Fake Trezor letters demand an "Authentication Check" and the recovery phrase

In February 2026 security researcher Dmitry Smilyanets shared on X a paper letter, printed on letterhead impersonating Trezor, that he said he received on 13 February. According to BleepingComputer and Cointelegraph, the letter claimed an “Authentication Check” would soon become mandatory, set a deadline of 15 February 2026 under threat of restricted device functionality, and asked the recipient to scan a QR code. Cointelegraph reports the letter carried a hologram and appeared to be signed by Matěj Žák, wrongly titled “Ledger CEO”; Žák is Trezor’s CEO.

BleepingComputer reports that the QR code led to trezor.authentication-check[.]io, which told visitors setup was required unless they had bought a newer Trezor Safe model after 30 November 2025, warned of blocked access and signing errors, and finally asked for a 12-, 20- or 24-word recovery phrase to verify device ownership. Entered phrases were sent to a backend endpoint on the same domain, letting the attackers import the wallet and take its funds. At the time of writing the site was still online but flagged by Cloudflare as phishing.

Both outlets describe a matching letter aimed at Ledger owners, which demanded a “Transaction Check” and was reported in October 2025, and earlier postal campaigns against Ledger users. Neither article reports a Trezor statement, how recipients were selected, or the number of letters sent.