Hi, I received an email from noreply@metamask.io with the following:
" Dear customer,
You are receiving this email because we have detected some unusual activities on our network, because malicous botnets exist on our platform taking assets away from our costumers. In order to remove a large amount of bots from our platform and to prevent this from happening to your wallet in the future, we will be terminating all wallets that have not been verified by their rightful owners. Verifying your wallet can be done via the button below.
Non-verified accounts will be terminated on Saturday, October 15, 2022. There is no way to recover your assets after your account has been terminated, so please make sure to verify your wallet as soon as possible.
Thank you for your understanding."
Is this legit or spoofed? I tried searching but didnāt see any matching threads. Thanks.
Thanks for the info. Although now Iām getting community notifications from notifications@metamask.discoursemail.com and I had to verify the account to post this thread, so the email must be recorded by MetaMask right? But not linked for the wallet you mean?
Does MetaMask have a security team or anyone who can take down the spoofers?
The community notifications email is from Discourse, not MetaMask. Discourse is itās own platform, MetaMask uses this platform for our community forum. The email you registered on Discourse with is not shared with or stored by MetaMask, it also has no way of being tied to your wallet. You can make adjustments to your Discourse email notifications by clicking your profile picture in the upper right hand corner of screen, click the person icon, choose preferences, go to Emails on left column of choices and make adjustments there as you wish.
One personal note I want to throw in there, that with all emails (crypto or not), itās best practice to use caution. I personally try to never click on any links and if itās a known account or site I visit I just go to the actual site in my browser the email is attempting to get me to click to. Example, if I receive an email from my bank, I never click links in it because that is a regular scam of phishing links. I would apply this rule to the Discourse emails too, not using those links but just visiting the forum that I know my message lives. Unfortunately, where there is any type of value, scammers are going to try and scam. Itās great your cautious and asking here. It also helps spread more awareness to others in the community!
Here is another MetaMask Knowledge Base article that shares some great info relating to all of this, sharing if itās helpful!
Ok, thanks for your help. I just realized that I may have entered my seed phrase into another āverificationā scam that was also spoofing noreply@metamask.io a while ago, so I guess that wallet is pwned and should not be used. Luckily I never put any funds there.
I want to follow Rule 9 and report this scam, where should I do that? Can I just post the domain and header data from the email here, or is somewhere else better for reporting them?
Yes! So sorry, you asked this in your previous post and I meant to answer it. You can report to MetaMask Help Desk. Do this by visiting support.metamask.io and click the blue āStart a Conversationā bubble. This will initially connect you with a bot, but as you answer questions it will get you connected to an agent.
Provide screenshots of the emails you received, sharing the āfromā email of the address where it came from. If you have a site link, provide that too but do not actually visit any links/sites you have to get info. We donāt want you to get compromised while trying to report.
Support will NEVER ask to connect to your device or for your Secret Recovery Phrase.
Yes, you are 100% correct. Do not use the wallet you inputting your SRP (Secret RecoveryPhrase) for, that was a scam.
Here are some common SRP scams -
-email verification (MetaMask does not have your email)
-text message or call (MetaMask does not have this info)
-email or notice you need to do something with your tokens because of the merge
-pop-up windows (that look legit and like they are from MetaMask) asking you to put in your SRP again.
-anything asking you to verify your SRP , including any site you are visiting
If youāre logged in your wallet, there is no reason that you should get asked for your SRP and if you are itās best to be strongly suspicious.
If itās suspicious, feel free to ask here!
Also, dropping some more articles if you find them of any interest:
Maybe consider getting a hardware wallet for an extra layer of security. One note, if you do get one buy directly from the hardware wallet company (like Ledger get from Ledger, Trezor from Trezor, etc.) and not any type of 3rd party seller. Here is an article about them:
You can check out our last āGet Started in Web3: All Things MetaMaskā workshop call here, there is some really great info shared in it:
Ok, I will try reporting the fake MetaMask spoofing emails to support.metamask.io and check out those resources you provided. Unfortunately Iām kind of familiar with scams now from another case, thatās why Iām more on top of it now.
Any idea how the scammers knew I had a MetaMask login to target me, or are they just spamming everyone randomly and they got lucky?
Remember - never share your Secret Recovery Phrase. The only time youād input it is when youāre restoring your wallet (because you reset it yourself) and no other reason.
Iām so sorry to hear you were victim of fraud. Check out that hardware wallet link for sure. Although, be sure of all the best practices with those too or possible issues.
Your question about how scammers might know you have a MM wallet is another really good question. I saw this response recently in regards to this that I think provides good insight (Iām going to copy paste it word for word ) -
Itās called spear fishing. They target users of other crypto services that do use email.
MM doesnāt collect much data. None of it is personal info.
That makes sense, pretty clever by the scammers. I opened a ticket with support.metamask.io (had to enter my email againlol). Thanks again for all your help!
You got it! Thanks for coming to ask the questions! I think with the platform for Help Desk, while you provide the email you can go to the actual site for the conversation. Just remember, support isnāt going to ask for your SRP (including QR code) or for you to input it anywhere or for you to share your device.
I meant to mention there are many more ways for peopleās data to get harvested, but that was a recent share I saw that really struck home for me. Watch for social engineering, and people being able to link your online persona to you somehow. Like donāt use your name on forums, or something that could get tied back to you.
Weāre here if you ever need us or have more questions! So is our help desk
) -