Scammers will sometimes impersonate companies and people to trick you into revealing private information, such as passwords, credit card numbers, or other personal data. These attacks often happen through email, text messages, or fake websites that are designed to look real. These are called “phishing” attacks.

Knowing Figma’s official email addresses can help you if you’re communicating with legitimate Figma contacts and stay safe from these attacks.

Figma’s official email addresses

Figma will only contact you from email addresses that end in @figma.com, for example:

• support@figma.com
• invoices@figma.com
• events@figma.com
• announcements@figma.com
• abuse@figma.com
• privacy@figma.com

Figma will never ask you to share sensitive information—such as passwords, 2FA codes, full credit card details, CVV codes, or plugin API keys—via email, text, or any insecure channel. Figma will also never ask you to transfer a file, project, or account ownership to an unknown email or unfamiliar domain.

Figma may ask for share permissions to your file, team, or organization if you've requested troubleshooting support. These permission requests will only come from official Figma email addresses ending with @figma.com.

Tips for identifying phishing attempts

Protecting your online security starts with recognizing deceptive messages and phishing attempts. Here are some guidelines to help identify and avoid phishing attempts targeting your personal information:

• Stay alert: Be cautious of anyone asking for your personal, financial, or sensitive information.
• Be aware of urgent or threatening language: Messages that pressure you to act immediately under threat of account suspension or loss of access is a common phishing tactic.
• Confirm an email is coming from Figma: Check that the sender’s email address ends with @figma.com. Phishers often use email addresses that look similar to legitimate ones, but contain misspellings or extra characters.
• Hover over links before clicking: Hover your cursor over links to preview the actual URL destination. Make sure the URL belongs to an official site, like www.figma.com. Any requests for sensitive actions—like resetting your password or verifying identity—will always route through Figma’s official website.
• Maintain strong security practices: This includes regularly changing your password and enabling two-factor authentication. Learn more about keeping your account secure.

If you’re not sure if an email is legitimate or if you experience a Figma impersonation attempt, please reach out to our Support team.