Trezor phishing emails: the sender looked right. The request wasn’t.

What did Trezor confirm?

In its September 10 notice, Trezor said about 347,000 newsletter addresses were affected. The message claimed a security vulnerability and linked to a download. Trezor suspended the provider account and warned that the addresses might be reused for phishing. It could not confirm whether the list had been exported. Read Trezor’s incident notice.

Why “check the sender” is only the beginning

A familiar sender is one clue. It cannot carry the entire security decision. The next question is what the message asks you to do. Does it turn a supposed emergency into a request for a secret? Does it move you from an app you know into a download you have never used?

Think of this as two doors. The first door is the communication channel: where the message arrived. The second is the authority to take an action: whether the request makes sense and has been independently verified. Getting through the first door should not automatically open the second.

A checklist for the next security email

1. Stop before installing anything. An unexpected warning should trigger verification, not an automatic download.
2. Open the official app or site independently. Look for a matching notice there. The FTC recommends using a known contact route to verify suspicious messages. FTC guidance.
3. Keep your backup out of emailed forms. Trezor says it will never contact you asking for that backup.
4. If you entered it, use the official response instructions immediately. Trezor directs affected users to move funds to a new wallet. Follow the guidance linked from its incident notice, not a helper arriving in your DMs.

What should readers distinguish?

Is an email-provider incident the same as a hardware-wallet exploit?

No. These are different failure points. A newsletter, a device, and a wallet backup should not be treated as interchangeable just because the same company name appears beside them.

Does reading this story tell me whether my wallet is compromised?

No. Your own actions matter. Write down whether you only received a message, followed it, installed something, or entered sensitive information. Those are different situations to explain to official support.

What is the useful long-term habit?

Decide how you will verify an emergency before an emergency arrives. Bookmark the support route, know where official notices appear, and treat surprise urgency as a reason to slow down.

Next: nine checks before trusting a website, and why knowing your details does not authenticate a caller.