M
MetaMask
Fake MetaMask support and account-verification messages that pressure you into revealing your Secret Recovery Phrase, which hands over your entire crypto wallet.
Official indicators
M
MetaMask<support@metamask.io>
To: you@example.com
For your security, please Check if an email is really from MetaMask to complete this action.
Original URL: https://support.metamask.io/stay-safe/safety-in-web3/i-received-an-email-claiming-to-be-from-metamask-is-it-legit. Click or tap if you trust this link.
What real MetaMask communications look like
- MetaMask will never ask for your Secret Recovery Phrase. Anyone or any website that asks for it is trying to scam you
- MetaMask cannot start an email conversation with you. It only emails you if you opened a support ticket or signed up for marketing updates. If you have no open ticket, ignore the email
- The only genuine MetaMask sender addresses are:
- support@metamask.io (a support ticket you opened)
- hello@metamask.io (newsletters, events and announcements)
- notifications@metamask.discoursemail.com (MetaMask Community activity)
- metamask@mail.cl-cards.com, metamask@info.cl-cards.com and metamask@cl-cards.com (MetaMask Card emails, sent by its card partner Crypto Life)
- An email from any other address that claims to be MetaMask Support is a scam. Check the real address behind the sender name, because "MetaMask Support" as a display name proves nothing
- MetaMask has no phone number for support and will never ask you to get on a call
- MetaMask has no KYC process of its own. The only identity checks are when you buy crypto in the wallet or sign up for MetaMask Card, and those are done with the provider
- To get genuine help, use Contact Support on support.metamask.io, not a link or number from a message
Common spoof patterns
- "Your wallet is restricted, locked or suspended" emails demanding you act now
- "Verify or confirm your account", "upgrade your wallet" or "your wallet failed to update, restore it" messages linking to a fake MetaMask site
- Fake KYC requests claiming you must complete identity verification to keep using MetaMask
- Fake support contact over phone, WhatsApp, Telegram, Facebook, X, Instagram or SMS. MetaMask states it will not contact you through any of these, and it never DMs offering help
- Scammers targeting people who really do have an open support ticket, using a lookalike address to ask for the Secret Recovery Phrase
- Fake MetaMask groups on Telegram, WhatsApp or Instagram. MetaMask describes these as at best a fan club and at worst social engineering
Note for NZ organisations
Anyone in your business who holds crypto in a self-custody wallet is a target for these lures, including staff using a work device or work email. Whoever has the Secret Recovery Phrase controls the wallet, and crypto transfers cannot be reversed, so there is no bank to call afterwards. If you have already typed your phrase into a page you're unsure about, move your funds to a new wallet straight away and report it to MetaMask Support.