning
- FTC: What to know about cryptocurrency and scams
- UK: Report Fraud · FCA: recovery room scams · FCA: crypto investment scams
- Vendor advisories: Ledger: address poisoning · Trezor: address poisoning · MetaMask: address poisoning · Trezor: is my device safe? · Trezor resellers
- Incidents: fake Ledger Live app (BleepingComputer, 2023) · fake Trezor (Kaspersky) · Balland kidnapping (RFI) · Reuters · Lopp: physical attacks list
- Added 24 October 2026: Ledger CEO: data leak update · Ledger breach FAQ · Coinbase SEC filing (May 2025) · FBI: search-ad impersonation (2022) · Koi Security: FoxyWallet · Mozilla: crypto wallet scams · ESET: clipper on Google Play · MetaMask: token approvals · MetaMask: signature phishing · ERC-2612 · FBI: SIM swapping (2022) · FCC SIM-swap rules (Federal Register) · DOJ: home-invasion crew sentenced · BBC: Manchester kidnapping
Educational information only, not legal, financial or security advice. Checked 24 October 2026.
Last reviewed: · Educational information only — verify current details with official sources.