MetaMask bait in your inbox
A phishing email impersonating MetaMask is circulating, urging you to back up your recovery phrase and click through to update your wallet.
You could receive a plain text email with the subject line "Back up your recovery phrase", made to look like it is from MetaMask. It pushes a security message about your wallet and urges you to click an "Update Wallet Now" prompt or back up your recovery phrase. If you use crypto services, it is designed to feel routine and urgent enough that you act before thinking.
What gives it away is that the sending domain, spectraspeaks.com, does not line up with the brand being presented, and the email system could not verify it as a legitimate sender. There were no working sender authenticity checks at all, which means the message could not prove who really sent it. The domain itself is old, but age alone does not make it trustworthy, especially when it is being utilised to impersonate a completely different organisation.
The attacker is after your wallet recovery phrase or any credentials you enter after clicking through. If you follow the prompt and hand over that phrase, they can take control of the wallet and empty its contents. Even replying or engaging confirms your address is active and can lead to more targeted phishing.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Confirm whether anyone in your organisation received a wallet or recovery phrase email claiming to be from MetaMask.
- Do not: Click the link, reply to the message, or enter any recovery phrase, password, or wallet details.
- Verify: If you use MetaMask or any crypto wallet service, go directly to the official site or app you already use, never through the email.
- Report: Send the message to your IT provider or security team so the sender domain and indicators can be blocked and reviewed.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine MetaMask message looks like, the real sender domain, the real link destination, and where to report a fake.