Never type the seed on a computer
Recovery should happen on the device, guided by Suite. Keyloggers and clipboard sniffers cannot capture what is never entered on the host. Your device’s screen and buttons exist to keep secrets off the computer.
Verify addresses on the device
Whether receiving or sending, the address displayed on your Trezor is authoritative. If it does not match your computer, stop and investigate. This single check eliminates a wide class of phishing and malware attacks.
Keep firmware and Suite updated
Updates contain security improvements and UX refinements. Apply them from the official sites only, and read prompts carefully. Do not rush dialogs; attackers rely on hurried clicks.
Segment funds and accounts
Use separate accounts for daily spending, savings, and testing. Hidden wallets (with passphrase) can provide additional privacy and plausible deniability when used correctly.
Protect physical access
Device security resists theft, but physical access plus time favors the attacker. Store your device out of sight, enable auto‑lock, and never leave it unattended while unlocked.
Defend against social engineering
No support agent will ever ask for your recovery seed, PIN, or passphrase. Urgent emails or pop‑ups claiming account compromise are classic lures—close the window, open your own bookmark, and verify through official channels.