Fake ‘MetaMask Support’ Emails Are Stealing Wallet Credentials, SlowMist Warns

MetaMask's official support documentation warns users that the wallet provider never initiates unsolicited contact.

• Security firm SlowMist warned of a fraud posing as "MetaMask Support" that used fake 2FA verification emails and webpages to obtain wallet passwords and recovery phrases.
• Some users on Reddit stated that the emails appeared authentic at first, as Mask Network's $MASK traded near $1.00 as retail sentiment on Stocktwits shifted bearish.
• MetaMask stated that the company never sends unsolicited emails, requests 2FA, or requests sensitive information, emphasizing the ongoing phishing concerns in cryptocurrency.

MetaMask is facing a new phishing scam that impersonates a “2FA Security Verification” process, according to SlowMist.

On Monday, blockchain security firm SlowMist posted that the scam attempts to trick users into believing their wallets require urgent two-factor authentication (2FA) verification. Screenshots shared by 23pds showed emails and web pages branded as “MetaMask Support,” urging recipients to click links to verify their wallets.

Metamask's protocol network token, Mask Network ($MASK), was trading around $0.64, down 0.2% over the last 24 hours. On Stocktwits, retail sentiment around the Mask Network changed from ‘bullish’ to ‘bearish’ territory over the day, as chatter levels dropped from ‘extremely high’ to ‘high’ levels over the past day.  

The fraudulent messages falsely warn that wallet functionality may be restricted or suspended if users fail to complete the verification process. The links redirect users to phishing websites designed to collect sensitive information, including wallet credentials and recovery phrases.

In a Reddit thread discussing the emails, a user said the message “looked official at first but came from a random address and asked me to enable 2FA through a link,” prompting concerns that it was a phishing attempt.

MetaMask Warns Against Unsolicited Emails

MetaMask previously warned users that it does not initiate unsolicited contact. In its official support documentation, the wallet provider states: “MetaMask will never send you unsolicited emails and will not initiate email correspondence with you.”

The company also noted that it does not collect personally identifiable information, such as email addresses, during wallet creation, meaning it cannot contact users directly unless they first open a support ticket.

For updates and corrections, email newsroom[at]stocktwits[dot]com.<