imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.
imtoken · Security Guide

Wallet Security Center

Wallet Security Center connects seed phrases, private keys, approval security, and phishing detection into a practical workflow for understanding, acting, verifying on-chain results, and reviewing security.

Illustration about offline private key protection
Core principleYour seed phrase and private key stay under your control. Official personnel will not ask you to send them.
On this page
  1. Core protection principles for seed phrases
  2. Recognize risks involving private keys and approval security
  3. What to check before accepting phishing detection
  4. What to do when device security looks suspicious
  5. A long-term checklist for transaction checks

Core protection principles for seed phrases

When learning Wallet Security Center, begin with seed phrases, then see how private keys and approval security affect the result. seed phrases describes one important object in this topic, while private keys and approval security help define the environment and the state you need to observe. Familiar labels are not enough: the same token name, address format, or feature entry can lead to different results across networks and contract contexts.

Keep phishing detection, device security, and transaction checks in the same context. Start from the task, then separate information that can be public from credentials or permissions that can change on-chain state. This prevents “I can see it” from becoming “I approved it,” and prevents “I submitted it” from being mistaken for “it is confirmed.”

Recognize risks involving private keys and approval security

To decide whether Wallet Security Center worked as expected, do not rely on an interface message alone; understand how private keys, approval security, and phishing detection relate. A reliable sequence is to verify private keys, check approval security, and then read the specific fields related to phishing detection. When device security is involved, determine whether the action only displays information, creates a connection, requests a signature, or actually submits an on-chain transaction. Those outcomes are not interchangeable.

If the task also involves transaction checks or seed phrases, map the destination address, network, allowance, fee, or contract target to the action before submitting. Afterwards, verify the result through a transaction hash, block explorer, permission record, or wallet history. With Wallet Security Center, being able to explain each step is more reliable than simply seeing a success message.

What to check before accepting phishing detection

A useful starting point for Wallet Security Center is to ask what approval security, phishing detection, and device security each mean in the workflow. Prefer information that can be independently checked on-chain. approval security, phishing detection, and device security often describe the object, environment, and state, while transaction checks and seed phrases can explain fees, confirmation progress, or permissions. Interface caches, node delay, and congestion can temporarily make the displayed state differ from the network state.

Do not immediately resend or approve again. Confirm the network first, then check whether a record related to private keys already exists. If you have a transaction hash, continue the investigation around that record. Repeating an action can add fees, change nonce ordering, or create extra permissions that make the original issue harder to diagnose.

What to do when device security looks suspicious

Before using Wallet Security Center, separate the roles of phishing detection, device security, and transaction checks; that is more durable than memorizing interface positions. Common mistakes include trusting a name without checking phishing detection, trusting an icon without verifying device security, or assuming that seeing transaction checks makes later requests acceptable. When seed phrases and private keys appear, distinguish a connection, signature, approval, transfer, and contract call by what each one can actually change.

Third-party DApps, smart contracts, bridges, and service interfaces can introduce technical or operational risk. A normal imtoken workflow does not ask you to enter a seed phrase, private key, recovery phrase, or verification code into a website. For on-chain permissions, verify the spender, scope, and purpose; for transfers, verify the address, network, and amount. If approval security does not match what you expected, stop new requests, keep the transaction or permission evidence, and review the network, address, contract, and request source before continuing.

A long-term checklist for transaction checks

With Wallet Security Center, device security, transaction checks, and seed phrases often appear together, but they answer different questions. Turn the workflow into three phases: before submission, verify device security and transaction checks; during submission, read seed phrases and private keys; afterwards, confirm the outcome through approval security and phishing detection. The same routine remains useful when you change devices, networks, or DApps.

For Wallet Security Center, the durable evidence is not where a button appears. It is whether the address is correct, the network matches, the signature can be explained, the spender and allowance make sense, and the transaction has an on-chain record. If one step cannot be explained, stop and re-check the source and purpose.

  • Confirm seed phrases matches the task
  • Cross-check private keys and approval security
  • Read fields related to phishing detection before submitting
  • Verify the outcome through device security or an on-chain record
  • Review and maintain transaction checks when it is no longer needed
  • Never send a seed phrase, private key, or verification code to anyone

Nine wallet security checks

  • Keep seed phrases and private keys under your control
  • Official personnel will not ask for a seed phrase, private key, or verification code
  • Never send recovery information or verification codes to anyone
  • Verify address, network, and amount before transferring
  • Confirmed on-chain transactions usually cannot be reversed unilaterally by a wallet
  • Third-party DApps and smart contracts can introduce risk
  • Review the spender and permission scope before approving
  • Review permissions you no longer use and revoke them when appropriate
  • Use extra caution on shared devices and public networks