Xaman Sign Requests: How to Read One Before You Sign

A Xaman sign request is a transaction that a website or app has prepared and sent to your Xaman wallet, and nothing happens on the XRP Ledger until you approve it. Before you sign, read three lines: the transaction type, the destination and the amount. If any of them looks wrong, or you didn’t start the request, reject it.

This matters because a scam sign request doesn’t need to hack the app. It only needs a yes. In February 2026, Xaman founder Wietse Wind warned on X about a coordinated scam campaign targeting XRP Ledger users, listing scam sign requests and scam NFT swap offers among the tactics, according to CryptoPotato’s report. If you haven’t set up Xaman yet, start with our Xaman wallet setup guide; this article covers one narrower skill, reading the sign screen.

What is a Xaman sign request?

A Xaman sign request is a draft transaction that a site or xApp (an app that runs inside Xaman) writes and sends to your phone for approval. The site can write the request, but it can’t sign it. The XRP Ledger docs say that to send transactions, an account owner “needs one or more cryptographic key pairs,” and those keys stay in your Xaman app.

Your signature is what turns the draft into a real transaction. The docs explain why that matters: anyone who knows an account’s secret has effectively full control over it. Your key never leaves your phone. What leaves is your signature on one specific transaction, and that signature is final. Xaman’s help center says “Once a transaction is signed and confirmed on the ledger, it is permanent.”

Which three lines should you read on a Xaman sign screen?

Read the type, the destination and the amount. Xaman’s help center says “Xaman shows you exactly what a transaction will do,” and names the same three things: “Look at the destination, the amount, the type.”

Line	What the XRP Ledger docs say	What to check
Type	“The type of transaction.”	Is this the action you meant, such as Payment or TrustSet?
Destination	“The account receiving the payment.”	The full address, at the start, the middle and the end
Amount	“The maximum amount of currency to deliver.”	The number and the currency together
SendMax (token or cross-currency payments)	The most you can be charged, which can be more than the Amount delivered	That you’re comfortable paying the full SendMax figure
Destination tag (payments)	Identifies “the reason for the payment to the destination, or a hosted recipient to pay.”	If paying an exchange, it matches the tag on your exchange account

Two addresses can share the same first and last few characters and still differ in the middle. That trick is called address poisoning, and our address poisoning article shows how costly a glance can be.

Which Xaman sign requests can change control of your account?

Some XRP Ledger transaction types move control, not money, so they can show no amount at all. These five deserve the most care:

Type	What the XRP Ledger docs say it does	Why it matters
SetRegularKey	“Assign, change, or remove the regular key pair associated with your account.”	A regular key “can do anything else the same as the master key pair,” with a few exceptions
SignerListSet	“Create, replace, or remove a list of signers that can be used to multi-sign a transaction.”	It can add other parties who can sign for you
AccountSet	“Modify the settings or properties of an account in the XRP Ledger.”	One setting will “Disallow use of the master key pair”
DelegateSet	“Delegate permissions to another account to send transactions on your behalf.”	It would let another account send some transaction types for you. As of mid-October 2026 the feature is not switched on: xrpl.org lists it as still open for validator voting
AccountDelete	Deletes an account and sends “the account’s remaining XRP to a specified destination account.”	It empties the whole account to the Destination, with no Amount line on the screen

Each of these has honest uses. Xaman’s help center describes rekeying as a way to keep the master key out of day-to-day use and sign with a regular key instead. The difference is who starts it. If you set a regular key yourself, inside Xaman, with a key you control, it can protect you. If a website asks you to set a key you don’t recognize, signing hands a stranger a second key to your account. For background on delegation, see our XRP Ledger permission delegation explainer.

How do you read common Xaman sign screens?

You read every screen the same way, but the line that matters most changes with the type. Four examples:

1. A Payment you started. Type says Payment. The destination matches the address you copied from your exchange, character by character, and so does the destination tag. The amount is what you chose. This is the kind you can sign, after reading it.
2. A TrustSet. The docs describe it as a way to “Create or modify a trust line linking two accounts.” Check the issuer address against the token issuer’s own website. If the request came from a link in an unsolicited memo, reject it. Xaman’s help center describes that pattern: “A small unsolicited transaction lands in your account with a link or instructions.”
3. An NFT offer. NFTokenAcceptOffer will “Accept an offer to buy or sell a non-fungible token (NFT).” Ask what you are giving and what you are getting. If you didn’t make the offer, reject it.
4. A SetRegularKey with no amount. Nothing looks expensive, which is why the type line matters. If you didn’t plan to change your keys, reject it.

When should you reject a Xaman sign request?

Reject any request you didn’t start, any type you didn’t expect, and anything you can’t explain. Xaman’s spam guidance says “It is very important that you never sign a transaction you did not start yourself,” and its safety guide adds “If anything is unclear, do not approve.”

Run this decision tree in a few seconds:

1. Did I start this? If no, reject. Done.
2. Is the type the one I expected? Anything that changes keys, signers or settings, when you didn’t plan it, is a no.
3. Do the destination and the amount match what I meant? Only then sign.

Worked example: a link in a message says a bonus is waiting and sends a request to your app. A link started it, not you, so question one says reject. If you somehow said yes, question two catches it: a bonus never needs a SetRegularKey.

Look-alike websites are part of the same scam. Xaman warns of “a site that looks identical to a real one, sometimes with a single letter changed in the URL,” and advises: “Bookmark the real ones.”

What if you already signed something bad in Xaman?

Go to support inside the app, not to an account that contacts you. Xaman’s help center says “The only official Xaman support is the Xaman Support xApp, inside the Xaman app,” and to “Tap xApps at the bottom of the screen, then Xaman Support.”

If Xaman warns that your account is present on another device and you didn’t import it there yourself, its help center says to act at once: “Move your funds out of your XRPL account immediately!” Our wallet drainers explainer covers how these scams usually unfold.

Xaman sign request checklist

• Did I start this request myself?
• Is the type what I expected?
• Does the destination match at the start, the middle and the end?
• Are the amount and the currency what I meant?
• Does it touch my keys, signers or account settings, and did I plan that?
• For payments to an exchange: does the destination tag match my account?

What to check next

Xaman adds warnings and filters over time, but as CryptoPotato reported, Wietse Wind’s message to users was that no scammer can get you if you don’t interact with them. Open Xaman’s help center at help.xaman.app to see the current screens, since labels may differ in the version you have. Then think of the last request you signed and ask whether you could name its type. If not, start reading that line first.

Sources

• Xaman Help Center: Self-Custody 101, Staying Safe with Xaman
• Xaman Help Center: Spam on the XRP Ledger
• XRP Ledger docs: Cryptographic Keys
• XRP Ledger docs: Payment transaction
• XRP Ledger docs: SetRegularKey transaction
• Xaman Help Center: How to rekey your account
• Xaman Help Center: Account present on another device
• XRP Ledger docs: AccountDelete transaction
• XRP Ledger docs: Accounts