Connect with us

Technology

How to spot wallet verification scam emails

Published

on

How to spot wallet verification scam emails

NEWYou can now listen to Fox News articles!

Recently, you may have received alarming emails like the one below from “sharfharef” titled “Wallet Verification Required” that uses the MetaMask logo and branding.

These messages warn you to verify your wallet by following a link, but scammers use emails like this to steal your crypto information.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

Advertisement

Scam emails posing as MetaMask alerts are tricking users into revealing their crypto wallet details. (Photographer: Wei Leng Tay/Bloomberg via Getty Images)

What is MetaMask and why scammers love it

MetaMask is a popular crypto wallet and browser extension that lets you store tokens and connect to blockchain apps on networks such as Ethereum. Because MetaMask is widely known and trusted, criminals impersonate it in phishing campaigns that ask users to “verify” wallets and then harvest recovery phrases or keys.

What makes this email a wallet verification scam

The scam email copies MetaMask visuals and even routes through a Zendesk address to look more professional, yet the “Verify Wallet Ownership” button points to an unrelated domain that has nothing to do with MetaMask. That mismatch between branding and destination is a major red flag in crypto phishing attacks. It also relies on classic pressure tactics and vague corporate language. The body reads:

Dear Valued User,
As part of our ongoing commitment to account security, we require verification to confirm ownership of your wallet.
This essential security measure helps protect your assets and maintain the integrity of our platform.
Action Required By: December 03, 2025
Your prompt attention to this verification will help ensure uninterrupted access to your account and maintain the highest level of security protection.

Phrases like “Dear Valued User,” “essential security measure” and “Action Required By” are common in phishing emails that pretend to be MetaMask and threaten restrictions if you do not comply. Genuine MetaMask support will direct you to metamask.io or official apps and will never ask you to reveal your secret recovery phrase through a link in an unsolicited email.

Advertisement

In this case, the message even claims to come from “МеtаМаsk.io (Support@МеtаМаsk.io)” . That display name looks like MetaMask Support, but the real sending address is an unrelated Zendesk subdomain, which is a classic red flag. MetaMask explains that legitimate support messages only come from specific official addresses, so anything else should be treated as a scam and ignored.

Why mention Zendesk can be misleading

Zendesk is a legitimate customer support platform that many companies use to manage tickets and notifications. Scammers sometimes route fake alerts through such services or spoof similar addresses, so messages look like real support tickets, which can fool users who associate Zendesk branding with trust.

In this case, the presence of a Zendesk-style address does not make the message safe because the link still leads away from MetaMask’s official website and asks you to react to manufactured urgency.

NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

Phishing messages urging MetaMask “wallet verification” direct victims to fake websites that steal recovery phrases. (Photo by Morteza Nikoubazl/NurPhoto via Getty Images)

Advertisement

Steps to stay safe from wallet verification scam emails

Taking the right precautions can protect your digital wallet and personal data from scammers.

1) Do not click suspicious links and use strong antivirus software

Avoid clicking buttons or links in unexpected wallet verification emails, even if they show the MetaMask logo. Instead, open your browser and type metamask.io yourself or use the official mobile app to check for any real alerts. Also, install strong antivirus software to detect malicious links, fake sites or malware that tries to capture your keystrokes. 

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Keep it updated so it can block new phishing infrastructure and known scam domains.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

Advertisement

2) Use official websites only

Always confirm that the address bar shows MetaMask’s official domain or your wallet provider’s genuine site before you sign in. If an email link sends you to a domain that looks odd, close it immediately.

3) Keep your credentials private

Never enter your secret recovery phrase, password or private keys on a site you reached by email. MetaMask support will not ask for that information, and anyone who gets it can empty your wallet.

4) Enable two-factor authentication

Turn on two-factor authentication (2FA) wherever your exchange or related accounts support it, since codes from an app or key add a barrier even if a password leaks. Store backup codes safely offline, so criminals cannot reach them.

REAL APPLE SUPPORT EMAILS USED IN NEW PHISHING SCAM

Criminals are spoofing Zendesk-style addresses to make fraudulent MetaMask support emails appear legitimate. (Photo by Felix Zahn/Photothek via Getty Images)

Advertisement

5) Use a data removal service

Data removal services can help reduce exposed personal details from data broker sites that attackers use to target victims by name and email. Less exposed information makes it harder for phishers to craft convincing wallet alerts tailored to you.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

6) Mark suspicious emails

Mark any fake MetaMask messages as spam or phishing in your inbox so filters learn to block similar attacks. You can also report phishing attempts through MetaMask and your email provider to help protect other users.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

Emails like the one from “sharfharef” use MetaMask’s trusted name, polished design and alarming language to push you into clicking before you think. When you slow down, check the sender, read the wording and confirm the website address, you strip scammers of their biggest advantage, which is panic.

What questions do you still have about protecting your digital accounts and crypto wallets that you want us to answer in a future article? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.

Advertisement

Technology

Microsoft’s next Xbox, Project Helix, won’t reach alpha until 2027

Published

on

Microsoft’s next Xbox, Project Helix, won’t reach alpha until 2027

We’re here at the 2026 Game Developers Conference, where Microsoft “VP of Next Generation” Jason Ronald is talking about a topic near and dear to many gamers’ hearts: the future of Xbox. Ronald says the next Xbox, codenamed Project Helix, will have a custom AMD chip with “an order of magnitude increase in raytracing performance” up to and including path tracing, and a next-gen version of AMD’s FSR upscaling technology that relies on machine learning and includes frame generation — which can improve the perceived smoothness of a game by imagining new frames between existing ones.

But don’t expect that next Xbox soon: Microsoft will begin sending out “alpha versions” of Project Helix to developers in 2027, Ronald revealed here at GDC.

Details about Project Helix.
Photo by Sean Hollister / The Verge

Ronald also confirmed that Xbox and Windows are getting closer together, beyond the fact that Project Helix will play PC games too. “PC is becoming an increasingly important part of Xbox. We’re bringing the best of Xbox to Windows itself,” says Ronald.

Microsoft is bringing the Xbox mode that originally shipped with the Xbox Ally handheld to more Windows computers “to select markets starting in April,” as well as Advanced Shader Delivery, which precompiles shaders so you can download them alongside a game or its updates, instead of having to wait when you launch a title.

Advertisement

Ronald says the Microsoft team’s been doing a lot of work behind the scenes to make the Xbox mode “feel distinctly Xbox” and feel the same as you migrate between devices and cloud. He says gamers play 3-5 games at any one time on average, and you should be able to pick up and play whether you’re on console, PC, or cloud.

As we spotted outside the keynote, Microsoft wants game developers to just build once for both Windows and Xbox, instead of building twice for both. It’s creating a unified development environment where “The vast majority of code that your game runs on Xbox is the exact same code that runs on other platforms,” says Ronald.

And while he isn’t promising all games will be this way, Ronald suggests that you won’t have to buy those games multiple times, too: the already-existing Xbox Play Anywhere program lets you buy once and “play on any screen,” he says. The catalog of Xbox Play Anywhere games now has more than 1,500 titles, Ronald says.

As part of the 25th anniversary of Xbox, the the game preservation team will also re-release an unspecified number of older Xbox titles under its Game Preservation program, Ronald says. “As one of the largest publishers in the industry, we feel a deep responsibility to preserve games from the past.” And he hints that “some of our most iconic first-party franchises are returning this year.”

A slide from an Xbox GDC 2026 presentation showing games that are part of game preservation.

Photo by Sean Hollister / The Verge

The news follows Microsoft’s recent announcement of the codename for its next-generation console, Project Helix, which the company says will play both console and PC games. That announcement about Helix was made by new Xbox boss Asha Sharma, who took over as Microsoft’s gaming CEO in February. Former Xbox boss Phil Spencer is retiring, and former Xbox president Sarah Bond, who had been seen as a potential successor to Spencer, also announced her departure.

Advertisement

Last year, Bond hinted that the next-generation Xbox would be more like a PC and noted that it would be a “a very premium, very high-end curated experience.” In her first memo since taking over Xbox, Sharma promised a “renewed commitment to Xbox starting with console,” and in her post about Helix, Sharma said the console would “lead in performance.” This week, Sharma also posted a picture of the original Xbox prototype, which Microsoft is showing at the GDC Festival of Gaming. We’ve got pictures.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.


Continue Reading

Technology

1 billion identity records exposed in ID verification data leak

Published

on

1 billion identity records exposed in ID verification data leak

NEWYou can now listen to Fox News articles!

Things like your name, home address, date of birth and even your Social Security number may have been sitting on the open internet. Researchers say an unprotected database tied to IDMerit, a company that claims to help businesses verify identities, exposed roughly 1 billion sensitive records across 26 countries.

In the United States alone, more than 203 million records were left unsecured. This involves the exact documents and details companies use to confirm you are really you. If criminals get that kind of information, they’d have everything they need.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

BE AWARE OF EXTORTION SCAM EMAILS CLAIMING YOUR DATA IS STOLEN

Advertisement

Researchers say an exposed database tied to IDMerit left roughly 1 billion sensitive identity records visible on the open internet. (Morteza Nikoubazl/NurPhoto via Getty Images)

What you need to know about the massive data leak

Researchers at Cybernews, a cybersecurity news and research publication, discovered an exposed MongoDB database on Nov. 11, 2025, that they believe belongs to IDMerit, a global identity verification provider that serves banks, fintech firms and other financial services companies. IDMerit uses artificial intelligence tools to help businesses perform KYC, short for Know Your Customer, which is the identity verification process required when you open financial accounts.

The database was not protected by a password. Anyone who knew where to look could access it. Inside were full names, home addresses, postal codes, dates of birth, national ID numbers, phone numbers, email addresses and gender information. Some records also included telecom-related metadata and internal flags that may have referenced past breaches.

The exposure affected people in 26 countries. The United States had the highest number of exposed records at more than 203 million. Mexico, the Philippines, Germany, Italy and France were also heavily impacted.

Researchers notified the company, and the database was secured the following day. There is currently no public evidence that criminals downloaded the data. Still, it’s worth noting that automated bots constantly scan the internet for exposed databases and can copy them within minutes.

Advertisement

YOU COULD BE SHARING YOUR SOCIAL SECURITY NUMBER WHEN YOU DON’T NEED TO

The unsecured database reportedly contained highly sensitive details including names, home addresses, dates of birth and national ID numbers. (Silas Stein/picture alliance via Getty Images)

How it happened and why it matters for you

When you open a bank account, sign up for a crypto platform or verify your identity for a financial app, you are often asked to upload a government ID and provide personal details. Companies like IDMerit process that information behind the scenes. That means this database likely contained the same details you would use to prove your identity to a bank or government agency.

For criminals, that is gold. With your full name, date of birth, national ID and phone number, scammers can attempt SIM-swap attacks. This is when someone convinces your mobile carrier to transfer your phone number to their device. Once they control your number, they can intercept security codes sent by text message and break into your bank or email accounts. They can also launch highly targeted phishing scams. Imagine receiving a call or email that includes your real home address and ID number. It would feel legitimate, and that’s exactly the point.

Because the data was neatly organized, criminals could sort it by country or other details and use automated tools to target huge numbers of people with scams.

Advertisement

We reached out to IDMerit for comment, but did not hear back before our deadline.

FIGURE DATA BREACH EXPOSES NEARLY 1M ACCOUNTS

Experts warn that data like this can help criminals launch SIM swap attacks and highly targeted phishing scams. (Kurt “CyberGuy” Knutsson)

8 ways you can protect yourself from data leaks

Before criminals have a chance to use this information against you, here are practical steps you can take right now to lock things down and reduce your risk.

1) Freeze your credit reports

Contact the major credit bureaus in your country and place a credit freeze. This prevents criminals from opening loans or credit cards in your name. Even if someone has your national ID and date of birth, lenders will not be able to access your credit file without your permission.

Advertisement

2) Stop relying on text message security codes

If your bank or email account still uses SMS codes for two-factor authentication, switch to an authenticator app instead. Text messages can be intercepted during SIM-swap attacks. An authenticator app generates codes directly on your device, making it much harder for criminals to break in.

3) Use a password manager

If attackers pair leaked identity data with passwords from older breaches, they can try to access your accounts. A password manager creates strong, unique passwords for every account, so one leak does not unlock everything else.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

4) Consider identity theft protection

Identity theft monitoring services can alert you if your personal information is used to open accounts or appears on dark web marketplaces. Early detection can mean the difference between stopping fraud quickly and discovering it months later. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com

5) Watch your mobile account closely

Log in to your mobile carrier account and enable extra security features, such as a port-out PIN if available. This adds an additional layer of protection so someone cannot easily move your phone number to another SIM card.

Advertisement

6) Run antivirus software on your devices

Good antivirus software can block malicious links, fake login pages and spyware that may be used in follow-up attacks. After a large data exposure, phishing campaigns often spike, and having protection in place can stop you from clicking into trouble. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Consider a personal data removal service

Your personal information is often scattered across data broker sites and people-search databases that sell access to your details. A personal data removal service can monitor where your information appears online and work to get it taken down. This reduces the amount of data criminals can find about you in one place, making it harder for them to piece together your identity and target you with scams or fraud. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

8) Be skeptical of calls that know too much

If someone contacts you and references your address, date of birth or ID number, do not assume they are legitimate. Hang up and call the official number listed on the company’s website. Criminals use real data to make fake stories sound convincing.

Kurt’s key takeaway

This incident exposes a larger problem. Companies that handle identity verification have become critical infrastructure for the digital economy. When one of them leaves a database open, the fallout spreads across countries and millions of ordinary people who never even heard of the company. You trusted a bank or app with your ID. That bank trusted a third party. Somewhere in that chain, basic security controls failed.

Should companies that handle identity verification face automatic penalties when they expose millions of people’s most sensitive data? Let us know by writing to us at Cyberguy.com.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading

Technology

How the spiraling Iran conflict could affect data centers and electricity costs

Published

on

How the spiraling Iran conflict could affect data centers and electricity costs

Soon after the Trump administration launched its war on Iran, I called up Reed Blakemore, director of research and programs at the Atlantic Council Global Energy Center, to talk about the consequences. While oil and gas prices were already on the rise, there was still more hope then that the impact of the conflict might be short-lived. At the end of our conversation, Blakemore said plainly: “Let’s have a call again [next week] … We’ll have a much clearer picture of what the conflict is going to look like and what the story really is going to be for energy moving forward.”

Energy infrastructure has become a key leverage point in the unfolding war

It’s a week later and the conflict has only escalated since the US and Israel launched strikes against Iran, killing Supreme Leader Ayatollah ​Ali Khamenei. Energy infrastructure has become a key leverage point in the unfolding war, with Israel hitting Iranian fuel depots and Iran targeting Gulf neighbors’ oil and gas infrastructure in its own strikes. Iran’s paramilitary Revolutionary Guard threatened on Tuesday not to “not allow the export of even a single liter of oil from the region to the hostile side and its partners until further notice.” Iran has reportedly also started to lay mines in the strategic Strait of Hormuz, through which one-fifth of global petroleum consumption and liquefied natural gas (LNG) trade used to move.

I talked to Blakemore again today about what Iran’s continued chokehold on the Strait of Hormuz means for energy costs and US tech companies’ rush to build out energy-hungry AI data centers.

This interview has been edited for length and clarity.

Advertisement

What’s your outlook now on how the conflict is likely to affect oil and gasoline prices?

Reed Blakemore: The fundamental issue right now, in terms of the energy implications of the conflict, is how the market is reacting to the uncertainty around safe passage through the Strait of Hormuz.

At the outset of the conflict when we saw insurance premiums going up for these ships, we were largely talking about it in the context of, Hey, it’s just gotten much more expensive for a ship to traverse the Gulf and therefore they’re staying out.

We’ve moved from that to actual concerns around the security of passing through the straits in the first place, so this is no longer an insurance cost issue as much as it is a safety and security issue.

We have virtually no traffic passing through the Strait of Hormuz. A lot of countries are beginning to shut in production. So there’s already this ripple effect emerging purely because the market and basically tankers are fundamentally concerned about whether or not they will be able to safely pass through the strait.

Advertisement

“There’s only so much that US energy dominance can do to shield US consumers”

The other feature that I think we’ve seen the market react strongly to in the past several days is a sense of how long this conflict is going to last. And I think you can look to the comments from the president in the last 72 hours and the market’s reaction as a major piece of evidence to that end. Moving into the weekend where the campaign had clearly escalated, the uncertainty around how open the Strait of Hormuz would or wouldn’t be was beginning to reach a fever pitch. The response from markets when they opened in Asia on Sunday going past $100 a barrel to nearly $120 a barrel is really a function of the market not having a sense that this would be over anytime soon. That pullback that we saw over the course of yesterday was in response to the president saying fundamentally that Hey, we have an end in sight to this conflict.

The United States is a major oil producer. I think the strategy of US energy dominance played a significant role in terms of shielding US consumers from the initial market consequences of the decision to go to war with Iran. The price increases we’ve seen thus far would have been much more responsive to the market volatility. That has bought the administration a little bit of time as it relates to how long until we see the gasoline prices really begin to pick up steam domestically. But as this conflict persists and the volatility in the market continues, we will begin to see upward pressure on gasoline prices, regrettably, over time.

There’s only so much that US energy dominance can do to shield US consumers from what is a globally traded market in terms of oil. Because the United States is a major domestic oil producer, it has the ability to put some downward pressure on its own gasoline prices.

But because via its oil exports it participates in a global market, it has that exposure to global oil market volatility.

Advertisement

Can we expect electricity prices to go up also? Why?

For the United States, the gas story is a little bit better, but not immune from the global market as well. Natural gas is largely regionally traded within the United States. The US is a major producer of natural gas for domestic consumption in a way that further insulates it. That makes the case of the United States much different than the gas price sensitivity we’re seeing in Europe or in Japan or other parts of East Asia.

The problem is similar to the oil story because the United States is a major LNG exporter. As natural gas prices increase elsewhere, LNG exporters will be incentivized to export more gas because that’s where the arbitrage opportunity is, and that will create the upward price pressure domestically in the United States.

What risks does that pose to tech companies and this push to build out more AI data centers and related energy infrastructure?

In the United States, the majority of the data center buildout has begun to be powered by natural gas. We’re not going to see electricity prices reach a crisis point in the United States in the short term because of this conflict. The time horizon that we’re talking about with gas and therefore electricity prices is likely in the time horizon of months rather than weeks you’d expect with oil.

Advertisement

However, the longer this conflict lasts and the more tightness we see in the global gas market — that will eventually permeate the United States and create that upward pressure on gas prices in a way which then affects electricity prices and then that brings the data center question into play.

I think the unique thing is it doesn’t necessarily affect the ability of data centers to purchase energy. Electricity costs are a relatively marginal proportion of the cost of building and operating a data center. What it does do is it only further inflames the energy affordability challenges that are currently deteriorating social license in the country for data centers. So the impact on electricity prices likely won’t directly harm data center buildout. The ancillary affordability challenges it will create will further entrench popular discontent with data center buildout, because data centers are simply making consumer electricity bills much more expensive.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading
Advertisement

Trending