MetaMask Scam Emails: How to Spot Them and Protect Your Wallet

You open your inbox and find an email that seems to come from MetaMask. The logo is right, the layout is clean and the message is urgent: verify your wallet, avoid a suspension, or confirm your Secret Recovery Phrase for a security update. It looks real because it was made to. It’s a phishing email, and the page behind its button is built to take control of your wallet.

You may have read that MetaMask never sends emails. That’s too broad. MetaMask can email you about a support ticket you opened, and it sends newsletters and MetaMask Card updates to people who signed up for them. What it never does is start the conversation. It doesn’t send unsolicited emails, it never asks by email for your Secret Recovery Phrase, your password or your Google or Apple account details, and it never asks you to verify, upgrade or restore your wallet. An email that does any of those things is a scam, however genuine it looks.

Why MetaMask scam emails work

MetaMask makes an obvious target. It describes itself as the most widely used self-custodial wallet, with more than 100 million downloads, so a fake MetaMask email sent to a large list reaches many real users.

Many of those users know exchange accounts better than wallets. A custodial exchange holds your coins for you, so it has your email address, can freeze your account and sends account emails. A self-custodial wallet, also called a non-custodial wallet, keeps the keys with you. Your accounts live on the blockchain rather than with MetaMask, so there is nothing for MetaMask to suspend or verify. Scammers count on people not knowing that difference.

The emails also work on emotion. A deadline such as “your wallet will be locked in 24 hours” pushes you to act before you think. A notice about “suspicious activity” makes clicking feel responsible, and a request to “update your security” sounds sensible rather than suspicious. Each one keeps you from asking the question that ends the scam: did I ever give MetaMask this email address, and for what?

What MetaMask scam emails look like

Phishing emails aimed at MetaMask users reuse a handful of templates, and MetaMask’s help center warns about the same pretexts. Recognizing the template is the best defense.

The “verify your wallet” email

This variant says MetaMask needs you to verify your wallet to keep using it. A button such as “Verify Now” or “Confirm Wallet” leads to a fake MetaMask website that asks for your Secret Recovery Phrase, the seed phrase that backs up your wallet. The moment you type it in, the scammer controls every account derived from that phrase and can drain each one. MetaMask states that it never asks you to verify your account.

A newer version asks you to “upgrade” to a smart account. MetaMask does show prompts to switch an account to a smart account, but only inside the extension or the mobile app. An email or a website pushing that upgrade is not MetaMask.

The “security alert” email

This version warns that unauthorized activity was detected on your wallet, or that the wallet is restricted, locked or suspended, and urges you to secure it through a link. The link leads to a cloned MetaMask page that captures whatever you type. If an email quotes real transaction details, that proves nothing: anyone can read the transactions of any address on a public block explorer.

The “KYC requirement” email

This one claims that new regulations force MetaMask to check your identity (KYC, short for “know your customer”). You’re asked to upload documents and connect your wallet on an outside site. MetaMask has no KYC process of its own. Identity checks can come up when you buy crypto inside MetaMask or apply for MetaMask Card. Those checks belong to that purchase or card application and run through the provider involved, so check whether a message relates to a service you actually requested. No identity check, real or fake, is a reason to disclose your recovery phrase or private key.

The “airdrop or reward” email

This one promises free tokens, a retroactive airdrop or a reward for loyal MetaMask users, if you connect your wallet on a linked website. MetaMask doesn’t give away assets: no tokens, NFTs, airdrops or random giveaways. The claim page either asks for your recovery phrase or asks you to sign a token approval, which gives the site permission to take your tokens rather than send you any. That approval is recorded on the blockchain, so it keeps working after you close the site until you revoke it.

The fake support reply

Some scams target people who really did contact MetaMask. MetaMask warns that scammers have approached users with open tickets and asked for their Secret Recovery Phrase. Genuine ticket emails come only from support@metamask.io, only about a case you opened through the chat on the help center, and never ask for your phrase. MetaMask Support doesn’t contact you first, has no phone number, and won’t reach you through WhatsApp, Telegram, Instagram, text messages or direct messages on X.

How to identify a fake MetaMask email

If you didn’t open a support ticket, join the Community forum or sign up for MetaMask emails, an email that claims to come from MetaMask is fake, however professional it looks. If you did, these checks separate the real thing from a copy.

Compare the sender with MetaMask’s official addresses

MetaMask lists six addresses it sends email from. Click or hover over the sender’s name to see the full address, because anyone can set a display name such as “MetaMask Support”.

Phishing emails usually come from lookalike addresses: a domain that adds a word such as “support” or “security” to the brand name, a different ending such as .team instead of .io, or a long domain that merely starts with metamask.io (metamask.io.example.net belongs to example.net, not to MetaMask). A matching address is a good sign, but on its own it doesn’t prove an email is genuine. What the message asks you to do settles it.

Check where a link leads, then don’t use it

Hover over a link before you click. Most email clients then show the real destination at the bottom of the window or in a tooltip. If it points somewhere other than metamask.io or one of its subdomains, such as support.metamask.io, be suspicious. A link that looks right can still mislead, because some mail apps don’t show the real target. Genuine MetaMask emails can contain links, for example to confirm a new Community account, but you never need one to manage your wallet.

So confirm the request through a separate route. Type support.metamask.io into your browser or use a bookmark, and check the request against your existing support case or the service you used. If it doesn’t match, or you’re unsure, start a chat through the Contact Support button on the help center home page and ask whether the email is genuine.

Watch for pressure and impossible threats

Legitimate services rarely set 24-hour deadlines or threaten suspension by email. In MetaMask’s case the threat is also empty: your accounts exist on a public blockchain, not on MetaMask’s servers, and MetaMask states that they can’t be deleted or restricted. Time pressure around your wallet is a warning sign by default.

Is MetaMask itself a scam?

No. MetaMask is a legitimate self-custodial wallet that has been in use since 2016. It’s made by Consensys Software Inc., which now does business as MetaMask, and the source code of the browser extension is public on GitHub. The scams don’t come from MetaMask. They come from criminals who impersonate MetaMask to reach its users.

That distinction matters most when you install it. MetaMask exists only as a browser extension and a mobile app, and the company tells you to get it only through the Install button on metamask.io/download or from your browser’s or phone’s official store. A copy from anywhere else may be built to steal the phrase you enter. And no wallet, however well made, can stop you from typing your recovery phrase into a fake website.

What to do if you clicked a phishing link

The next step depends on what happened after the click. Opening a page, approving a transaction and typing your phrase call for different responses.

You only read the email or opened the page

That alone doesn’t expose your keys. The danger is what you type or approve on the page, which is often built to collect your Secret Recovery Phrase. If you entered nothing and approved nothing, your wallet is most likely fine. Close the page. If you downloaded a file, don’t open it, and scan the computer for malware. Note what happened and when, and watch your account activity for the next few days.

You connected your wallet or approved a transaction

A connection is not the same as permission to spend tokens. Connecting lets a site see your public address and balances and propose transactions for you to confirm. A token approval goes further: it lets a smart contract move a specific token out of your wallet, often in unlimited amounts, until you revoke it. A malicious site can use it to drain those tokens without ever knowing your phrase.

Review what you signed and which approvals are still active. Disconnecting a site doesn’t revoke an approval. Revoking is a separate blockchain transaction that costs a network fee (gas), and it can’t undo transfers that already happened. MetaMask’s guide to revoking token approvals points to the approval checkers on block explorers such as Etherscan and to tools such as Revoke.cash. Reach them through that guide or by typing the address yourself, never through a “revoke” link in the suspicious message.

You already entered your recovery phrase on a suspicious site

Assume the phrase and every account it controls are compromised. Changing the local MetaMask password won’t help, because whoever holds the phrase can restore the wallet on their own device. A private key you typed in exposes its account in the same way. Don’t add funds to the affected accounts. MetaMask’s steps for a compromised wallet come down to this:

1. Install MetaMask in another browser or browser profile, or on a second mobile device.
2. Create a new wallet there with a new Secret Recovery Phrase. If the old wallet used a Google or Apple account, don’t connect that same account to the new wallet.
3. Write the new phrase down in the correct order and store it offline.
4. Send whatever remains in the old wallet to the new one.
5. Stop using the old wallet and every account tied to the compromised phrase.

Speed matters, but you can’t outrun a script. Some attackers run sweeper bots that move incoming funds out of a compromised address almost instantly, so don’t send ETH into the old wallet to pay for gas if you suspect one; the bot will take it too. MetaMask’s sweeper bot guide covers that case, and our MetaMask wallet recovery guide explains what to do after a compromise.

You typed your password or your Google or Apple login

The risk depends on how you set up MetaMask. If you created the wallet with a Secret Recovery Phrase only, the password unlocks MetaMask on your own device and doesn’t give anyone access to your accounts by itself. Change it anyway. If you created the wallet with a Google or Apple account, that account together with your MetaMask password opens all your accounts. If a fake page captured both, follow the compromised-wallet steps above and secure the Google or Apple account too.

Report the email and any theft

Report a phishing email to MetaMask through the Contact Support chat on the help center, with the sender’s address and the link it used, then mark it as phishing in your mail app and delete it. If you lost funds, MetaMask’s guide on how to report a scam explains how to flag the scammer’s address on Etherscan and which cybercrime authorities to contact; in the United States, that’s the FBI’s IC3. Describe what was disclosed, but never include the phrase or key itself.

Crypto Recovers doesn’t take stolen-crypto or scam cases. A confirmed blockchain transaction can’t be reversed, and the FBI warns that anyone who claims they can recover your funds after a scam may be running another one; our guide to telling legitimate recovery companies from fake ones shows how those offers work. Crypto Recovers restores access for rightful owners who are locked out, for example after a forgotten MetaMask password, and never holds or moves clients’ funds. If that’s your situation, see MetaMask wallet recovery.

How to protect yourself going forward

The most effective protection is also the simplest: never enter your seed phrase anywhere online, whether in an email form, on a website, in a chat window or in a pop-up. MetaMask names only two legitimate moments to type it: when you create a wallet and confirm that you wrote it down, and when you restore the wallet or reset its password in the official extension or app. Anything else is likely a scam.

The rest is habit:

• Let MetaMask update through your browser or app store. A real update never asks you to verify or restore your wallet through an email.
• Bookmark metamask.io and support.metamask.io, and open them from the bookmarks rather than from search results, ads or links. Scammers buy ads that sit above the real result, as our article on crypto scam warning signs shows.
• Keep your Secret Recovery Phrase offline, written on paper or stamped in metal, in a secure place only you can reach. MetaMask advises against cloud storage and password managers for the phrase.
• Use a hardware wallet for significant holdings. MetaMask recommends one for high-value accounts, because the keys stay offline and every transaction needs the physical device.
• If you set up MetaMask with a Google or Apple account, give that account a unique password that differs from your MetaMask password.
• Check your token approvals regularly. MetaMask suggests a habit such as once a month.
• Assume that any unsolicited message about your crypto, by email, direct message, phone call or social media comment, is a scam until you’ve checked it through MetaMask’s own channels.

Official documentation

• Is this email really from MetaMask?
• MetaMask’s official support channels
• How to revoke smart contract allowances/token approvals
• I’ve been hacked or scammed (unauthorized transactions on my account)

FAQ: MetaMask scam emails

Does MetaMask send emails?

Yes, but only in a few situations and never unsolicited. MetaMask emails you about a support ticket you opened, about Community forum activity if you joined, and with newsletters or MetaMask Card updates you signed up for. It never emails you to ask for your Secret Recovery Phrase, your password or your Google or Apple account details, and never to verify your wallet. Any other email that claims to be from MetaMask is phishing.

What should I do if I get a MetaMask email?

Don’t click its links, don’t open attachments and don’t reply. Compare the sender with MetaMask’s official addresses. If you didn’t open a ticket or subscribe to anything, mark the email as phishing and delete it. If you’re unsure, type support.metamask.io into your browser and ask through the Contact Support chat.

Can scammers access my MetaMask without my seed phrase?

They can’t take over the whole wallet without it, unless the wallet was set up with Google or Apple and they have that account together with your MetaMask password. A private key you gave away exposes the account it belongs to. Token approvals are the exception to watch: a malicious contract you approve can move the approved tokens without your phrase. Malware can also steal a phrase stored on your computer. Revoke approvals you don’t recognize, and keep the phrase off internet-connected devices.

I gave my seed phrase to a scammer. Can I get my funds back?

MetaMask cannot reverse a confirmed transaction or restore stolen funds. Reporting the theft may help authorities or the receiving exchange act, but it does not guarantee that funds will be returned. Crypto Recovers doesn’t take stolen-crypto or scam cases either. Move anything still in the wallet to a new wallet with a new phrase right away, report the theft, and be wary of anyone who offers to get the funds back, especially for an upfront fee.

Can MetaMask lock or suspend my wallet?

No. MetaMask is a self-custodial wallet: your accounts exist on public blockchains, and MetaMask states that they can’t be deleted or restricted. An email that threatens to lock, suspend or close your wallet unless you act is a scam.