Remove “Two-Factor Authentication Activation” email

The “Two-Factor Authentication Activation” email is a phishing attack that targets MetaMask users. The email falsely claims that the recipient’s crypto wallet is at risk because suspicious activity has been detected on their account. The recipient is asked to secure their account immediately and turn on two-factor authentication by clicking the button in the email. If users click the “Activate 2FA Now” button, they’ll be taken to a phishing site that asks for account recovery phrases. If users type them, they will be sent to the cybercriminals operating this malicious campaign.

 

This “Two-Factor Authentication Activation” phishing email suggests that due to some suspicious activity in your account, you need to secure it by clicking the “Activate 2FA Now” button and turning on two-factor authentication. If you do click the button, you’ll be redirected to a site that incorrectly states that your password cannot be recovered. The site asks that you validate your ownership by typing in your secret recovery phrases. This is a phishing attempt designed to steal your recovery phrases and gain access to your account. If malicious actors successfully gain access, they may be able to steal your funds.

Access to cryptocurrency accounts by malicious actors can lead to very serious financial losses. Phishing attacks are becoming increasingly more frequent, targeting various types of accounts. Thus, it’s essential that users learn to identify phishing attempts and suspicious emails. There are usually signs pointing to an email being potentially malicious. As long as users do not rush and carefully review all unsolicited emails, they should be able to recognize them.

If you’ve received this email and interacted with it, make sure to manually log in to your MetaMask account immediately and secure it to prevent any potential loss of your cryptocurrency.

The full “Two-Factor Authentication Activation” email is below:

Subject: Last Reminder: Urgent Two-Factor Authentication Activation

Urgent Two-Factor Authentication Activation

Your wallet account is at risk! We’ve detected suspicious activity on your account.

To secure your account immediately, please activate Two-Factor Authentication (2FA) by clicking the button below:

Activate 2FA Now

If you need any assistance or have questions, please contact our support team immediately.

Thank you for your prompt attention to this matter.

© 2025 MеtaMаsk. All rights reserved. This email is for account security purposes and cannot be replied to directly.

How to recognize phishing emails?

Phishing campaigns that target many users with the same generic email are usually identifiable as long as users know what to look for. These emails usually don’t have any personal details, are riddled with mistakes, and provide minimal credible information. In contrast, when a phishing campaign targets a specific individual or company, the emails are significantly more sophisticated and personalized. Such emails will typically be free from mistakes and will include details that lend them credibility. Nevertheless, most users will encounter generic and easily recognizable phishing attempts.

Checking the sender’s email address is one of the first things you should do when you receive an unsolicited email. This can be done using a search engine if the email address is not completely random and looks legitimate. While some email addresses may stand out, others can be cleverly disguised by modifying letters or adding extra characters. For instance, this particular “Two-Factor Authentication Activation” email is clearly from a malicious source, as the address looks completely illegitimate—no further inspection of the email content is necessary.

Another thing you should pay attention to is grammar and spelling mistakes in emails, as phishing emails often contain multiple mistakes. Although the “Two-Factor Authentication Activation” email does not have obvious mistakes, it nonetheless does not look like something MetaMask would send.

Another clear indication that you’re dealing with a phishing attempt or a malicious email is when an email uses generic words to address you or does not address you at all when the sender should know your name. Legitimate companies will always use your name to personalize their communication with you. Words like “User,” “Member,” or “Customer” are commonly used by malicious senders as they usually don’t have access to users’ personal information.

Finally, it’s a good idea to avoid clicking on links within emails altogether. If there’s an issue with your account that requires your attention, it’s better to access the account manually instead of clicking on a link.