MetaMask scams
Last updated September 18, 2026
The short answer
MetaMask scams take two forms: getting your twelve-word seed phrase, or getting you to sign a transaction that grants unlimited spending approval to a contract. MetaMask has no support staff who will contact you, and no legitimate site ever needs your seed phrase.
MetaMask is self-custody, which means there is no company able to freeze, reverse or refund anything — the security model puts all of it on the user. Beyond the familiar seed-phrase theft, the distinctive MetaMask risk is the approval signature: a single confirmation can grant a contract permission to move your tokens indefinitely, and the confirmation dialog does not make that obvious to someone who has not been burned by it before.
How MetaMask scams work
- 1
Seed-phrase phishing
A site, support agent or "wallet validation" tool asks for your twelve words. Any use of them anywhere other than restoring your own wallet gives away everything in it, permanently.
- 2
Drainer contracts and malicious approvals
A mint page, airdrop claim or game asks you to sign. The signature grants unlimited spending approval over a token. Nothing happens immediately, which is what makes it work — the drain comes later, and looks unconnected.
- 3
Fake support everywhere
Every public MetaMask question attracts DMs from accounts posing as support, on Discord, X, Telegram and Reddit. They direct you to a form that requests your phrase.
- 4
Address poisoning
A scammer sends you a zero-value transaction from an address that resembles one you use, so it appears in your history. Copying the address from your own history later sends funds to them instead.
Warning signs
- Anything asks for your twelve or twenty-four word phrase
- A signature request you do not understand, especially for "approve" or "setApprovalForAll"
- Support contacts you first, anywhere
- A free airdrop or mint requires a wallet connection from a link someone sent you
- An address in your transaction history closely resembles one you use but is not it
- A site asks you to "validate", "sync" or "migrate" your wallet
- Urgency — a claim window closing, a token about to be lost
Examples
The approval that waited three weeks
A user connects to an NFT mint site and signs what looks like a routine transaction. Nothing happens; the mint "fails". Three weeks later their entire USDC balance moves in one transaction. The signature had granted unlimited spending approval, and the drainer waited for the balance to grow.
Address poisoning
A trader sends funds to an exchange regularly. A zero-value transaction arrives from an address matching the exchange deposit address in its first and last four characters. On the next transfer they copy from history rather than the exchange, and $18,000 goes to the lookalike.
What to do
- Never enter your seed phrase anywhere except when restoring your own wallet in the real MetaMask extension or app.
- Read every signature request. If it says approve or setApprovalForAll and you did not intend it, reject it.
- Review and revoke old approvals regularly with a tool like revoke.cash.
- Use a separate "burner" wallet for minting and connecting to new sites, holding nothing of value.
- Always copy addresses from their source, never from your own transaction history.
Report it to MetaMask
Report phishing sites at support.metamask.io. MetaMask support never contacts users first and never asks for a seed phrase.
Getting your money back
Self-custody means nobody can reverse a transaction, so the priority is stopping further loss: if a seed phrase was exposed, create a brand-new wallet and move remaining assets immediately, because the old wallet is compromised forever. If a malicious approval was signed, revoke it at revoke.cash before moving anything. Report to IC3 with transaction hashes — funds that reach a regulated exchange can occasionally be frozen. Ignore every "recovery service" that contacts you afterwards; they are the second scam, not the remedy.
Frequently asked questions
Can MetaMask reverse a transaction or recover stolen funds?
No. MetaMask is self-custody software, not a custodian — there is no account, no balance held on your behalf, and no mechanism to reverse anything. That is the trade-off of self-custody, and it is why seed-phrase discipline matters so much more here than at an exchange.
What is a token approval and why is it dangerous?
An approval lets a smart contract move a token on your behalf, and by default many requests ask for an unlimited amount with no expiry. Signing one gives a contract standing permission to drain that token whenever it likes. Review your approvals periodically and revoke the ones you no longer need.
Someone sent me crypto I did not expect. Is that a problem?
It can be. Address poisoning works by placing a lookalike address into your transaction history through a tiny or zero-value transfer, hoping you copy it later. Unexpected tokens can also be bait to get you onto a drainer site to "claim" them. Ignore both, and always copy addresses from their original source.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about MetaMask, these are the guides worth reading next.