Skip to main content
Category: Hacks → Phishing & TyposquattingHacksPhishing & TyposquattingFake Login PagesReading time: 10 minutes
Risk level: Critical
Target audience: MetaMask users, wallet users

​
Meet Tunde

Tunde is a 27-year-old trader who uses MetaMask regularly. One evening, he receives an email: Subject: “URGENT: Verify Your MetaMask Account – Unusual Activity Detected” The email:
  • Uses MetaMask’s logo
  • Claims unusual activity was detected on his account
  • Says he needs to verify his account immediately
  • Includes a link: https://metamask-verify.io/confirm-identity
Tunde is alarmed. He clicks the link.

​
What Happened

He lands on a page that looks identical to MetaMask’s official site. It asks him to “verify” by entering his seed phrase or password. Tunde enters his seed phrase. The page processes and then displays: “Verification complete. Your account is secure.” But it wasn’t verification. The attacker captured his seed phrase. Within minutes, the attacker imports his seed into a new MetaMask instance and drains his wallet (which had ₦1.2M in various tokens). Tunde’s wallet is empty before he realizes what happened.

​
Where the Scammer Won

  • Email urgency: “URGENT” and “Unusual Activity” created fear and bypassed critical thinking.
  • Perfect UI cloning: The fake site looked identical to MetaMask’s official site.
  • Fake domain: metamask-verify.io looked legitimate but was not an official MetaMask domain.
  • Authority: Using MetaMask’s logo and branding made it seem official.

​
Red Flags Tunde Missed

  • Official MetaMask never emails about account verification.
  • No wallet ever asks for your seed phrase via email or website.
  • The domain is fake: metamask-verify.io instead of metamask.io.
  • Email sender domain doesn’t match: Check if it’s actually from MetaMask.

​
How Fake Wallet Login Scams Work

What happens: Scammer sends email claiming to be from wallet provider, using urgency (“URGENT”, “Unusual Activity”) to create fear.
What happens: Scammer creates website that perfectly clones the official wallet site’s design and branding.
What happens: Fake site asks for seed phrase or password, claiming it’s needed for “verification” or “security.”
What happens: Attacker uses captured seed phrase to import wallet and drain all funds.

​
Prevention

Never enter seed phrase into any website.
Official MetaMask domains are metamask.io and app.uniswap.org (for connected apps).
Verify emails by going directly to the official website, not clicking email links.
Check email sender domain: Verify the email is actually from the official domain, not a look-alike.
No legitimate service emails about account verification: Wallet providers don’t send emails asking you to verify your account.

​
If You Already Entered Your Seed Phrase

1

Create New Wallet Immediately

Create a completely new wallet with a fresh seed phrase.
2

Move All Funds

Move all remaining funds from the compromised wallet to the new wallet immediately.
3

Assume Old Wallet is Compromised

Never use the old wallet again, even for receiving funds.
4

Report the Fake Site

Report to ChainAbuse and the official wallet provider.
5

Report the Email

Report the phishing email to your email provider.

Grant Phishing + Wallet Drainer

See how phishing leads to wallet drains

Hacks Category

Explore all types of phishing and technical exploits

Check Your Wallet

Verify if addresses are reported as malicious

Report a Scam

Report fraudulent sites and addresses

​
References

  1. MetaMask - Official Website and Support
  2. MetaMask - Never Share Your Seed Phrase
  3. ChainAbuse - Report Scam Addresses