Blog
MetaMask Scam Emails: What to Check
In short
MetaMask can send legitimate support replies and subscribed updates. An unsolicited email asking for your recovery phrase, private key or password is not a legitimate wallet-verification procedure. Check the request through MetaMask’s official help centre, opened independently of the email.
What to do next depends on what happened. Reading a message is different from downloading software, entering credentials or approving a wallet request. Disconnecting a website does not revoke an existing token allowance. If a recovery phrase or key was disclosed, changing the app password does not make it safe again. Preserve a record of the incident without sharing secrets; completed blockchain transfers cannot be reversed by a recovery service.
“MetaMask never sends emails” is too broad. MetaMask may reply to a support request or send updates you subscribed to. An unsolicited message demanding wallet verification is a different matter.
Some services, such as buying crypto or using a card, may involve identity checks. That does not make an unsolicited “verify your wallet” email genuine. Check whether the message relates to a service you actually requested. Identity verification is not a reason to disclose your phrase or private key.
Check the request, not just the sender name
MetaMask does not ask by email for your Secret Recovery Phrase, private key, password or Google/Apple account details. A threat to suspend your wallet unless you disclose them is a warning sign. A familiar logo or sender name is not proof of authenticity.
Verify through a separate route:
- Read the full sender address, not only the display name, but do not treat it as proof.
- Open MetaMask’s official help centre independently, without using the email’s links.
- Check the request against your existing support case or the service you used. Contact support through the official site if it does not match.
The official email guide below describes the kinds of correspondence MetaMask sends.
If you already interacted with the message
You read the email or opened a page
That alone does not establish that your keys were exposed. Close the suspicious page and record what happened. Separately note any download, credential entry or wallet request you approved; these call for different checks.
You connected the wallet or approved a transaction
A connection is not the same as permission to spend tokens. Review what you signed and any token approvals. Disconnecting a site does not revoke an existing on-chain approval. Revocation is a separate transaction that can require a network fee; it cannot undo earlier transfers. Use the official approval guidance below rather than a “revoke” link in the suspicious message.
You disclosed a phrase or private key
Treat the affected accounts as compromised. Changing the local MetaMask password does not make those keys safe again. Do not add funds to the affected accounts while seeking guidance; follow MetaMask’s official compromised-account instructions. In a support report, describe what was disclosed without including the secret itself.
Contact official support for the next steps. Crypto Recovers handles lost wallet access for rightful owners, not recovery of stolen or scammed funds. A confirmed blockchain transaction cannot be reversed.