MetaMask is adding a new layer of protection for users as crypto scams become increasingly convincing—and increasingly personal. The wallet maker has introduced new warnings and transaction safeguards designed to catch suspicious activity before funds leave a user’s account.
The rollout covers both MetaMask’s mobile app and browser extension. New alerts flag lookalike wallet addresses, first-time recipients, and potential investment and romance scams, while redesigned transaction screens aim to make it clearer what users are actually approving.
One of the more unusual additions is called Added Protection. The feature can automatically reverse a transaction when what ultimately happens does not match the preview shown to the user. It is launching first on the browser extension, with mobile support planned for later.
The thinking behind the change came partly from a frustrating pattern MetaMask noticed in real scam attempts. Martin Peko, a staff product manager at MetaMask, said victims of investment scams were often dismissing warnings rather than following them.
“This told us something specific: they either trusted the recipient far more than usual, or they were being actively coached past it,” Peko told Decrypt. “That’s what made us think a different kind of control was needed. We’re also adding a route to priority support from this flow, so someone who’s uncertain can reach a person rather than simply being told to stop.”
That changes the role of a wallet warning. Instead of simply flashing a red flag and leaving the decision to the user, MetaMask is trying to intervene when a transaction appears especially risky.
MetaMask Is Trying to Outsmart the Scammers
The new protections arrive as scammers are using increasingly sophisticated tactics, including personalized messages and increasingly convincing websites designed to look legitimate.
MetaMask said it is also using artificial intelligence to help identify those threats. Its security partner, Blockaid, uses LLMs and classification models to examine unstructured material across websites and social platforms, alongside onchain bytecode and transaction-flow analysis.
“Our security partner Blockaid uses LLMs and classification models, within custom agent harnesses, to analyze unstructured content across websites and social feeds at scale, alongside static and dynamic analysis of onchain bytecode and transaction flows to identify phishing, scam, and malicious behavior in real time,” Peko said.
The resulting intelligence feeds into warnings shown before users send funds. MetaMask says that approach is part of a broader move toward contextual security alerts rather than generic warnings that users can quickly learn to ignore.
Address-poisoning alerts, first-send notifications and deeper security information for tokens and transactions are already part of that effort, according to Peko.
The timing is notable. U.S. authorities are also intensifying efforts against services connected to investment and romance fraud. In July, authorities seized more than $25 million in cryptocurrency tied to schemes prosecutors said had defrauded thousands of people in the U.S. and Canada.
Earlier this month, the Secret Service froze $52.8 million in crypto connected to Xinbi Guarantee, a Telegram marketplace that allegedly provided services used by scammers.
For MetaMask, better fraud detection is also arriving at a moment of corporate change. Consensys, the company behind the wallet, is preparing to separate its consumer and institutional businesses by the end of 2026.
The bigger story, though, is happening inside the wallet itself. MetaMask is betting that crypto security cannot depend entirely on users recognizing every suspicious address, phishing page or manipulative message on their own. As scams become harder to distinguish from ordinary online interactions, the wallet is increasingly being asked to make that judgment before the money moves.