> For the complete documentation index, see [llms.txt](https://help.xaman.app/app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.xaman.app/app/xaman-tangem-cards/best-security-practices-using-a-xaman-card.md). # Best security practices for the Xaman cards How we recommend using the cards Your Xaman cards keep your account secret on a secure chip. It never leaves the card, it never touches your phone, and Xaman never sees it. That makes your cards one of the safest ways to protect your XRP and XAH. The habits below help you get the most out of that protection. #### Always set up a Backup card This is the most important thing you can do on this list. Your account secret exists in only one place: on the card. If your only card is lost, damaged, or stolen, there is no way to recover the account. That is why every order includes at least two cards. Link your second card to your Primary account as a Backup card, so you can still reach your funds if something happens to one of them. The setup takes a few minutes, and the [Tangem Backup xApp](https://xaman.app/detect/xapp:xumm.tangem-backup) walks you through it. * [Getting started with your new cards](https://help.xaman.app/app/xaman-tangem-cards/getting-started) * [Lost or damaged cards](https://help.xaman.app/app/xaman-tangem-cards/lost-or-damaged-cards) Also write down your Primary account's r-address and keep it somewhere safe. If you ever lose your phone and your Primary card at the same time, you will need it to get back into your account with your Backup card. #### Keep your cards physically safe Anyone who holds one of your cards can use it to sign transactions on your account. Treat your cards the way you treat cash or house keys. * Store your Primary card somewhere secure, such as a safe, a safe deposit box, or a locked drawer. * Keep your Primary and Backup cards in **different places**, so a single event (a fire, a flood, or a break-in) cannot take both. * Do not lend your cards to anyone. * Keep your cards where they will not get bent, cracked, or chewed by a curious pet. {% hint style="info" %} **Have an older card with a PIN?** Earlier Xaman cards let you set a PIN. If you set one, keep it somewhere safe. If you forget it, you can lose access to the account on that card. New cards do not use PINs. {% endhint %} #### Only sign in private, trusted places Use your cards at home or somewhere else private and secure. Avoid signing transactions in busy public places, such as grocery stores, malls, or crowded streets, where someone could watch your screen or grab your card. If you make a lot of transactions on the go, consider keeping a separate everyday account in Xaman with a small amount of funds for daily use. Keep most of your funds on your card account. When your everyday account runs low, top it up from your card account when you are back home. #### Only use your cards with a trusted phone Only add your cards to a phone you trust and control. Make sure: * your phone has the latest security and operating system updates * your phone is protected by a strong passcode * your phone is not rooted or jailbroken * you only install apps from the [App Store](https://apps.apple.com/app/id1492302343) or [Google Play](https://play.google.com/store/apps/details?id=com.xrpllabs.xumm), never "cracked" apps from other websites * you review your installed apps from time to time and remove the ones you do not use #### Avoid public Wi-Fi Public Wi-Fi networks can expose you to network snooping, fake hotspots, and other attacks. When you use Xaman or your cards, use your mobile data connection or a Wi-Fi network you trust, such as your home network. #### Never sign a transaction you do not understand Your card protects your account secret, but it cannot protect you from approving a harmful transaction. Before you tap your card to sign, read what the transaction does. Be especially careful with transactions that change who controls your account, such as **Set Regular Key** or **Account Delete**. Scammers sometimes trick people into signing a Set Regular Key transaction that gives the scammer's account the power to sign for theirs. Only sign these transactions when you started them yourself, for example when you link your own Backup card. {% hint style="danger" %} **Xaman will never contact you first.** The only official support is the [Xaman Support xApp](https://xaman.app/detect/xapp:xumm.support-md) inside Xaman. We will never send you a direct message, and no one from Xaman will ever ask you to tap your card or sign a transaction to "verify" or "fix" your account. Support may ask for your r-address to look into a problem. That is safe to share: your r-address is public, just like an email address. It cannot be used to sign for your account. {% endhint %} #### Consider spreading your funds across accounts Some people keep separate accounts for different activities, for example: * long-term savings * daily spending * DEX trading * NFTs * airdrops * games Spreading your funds this way means that if someone ever gained access to one account, they would not get access to **all** of your funds. Some people even use several card accounts, each with its own Backup card, and divide their savings between them. Even the most secure basket in the world still holds all of your eggs in one place. #### Only buy cards directly from Xaman Only buy Xaman cards from the official store at [order.xaman.app](https://order.xaman.app/). Do not buy cards second-hand, from online marketplaces, or from other sellers. A card from anyone else could have been used before. To protect you, Xaman checks every new card the first time you tap it, to confirm the card is genuine and has never been used. If the app warns you that a card was used before, **stop**. Do not import that card, and contact us through the [Xaman Support xApp](https://xaman.app/detect/xapp:xumm.support-md). (If you are re-importing one of your own cards, for example on a new phone, this warning is expected.) A new Xaman card never comes with an account already set up, a recovery phrase, or a PIN. If a card arrives with any of these, or with instructions telling you to use one, do not use it. #### Questions? If you have questions about keeping your cards secure, contact us through the [Xaman Support xApp](https://xaman.app/detect/xapp:xumm.support-md) in Xaman. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.xaman.app/app/xaman-tangem-cards/best-security-practices-using-a-xaman-card.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.