Fake MetaMask 2FA security checks lure users into sharing recovery phrases

[KiaKia]

It should work on people who have no clue how crypto wallet works, that part that said " After this date, access to key wallet features will be restricted until 2FA is enabled" is scary, it doesn't dish off the fact that they are metamask customers, unlike others that will say you will lose your coins if you don't activate the 2FA.

I also don't understand how people don't find the 2Fa instead of 2FA is read flag.

Anyways, the real matter is the concern about people who are using crypto wallet but don't fully understand how a crypto wallet should world, this is wisdom been changed for money, lack of knowledge is why these people fall for this type of scams, it is getting ridiculous every day.

[MisFoxie]

A noncustodial wallet can not force you to enable 2FA but some users will still be fooled with it and be scammed.

I think this scheme Only target beginners or those who don't have knowledge how a non custodial wallet work. Elderly people are also the victim of this scam. This kind of scam are done mainly with bank account users. Many bank user may think crypto wallet works like bank account and need a 2FA for better security. We should do something to make them aware of it. If someone you know uses crypto wallet and don't know anything about it You should give them some basic knowledge so that they don't make this kind of simple mistake and lose all hard earned money.

[Charles-Tim]

I think this scheme Only target beginners or those who don't have knowledge how a non custodial wallet work.

A very good reason people should learn about noncustodial wallets, different types of scam, hacks and also be updating oneself with scam related news on the internet and social media. But the problem is that some people are just ignorant of all these but they are using noncustodial wallets.

[macson]

This is why you should always verify all information received in emails, as they could be a trap designed to lure you into disclosing sensitive information.

Always ensure that your seed phrase, password, or any other personal data is not shared with anyone. No legitimate crypto service or exchange will ever ask for your seed phrase or account password.

So, even if the email looks official, never share any details with them, and avoid clicking on suspicious links, as they could contain virus.

[sokani]

Scammers are always improving their scamming skills from time to time, because they know people will definitely get familiar with their old skills and no longer fall for them.

This is wrong because there is nothing that is new about this at all, it has been an old scam but just that 2FA is used this time but it is still the same phishing link that take people to a website that they can put their seed phrase which will be used to steal their coins on their self-custody wallet.

You know, scammers are a very smart set of individuals. And like you correctly said, it's an old scam, but they tweaked it a little bit by introducing 2FA and also a deadline to create panic. People who are not knowledgeable would not even think twice when they saw the message. In order not to miss the deadline, they would quickly click the link, enter their seed phrase, and thereby compromise their wallet.

Sometimes I wonder why some persons hold crypto when they lack the basic knowledge about crypto and scams. It's like buying a TV set and not realizing you need to also study the manual to operate it optimally. People need to wise up. There's a need to also equip themselves with the right information in order to protect their assets.

[notocactus]

I think this scheme Only target beginners or those who don't have knowledge how a non custodial wallet work.

With newbies, it's good for them to start with centralized exchanges and custodial wallets, but don't read me wrong. I meant they should never feel safely with centralized exchanges and custodial wallets there. It's just during their very first days, if they don't master non custodial wallets yet but want to start with money in this market, they can choose CEX and custodial wallets.

By knowing about risk and benefit of custodial and non-custodial wallets, they will have reasons to learn about non-custodial wallets, and when they are ready, they should store their fund in non-custodial wallets.

When you teach them, tell them like this, rather than saying "as newbies, CEX and custodial wallets are safe for you". Skipping the second part that is important will make your advice kind of stupid. Like a half of truth is no longer the truth.

[Awaklara]

So, even if the email looks official, never share any details with them, and avoid clicking on suspicious links, as they could contain virus.

For normal people, they would certainly be careful and think clearly to ignore such emails. However, usually once you have received an email like that, in the future you will also receive several emails with similar scam attempts. 
The ones who are easily victimized are people who are new and have little knowledge. Also, people who are in situations that fit the scheme designed by the scammer. For example, when you are in a hurry and ignore some notifications while making a transaction. Unknowingly, we have already opened the door for scammers to drain the assets in our wallets.

[Z-tight]

By knowing about risk and benefit of custodial and non-custodial wallets, they will have reasons to learn about non-custodial wallets, and when they are ready, they should store their fund in non-custodial wallets.

You do not need to use a wallet to learn about the risks and benefit. As a newbie, you shouldn't even use any wallet nor buy BTC immediately. The first thing to do is learn about wallets and other basic things and when you are done, start off with the best option, which is an open source, self custodial wallet that is well reviewed too.

I do not agree with the idea that you need to use a custodial wallet at first. A newbie could do so and get so comfortable with it, having the same feeling as using fiat in a bank and then stick with centralized exchangea, have you thought about that?

[Charles-Tim]

This is why you should always verify all information received in emails, as they could be a trap designed to lure you into disclosing sensitive information.

I always neglect all the emails that I do not authorized for. Also phishing emails are easy to know, but people should learn about how to know them and also learn about how to avoid scam and hack in general.

I do not agree with the idea that you need to use a custodial wallet at first. A newbie could do so and get so comfortable with it, having the same feeling as using fiat in a bank and then stick with centralized exchangea, have you thought about that?

It is also worth knowing that there are ways scammers are using to steal coins from people in a way that it does not matter where the coins are. There has been over $2 million that was stolen by a single person impersonating Coinbase users and I guess most coins sent or stolen by the guy are from the victims accounts on Coinbase

https://www.financemagnates.com/cryptocurrency/how-a-single-threat-actor-stole-2m-in-a-coinbase-support-impersonation-scheme/

Learning about scam and hack and how to avoid them is very important before investing in bitcoin.

[joniboini]

I always neglect all the emails they I do not authorized for. Also phishing emails are easy to know, bit people should learn about nhowntonknow them and also learn about how ti avoid scam and hack in general.

Just a heads up, I think there are a lot of typos in this sentence. Maybe you want to edit it later since there are quite a few of them.

Anyway, speaking of fake emails, I got so many of them recently. One of them even comes from a legitimate address, probably due to a mail server hack or something similar. Not the first time someone has done that to big business. I remember Mozilla is one of their targets. If you never knew about that, there's a chance you'll just trust the message you received, even though the content itself should be enough to tell you whether it's a phishing one or not.

[armanda90]

Nice ideas for OP after sharing important information exactly for the beginner installing metamask wallet as their main wallet for holding cryptocurrency assets, actually all wallet not able for security additional of 2FA from metamask or other kinds wallet exactly installing metamask add on. Its important checking the official email sender when receiving most important update because right now the scammer very smart when making similar email sending.
For every one else, protect well with your email and always privacy main email use for registering CEX exchange wallet avoid sending fake link by scammer, if want to try registering and airdrop project don't use your primary email but using not primary email. I have much experienced when using primary email every days ending fake link by scammer.

[Rustam Meraj]

Social engineering is method used by hackers to get people to give up their crypto by creating a fake feeling of threat or panic, including sending messages that account will be closed unless security check is done. Since lots of users are used to other banks which have to use 2FA, they are easily tricked by websites that look official but ask for seed phrase to prove who they are.
Non custodial wallets such as MetaMask can yet use your seed phrase as main key, and when you enter it into site, you can lose all your money in only seconds by hacker using his program. In order to be safe, you should keep in mind that seed phrase is meant to bring back your wallet in new device only and should never be typed in any website.
Personally, price of being able to have full control over your money is price of 100% responsibility because there is no company to call in case you make mistake, hardware wallet would be most fitting to build real wall that can ensure your keys are not stolen by such fake links.