> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fundwork.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Account Security Best Practices | Fundwork Trust & Safety

> Keep your Fundwork account secure. Protect your wallet, guard your private key, verify the site URL, and stay alert to phishing attempts.

Your Fundwork account is tied to your Base identity via Privy. That means your account security is ultimately as strong as the security of your wallet. There is no password reset email, no support ticket that can recover a compromised private key — protecting your credentials is your responsibility, and it starts with a few non-negotiable habits.

<Warning>
  **Phishing warning:** Fundwork will never ask for your private key, seed phrase, or wallet password — not through email, not through support chat, not through any other channel. If anyone claiming to be Fundwork asks for these credentials, it is a scam. Do not respond and report it immediately.
</Warning>

## Secure Your Wallet and .base.eth Identity

<Steps>
  <Step title="Use a hardware wallet or trusted wallet app">
    Store the private key controlling your .base.eth name in a hardware wallet (such as Ledger or Trezor) or a well-audited mobile wallet (such as Coinbase Wallet). Hardware wallets keep your key off internet-connected devices, which eliminates the largest class of remote compromise attacks.
  </Step>

  <Step title="Never share your private key or seed phrase">
    Your private key and seed phrase provide complete, irrevocable control over your wallet and everything associated with it. Write your seed phrase down on paper, store it in a physically secure location, and never enter it into any website, app, or form — including anything that appears to be Fundwork.
  </Step>

  <Step title="Verify you're on https://fundwork.app before signing">
    Before you connect your wallet or sign any transaction, confirm that your browser's address bar shows **[https://fundwork.app](https://fundwork.app)** exactly. Bookmark the real URL and navigate from your bookmark rather than search results or links in messages. One character of difference in a URL can send you to a phishing site built to steal your credentials.
  </Step>

  <Step title="Review every transaction before signing">
    Never approve a wallet transaction without reading what it does. Fundwork payments are in **USDC on Base** — if a signing request asks you to approve a different token, an unexpected amount, or interact with an unfamiliar contract address, reject it and contact support.
  </Step>

  <Step title="Keep your Privy session secure">
    Fundwork uses Privy to connect your Base identity to the platform. Sign out of your Privy session when you finish working, especially on shared or public devices. Do not grant Privy access to third-party apps you don't recognise.
  </Step>
</Steps>

## Recognise and Avoid Phishing

Phishing attacks targeting Base and crypto users are common. Attackers often impersonate platforms, project teams, and support staff to trick you into handing over credentials or signing malicious transactions.

<CardGroup cols={2}>
  <Card title="Fake support messages" icon="envelope-open">
    Be suspicious of unsolicited messages claiming to be from Fundwork support, especially those that create urgency ("your account will be suspended") or ask you to connect your wallet via a link.
  </Card>

  <Card title="Lookalike URLs" icon="link-slash">
    Attackers register domains that look nearly identical to the real one — for example, `fundw0rk.app` or `fundwork.io`. Always check the full URL carefully before connecting your wallet.
  </Card>

  <Card title="Malicious signing requests" icon="pen-nib">
    A phishing site may prompt you to sign a transaction that transfers your tokens or grants token approval to an attacker's contract. Read every signing prompt before approving.
  </Card>

  <Card title="Social engineering via DMs" icon="comment-slash">
    Attackers may contact you via Discord, Telegram, or X claiming to offer opportunities or support. Fundwork's official communications come through the platform and verified channels only.
  </Card>
</CardGroup>

## Additional Security Tips

<Tip>
  Use a dedicated wallet for your Fundwork identity rather than the same wallet you use for high-value holdings. This limits the blast radius if something goes wrong.
</Tip>

<Tip>
  Regularly review which apps and sites have approval to spend tokens from your wallet. Use a tool like Revoke.cash to audit and revoke unnecessary token approvals on Base.
</Tip>

<Tip>
  If you believe your account or wallet has been compromised, contact Fundwork support immediately and move your assets to a new, uncompromised wallet as quickly as possible.
</Tip>