"Check the URL" is good advice, but it is not enough. In October 2026, phishers sent "verify your wallet" emails that linked to the real portfolio.metamask.io, not a lookalike domain. A flaw in how the page displayed notifications let the attacker put their own message and button on MetaMask's genuine site. Clicking "Verify now" loaded a script that showed a seed phrase form in MetaMask's colours and sent the words to the attacker.
The domain was real, the certificate was valid and the design matched. The researcher who found it reported it on October 9, and MetaMask fully fixed it on October 19. The lesson applies to every wallet, exchange and dApp.
Why a real domain can still be dangerous
The address bar tells you who served the page. It does not always tell you who wrote what is on it. Bugs in websites, compromised third-party scripts, hijacked front ends and malicious ads can all put an attacker's content on a trusted domain. When that happens, every visual check passes.
Rule 1: No legitimate page asks for your seed phrase
Your seed phrase (Secret Recovery Phrase) is only typed into your wallet when you restore it, and only when you started that restore yourself. No website, support agent, "verification", "sync" or "security upgrade" needs it. If any page asks for it, even on the right domain, close the tab. This one rule would have stopped the MetaMask Portfolio campaign completely.
Rule 2: Judge the request, not just the URL
Ask what the page wants you to do. Red flags include:
- Entering a seed phrase or private key
- Signing a message or permit you don't understand
- Approving tokens for an address you don't recognise
- Acting within a deadline or "your account will be suspended"
Urgency and threats are pressure tactics. Real services don't suspend a self-custody wallet, because they can't.
Rule 3: Arrive through your own bookmarks
Don't open wallet or exchange sites from emails, DMs, ads or search results. Save the sites you use as bookmarks and go through those. A clean bookmark won't fix a bug on the site itself, but it removes most of the links attackers control, including long URLs packed with hidden parameters.
Rule 4: Treat unexpected messages as suspicious
Wallets rarely email you, and many don't have your email at all. If a message claims there's a problem, check the project's official channels yourself instead of using the link provided.
Rule 5: Use a hardware wallet
A hardware wallet keeps your keys off your computer and shows the transaction on its own screen. Read that screen before confirming. A hardware wallet can't protect a seed phrase you type into a website, so Rule 1 still applies.
If you already entered your phrase
Treat the wallet as compromised. Create a new wallet with a new seed phrase, ideally on a hardware wallet, and move your assets right away. If you signed anything, revoke approvals too, but moving funds comes first.