Bitcoin Forum

I use more than one email address for different reasons and I got a scam message in all three email addresses, it's about metamask and I am familiar with this trick, I just feel like sharing here because we always have newbies joining the forum almost all the time.

A scam metamask mail was sent out to my email addresses two days ago, at first I don't seem to care because it's not new but I got the same message of all three email addresses which prompt me to share on here.

https://i.imgur.com/4OF9A0l.jpeg

I am pretty sure that the metamask team has no mail ID and also the wallet never ask for email address when creating a new wallet account, so the question is how did they get your email address? This is a RED FLAG.

The link directs me to a page link platform that asks you to insert your metamask recovery seed to proceed.

https://i.imgur.com/7JrfyAK.jpeg

They must have gathered hundreds or thousands of email addresses and used some kind of messaging tool to send out the scam mail alert in a single click. If you are new to crypto stay away from email messages, some are scams and they won't end up in SPAM Folder.

Thanks for share, it would be nice you "copy/paste" in the text of email so people can easily find also with a search engine.

Moreover there is a very simple method to avoid falling victim to this type of scam that anyone could apply (tech savy or not): Access the main site and check if that information is true!
For the more paranoid, use a secondary laptop / account/ secondary wallet to verify this information before using it on the main account.

There's a possibility to this angle. This is the major reason I stopped participating in airdrops. Till date, I suspect that my personal data which I used for past airdrops and bounties before now would be chilling in someone's archive. I hope they don't get used for something sinister, anyway.

I haven't ever updated anything going through email messages. In fact, I like to update my apps through the same source I get them. If I get an app from Playstore, I make it a matter of guideline to update that app through playstore. That's the way I play. With that I keep off random upload.

Anything that has to do with upgrading a wallet app must be sourced from the official website and not the embedded links available on the internet where everyone can easily have access to and abuse it, those that are not the official links from their sites are the ones aimed to attack people through phishing links, they comes with various apps ads on different websites which redirect user to their own fake website for further attack.

Scammers usually have two themes that all their attempts take; Greed or Panic.

With greed, they lure victims with the possibility of crazy returns if they only risk a relatively small amount. And if they do get hooked, they keep tempting them with more while asking they pay some amount to get it, till it doesn't work anymore.

Wit panic, which is what was used here, they scare you into making an urgent action or risk losing something. In such State of panic, you can easily enter limbic mode and not think logically, leading one to make a mistake.

---

Always stay sharp and vigilant. Treat everything as a scam until proven otherwise.

Perhaps you use this email address from bounty hunting not on meta mask directly. In that case, your email address has been compromised --you need to change your email address right now and unlink that valuable stuff in your email address.

---

Thank you for sharing this and this will warn everyone, I thought this is only on the Electrum app but now it is also on metamask, scammers getting smarter these days.  Always check on the official website and download it if need to upgrade your wallet and don't forget to verify every app you downloaded.

This is an old strategy maybe they found your email somewhere here on the forum if you posted all 3 emails to join in some campaigns then after a few days expect to receive spam emails from random strangers.

Have you tried to check if the email has an unsubscribe button? so that you can remove your email from their spam emails or block them.

It's really dumb they ask for a seed phrase it is likely the same as asking for a Bitcoin wallet backup. A seed phrases should never be shared with anyone you should be the only one who knows your seed phrase typing it to any online device can possibly be hacked/leaked. So always keep them offline and don't fall to any trap like this.

Definitely, knowing that the metamask wallet doesn't require an email address in its set-up was definitely a better place for a start. Still, you would find those that due to adrenaline rush, would jump at the information because, they've heard of the possibility of loosing there funds (besides, who won't want to secure there funds) but, in taking that step without first taking a moment to check into your reasoning asoning on what could be going on, your lose the very thing you hope to save.

My advise and what works with me on this is, if its working fine @wallet, what's the use or need for an update. Its just unnecessary.

Mail address is something that comes handy for these guys and sending spam messages to just anyone, including those that don't don't use metamask wallet is not an issue with them.

You have been correct responsive, and careful. This is happened to me also in the past after installing Fake Extension (https://bitcointalk.org/index.php?topic=5435986.0). The software asks me to input the word mnemonic which I think it's a 100% scam. This is the same case like you got call the bank, the caller ask the pin, otp and mother name, off corse this is really scam because CS Bank never ask the PIN or OTP code when they call you.

The design is pretty sketchy though. I think upgrading waller should be done on website itself, so any messages of possible upgrade is most likely scam. I was always worried about this style of update or checking if the email was legit and came from their official sites or own social cause this could be fake users who are trying to phish you when you click the link or their downloadable box.

There are many ways you can leak your email address online and the most popular one is through airdrops, I receive spam emails and fake messages through emails that I have used for raindrop hunting in past more than the email I don't use for airdrop hunting.

There is something called Email Harvesting where the scammers use bots to scout the web for email addresses, this hot use the @ symbol to identify any email format on the web and grab them one by one and add it to the list. I believe to have seen this bot at work when a friend of mine was into affiliate marketing.

No, they are not asking for email its impossible for the metamask team to get your email or any decentralized wallet, this is a red flag that anyone who falls for it does not even think or even stop and ask where did they get my email and if you know security the basic is always been never click any link coming from an unknown source and if there is a wallet upgrade it should be after you open the wallet not coming from a link, a decentralized platform never send a link to upgrade, basics that newbies are overlooking

Traced back when and where did you used your email for signing up and if you just signed up with a few then you'll have the idea on who's the culprit that sends out your email to these scammers.

These scammers/hackers know how to play the minds of everyone especially those that has no to little background about wallets and stuff. They're like making you decide quickly to click those links that they attached but if you've been fooled, you'll really fall for it.

Thank you so much for this prompt wake up call and this is really helpful especially for the newbies who want to go with trends and don't want to miss out of any little opportunity they get along their path and crypto journey.
Most times I just sit down to imagine how updates this scammers are and how mich well they evolve with the world and technology and it only bit amazes me.
For every potential scam message I get, I just wave and flag them off or move them to spam without deleting them because I always reference them when I get a similar message because in the last years it has really helped me alot to stay safe in the cyber space.

AFAIK non custodial wallets are always can be accessible even though you're using an old version, usually the upgrade is related about new feature, fix bug, security improvement etc. If you need to update your old wallet, it's really recommended to access it through your wallet or from the official site or github, don't trust anywhere like email, social medias etc.

This trick is very common in hacking world but its more used in the field of social media accounts to hack them as far as I know but this is something new so yes be cautious whenever you receive such messages. You are not likely to receive such warnings through emails if its legit, either you can be notified with their official media handles or with the app notification itself.

Be aware of masking, it will redirect us to exact replica of the official website or something relevant to it where we enter anything will be visible to the hackers so don't every such fall for tricks anymore.

Common used trick by hackers so verify always what we read online specially when the message came from spam folder on email since mostly they sent a message there. Much better ask the support of the website to know if the upgrade is legitimate and we will not fall on fake upgrade sites which compromise all our funds.

Always verify what you download. Unfortunately very little people do verification for their download files.

At least, if they do verify it, they must do it right at first. Knowing what is official website and get link to download from an official website is a first safe step to do.

Officially visit websites & download apps, not fake ones. (https://bitcointalk.org/index.php?topic=5259689.0)

I think the scammers are also intelligent when it comes to sending people about the upgrades of wallets because sometimes they join the original creator to send their own phishing link to confuse the users. It's really recommendable to double-check everything before proceeding to click because one bad click will result in the loss of everything you have in that crypto wallet. With this kind of fraud, there are a lot who already have fallen victim and they are too late when they find out they have been hacked due to the link they clicked from their emails.

Upgrading of wallets have really swept lot of people's fund, and I think this same post have been shared before about metamask sending mails asking for update. How did they get to know your emails, do I say is from bounty spreadsheet or where exactly do we think people's mail will be that exposed for them to send scam mail to people around and they are always ready to steal people's funds. Maybe some are already a victim of this scam, mainwhile, newbies should be more careful with their wallet when it comes of update, i  don't accept any random pop-up notification to update whatever app in your phone, instead you may visit playstore to get it updated.

Exactly some users fail to do this because if they are ro innocent for this they are to lazy to seek for further information about what notice they receive. If majority just have critical thinking towards this and always know what to do especially when receiving a unwanted or verifiable information for sure they never get victim on this kind of schemes.

In fact I always suspect if there are emails about wallets and any kind related to Crypto. Unless I'm right to do that myself. Because I always pin the sites I visit. It's one of the methods I use to avoid scam sites. I also often overlook emails that I thought were useless, not from my job. Because they always communicate with me if they send an email. Although the current model of criminals is very diverse, the important thing is to always be vigilant, don't trust anyone in the online world. In addition, I also rarely use metamask, trust wallet to connect with Airdorop sites or other exchanges.

When it comes to upgrading of any application, do it from only trusted sources like your app store. Deciding to search for updates randomly on the internet can be a bad idea because you cannot tell when you will fall into the net of scammers. If I can receive random calls from scammers asking me to confirm my banking card by calling the numbers behind, I do not see why receiving strange and suspicious emails should be strange. Those people have access to even things we do not know.

They don't collect your email from meta mask for sure. Scammers who use email for scams collect your email from different crypto-related websites and forums where you set your email address public. They send automated emails to their collected email list.
This thing needed to be shared for the awareness of many forum members here.

Thanks for sharing this experience. This will help and remind us to be more careful.

Again, this trick may work for people who are less skilled or new. Because they assume that the notification is real from Metamask or another online wallet email. However, actually, when we are going to upgrade an application, wouldn't it be better if we immediately confirmed it when opening the application? Usually, there will be an immediate upgrade notification or application update when we open the application. So we'll know when we need it. But once again, when it comes to e-mail, we really have to be vigilant because scammers can camouflage themselves to be like official e-mails with very small and unnoticed e-mail differences.

It's very easy for them to get active emails from various fraudulent registration forms to get coin airdrops, so many registrants are beginners who don't understand crypto so they find it easier to believe fake information sent from email messages that scammers have spread. So many phishing scams are related to update wallet so we have to be careful, it is better to ignore the notification and access real wallet to update from system and not from fake information.

This is what I always do, and I strongly recommend people always do this instead of clicking on a link sent from an email or private message. No matter what email I receive, I rarely confirm whether it is an official or fake email. What I would do is visit their official website or social media to confirm the information, because I think before they send emails to customers, those messages are already communicated in their main media. And if that's true, I will update following the instructions from their website instead of going back to the email and following the instructions in the email.