MetaMask scams: fake emails, texts, KYC requests and support

The common MetaMask scams

How to check a MetaMask message

1. Ask: does it want my Secret Recovery Phrase, a private key, a signature or a payment? If yes, it is a scam.
2. Do not click links in the message. Type metamask.io yourself.
3. If you are unsure, use MetaMask’s help center from the official site.

Copy tokens in MetaMask

MetaMask warns that anyone can create a token, including fakes of existing ones. Copy USDT tokens and claim tokens appear in MetaMask like anywhere else. Flash USDT in MetaMask shows how to spot and hide them.

Related

Approval scams, Trust Wallet scams, fake exchange emails.

What a fake MetaMask email looks like

The giveaway is structural. MetaMask is software that runs on your device. It does not hold your funds and cannot lock your wallet. There is nothing to verify. Any message that says otherwise is phishing, no matter how good the logo looks.

Fake support

When people post about a MetaMask problem on X, Reddit or Discord, accounts with names like “MetaMask Support” reply within minutes and move the conversation to DMs or a form. The form asks for your recovery phrase “to sync” or “to restore”. Real MetaMask support works through its official help center and never asks for the phrase.

Fake extensions and apps

Search ads sometimes lead to fake MetaMask download pages. A fake extension can look and work like the real one while sending your phrase to the attacker. Install only from links on metamask.io, check the publisher on the store page, and keep one copy installed.

Signatures in MetaMask

MetaMask shows warnings for some risky requests. Read them. Reject spending requests from sites you reached by a link in a message. USDT approval scams.

If your MetaMask was drained

1. Create a new wallet with a new Secret Recovery Phrase, ideally on a clean device.
2. Move anything left in the old wallet.
3. Revoke approvals on the old address with the explorer’s tool.
4. Report the phishing site and file a police report with hashes.

MetaMask scam email, text and KYC messages

A MetaMask scam email or text usually claims something is wrong with your wallet and asks you to act fast. MetaMask is a self custody wallet with no account to suspend, so most of these messages fail on that point alone.

MetaMask scam warning signs in signing requests

The most expensive MetaMask scams happen in the signing window, not in emails. Look for these warning signs before you confirm.

• A request for unlimited spending of a token.
• “Set approval for all” on NFTs.
• A permit signature with a long expiry.
• A transaction that sends ETH or tokens out when you expected to receive.
• A MetaMask security alert banner on the request.

When unsure, reject. A legitimate site will still work after you check it. See the approval scam.

Flash USDT and copy tokens in MetaMask

MetaMask shows any token you import or that is auto-detected. Copy tokens named USDT can appear, and some show a price from a tiny pool.

1. Open the token and check its contract address.
2. On Ethereum, compare with 0xdAC17F958D2ee523a2206206994597C13D831ec7.
3. On BNB Chain, compare with 0x55d398326f99059fF775485246999027B3197955.
4. Hide any token that does not match.

More in flash USDT in MetaMask.

Fake MetaMask support and extensions

• Fake support accounts reply to public complaints and move you to private chat. Real support works through the official help site.
• Fake extensions appear in browser stores and ads. Install only from the link on MetaMask’s official website.
• Fake mobile apps copy the icon and name. Check the developer name in the store.

See fake crypto wallet apps for cloned wallets in general.

If your MetaMask was drained

1. Create a new wallet with a new recovery phrase on a clean device.
2. Move any remaining funds there.
3. Revoke approvals on the old wallet, if funds remain.
4. Note the attacker’s address and transaction hashes.
5. Report to the police and follow our recovery steps.

Questions about MetaMask scams

Can MetaMask reverse a transaction?

No. MetaMask is a wallet. It cannot reverse confirmed transactions.

Does MetaMask ever email me?

Only if you signed up for its newsletter, and it never asks for your recovery phrase.