A wallet safety checklist you can actually follow

Security advice is only useful when it fits into a real routine. You should not need to memorize a page of jargon every time you open an app. Build a few checks into the moments where a mistake would matter most.

A checklist can’t inspect your device or verify an address for you, but it can help you slow down at the moments that matter.

Before installing or signing in

Begin from a known official destination. Check the domain and the store page reached through it. Avoid entering credentials after following an unexpected message or a search ad that merely looks familiar.

Secure your device and the email or social account used for sign-in. Use the security controls available for those accounts and keep recovery options current. Do not assume that every wallet or payment account supports the same authentication features.

Before creating a wallet backup

Understand the exact account and wallet type before you create or fund it. Jupiter Mobile’s current wallet guide says Quick Accounts have no recovery phrase; their private key can be exported only through the Jupiter website using the same social login. If you lose access to that login, Jupiter says it cannot recover the key for you. Recovery-phrase wallets use a separate offline-backup process. Read the current instructions for the account option shown in the official app, and stop to contact support through that app if its steps differ. Mobile security model · Wallet and recovery instructions

Keep recovery information private and away from ordinary chat messages or shared photo libraries.

If you lose access, use the legitimate provider’s documented recovery path. Nobody in a public community should need your recovery phrase, private key, or one-time login code to help you understand instructions.

Before sending any funds

Reopen the destination’s receiving screen. Match the asset, network, full address, any required reference, and the amount expected to arrive. Read the final confirmation screen rather than approving it from habit.

Do not take a destination from a stranger’s message or an unexplained transaction in your history. If details change, verify them through a channel independent of the message containing the change.

For a new route, consider a modest valid test amount. Check minimums and fees first, wait for the expected credit, and remember that a successful small transfer does not guarantee a larger one.

Before connecting to any website

Ask why the site needs a wallet connection or signature. Reading a guide, searching a glossary, or comparing transfer quotes does not require either. This site has no wallet connector and never asks you to approve a transaction.

If a website unexpectedly changes from explaining a fee to asking for a signature, stop and investigate. Do not treat a polished design, a familiar logo, or a favorable quote as proof that a request is appropriate.

When someone offers urgent help

Pause. A person claiming that you must immediately pay a fee, verify a wallet, or reveal a code to stop a loss deserves independent verification. Reach support from the original app or official site, not the link in the message. The FTC describes cryptocurrency scam patterns, including impersonation and demands for crypto payments. Consumer scam guidance

Keep the conversation and transaction references as evidence without publicly exposing account details. Avoid sending more money to a supposed recovery service before understanding who they are and what they can actually do.

When a card or payment account is involved

Wallet security and card management are different tasks. For suspected unauthorized Jupiter card activity, the documentation describes freezing the card in-app and contacting support. That is not the same as changing a wallet backup or moving tokens to another network. Card response steps

Know which service owns the problem. A pending bank payout, an unauthorized card purchase, and a token sent to the wrong address have different investigation paths.

Make the routine repeatable

Try the short safety practice to rehearse spotting the decision points.

Mistakes happen. The rule that matters most: don’t let urgency talk you out of a check you know you should make.

Common mistakes people can avoid

New users often make the same preventable mistakes when they are rushing. Treat the examples below as reasons to pause, not as a test of whether someone is “good at crypto.”

• Sending the right-looking token over the wrong network. A matching ticker does not prove the receiving service can credit the transfer. Match the exact asset, network and full destination shown by the recipient. An incompatible crypto transfer may be difficult or impossible to recover. Spend deposit instructions
• Sending SOL to a Spend crypto deposit address. SOL pays Solana transaction fees, but Jupiter Spend does not list SOL as an accepted deposit asset. The wallet-fee token and the receiving service's deposit assets serve different purposes. Solana fees · Spend funding instructions
• Checking whether a deposit arrives but forgetting how money must leave. Deposit compatibility does not guarantee a useful withdrawal route. For example, Jupiter documents that USDT-funded deposits cannot be withdrawn to fiat. Check the current exit before choosing what to send. Remittance limitations
• Treating a stablecoin as a guaranteed dollar or bank balance. A price target does not remove issuer, access, conversion, partner or withdrawal risks. Compare the real route and amount you can use. USDC information · Spend risks
• Trusting a search ad, lookalike domain or unexpected “support” message. Start from a known official address or the app you opened yourself. Do not use the urgent helper's contact details to check whether that helper is genuine. Official Support Hub · FTC scam guidance
• Sharing recovery information to fix an account or deposit. A recovery phrase, private key and one-time login code can give someone access. A public receiving address is different. Follow official instructions for the exact account or wallet type you use. Solana wallet basics · Wallet security
• Treating a Quick Account like a recovery-phrase wallet. Jupiter says Quick Accounts have no recovery phrase and rely on the same social login to export the private key from its website. Understand that recovery route before adding funds. Wallet and recovery instructions
• Assuming on-chain confirmation means Spend or a bank credited the money. Blockchain confirmation, service balance credit and final bank delivery are separate statuses. Check the destination service and original reference. Spend FAQ
• Sending again while the first attempt is pending. A pending screen does not prove the transfer failed. Check the status with the original reference and use official support guidance before deciding what to do next. Spend FAQ
• Approving a transaction without understanding it because the app looks familiar. Read what will be signed, who receives funds and what permission is being requested. A logo or wallet connection does not explain a transaction. Solana safety guide

If you are unsure, stop before confirming. Reopen the destination instructions yourself, compare every field and ask official support through a channel you reached independently. Never pay a stranger or disclose a secret to “unlock” or reverse a transfer.

For a step-by-step routine, start with Part 1 of the wallet-safety series: pause, check, then click.