A seed phrase is never typed into anything

Your recovery phrase — twelve or twenty-four ordinary words — isn't a password for your wallet. It is the wallet. Every key and every address comes from it. Anyone who has those words has your funds, immediately, permanently, from anywhere in the world.

No second factor. No reset. No support line.

So the rule is simple. You type it into your own wallet software when you're restoring, and nowhere else, ever. Not a website. Not a form. Not a chat. Not a spreadsheet, a photo, a notes app, or an email to yourself.

The rule isn't the hard part. The exceptions are, because scammers supply them.

“Validate your wallet.” “Sync your wallet.” Neither is a real operation. “Migrate to the new version.” Updates never need your phrase. “Support needs it to look at your account.” No support team asks, and they say so themselves. “Enter it to claim your airdrop.” A claim needs an address, never a phrase.

And the one built for careful people: a screen that looks exactly like your hardware wallet, asking for the words. A hardware wallet asks for your phrase on the device itself, never on a computer screen. That's the entire point of the device.

Every one of those comes with a reason — urgent, plausible, technical-sounding. The reason is the tool. Hold the rule as absolute and you never have to judge the reason, which is the point: they're written by people who do this full time.

Aureus has no field for a recovery phrase anywhere in the product. That's not a policy we could quietly change — a test checks it every time our code is built. We mention it because “we'd never ask” is what a scam says too. The difference is whether anything enforces it.