How to avoid scams is by experience. By knowing about it. Look here for a start.
I don’t believe it when people said that “common sense” and/or “following the rules” are the ways to avoid scams. The passphrase stealing trick you described has got into quite a few people here and some have lost thousands. They can still be scammed even if they have ‘common sense’ and ‘followed the rules’. They got scammed because they didn’t know, and maybe because they didn’t have enough precautions by using the same environment for work and for opening their wallets. Quite tricky isn’t it?
The system can/should actually do something to protect its users from getting scammed repeatedly. But forget it, it’s Upwork.
ps: took too long to write, didn’t realize that Clark had already posted 😁