What are the red flags of this scam?

An email says you must 'enable 2FA' or 'verify your wallet' by a countdown deadline — real wallet providers do not email you with ultimatums tied to timers • The email asks for your 12-word (or 24-word) seed phrase or 'secret recovery phrase' — no legitimate service ever needs it • The link goes to a convincing clone of the wallet provider's site but the domain is slightly wrong (e.g. 'matamask' instead of 'metamask') • You are told your wallet will lose key features or be suspended unless you act within hours • The email arrives from a free email provider or a domain that only vaguely resembles the real company

What should I do if this happened to me?

Never enter your seed phrase anywhere online — your 12-word recovery phrase is the master key to your wallet and any site asking for it is stealing it • Go directly to your wallet app (installed on your own device) rather than clicking any link in an email • If you entered your seed phrase on a suspicious site: immediately transfer any remaining funds to a brand-new wallet with a fresh seed phrase you generate yourself • Report the phishing email using your email provider's built-in tool and forward it to the wallet company's official security contact • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

CRITICAL phishing Last reported: Sep 6, 2026 Share

A fake "security upgrade" email tricks you into surrendering your crypto wallet seed phrase

Q: Is this a scam?

Yes. This is a documented scam pattern. An email mimicking your crypto wallet provider claims you must enable 2FA or complete a security upgrade by a deadline or you will lose account access. The final step asks for your 12-word seed phrase — instantly draining your wallet.

An email mimicking your crypto wallet provider claims you must enable 2FA or complete a security upgrade by a deadline or you will lose account access. The final step asks for your 12-word seed phrase — instantly draining your wallet.

Also known as: MetaMask fake 2FA scam, crypto wallet seed phrase phishing, recovery phrase phishing, wallet security upgrade scam, fake 2FA crypto email

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Never enter your seed phrase anywhere online — your 12-word recovery phrase is the master key to your wallet and any site asking for it is stealing it
2 Go directly to your wallet app (installed on your own device) rather than clicking any link in an email
3 If you entered your seed phrase on a suspicious site: immediately transfer any remaining funds to a brand-new wallet with a fresh seed phrase you generate yourself
4 Report the phishing email using your email provider's built-in tool and forward it to the wallet company's official security contact
5 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ An email says you must 'enable 2FA' or 'verify your wallet' by a countdown deadline — real wallet providers do not email you with ultimatums tied to timers
⚠ The email asks for your 12-word (or 24-word) seed phrase or 'secret recovery phrase' — no legitimate service ever needs it
⚠ The link goes to a convincing clone of the wallet provider's site but the domain is slightly wrong (e.g. 'matamask' instead of 'metamask')
⚠ You are told your wallet will lose key features or be suspended unless you act within hours
⚠ The email arrives from a free email provider or a domain that only vaguely resembles the real company

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources