My checklist is short: verify the domain, confirm the contract, read every wallet prompt, and never sign a message I do not understand. A calm minute is worth more than a rushed click.