Install Chain Insights
← All stories

Safety Academy · Story 13 · Fake wallet apps & updates

Same icon. Extra owner.

An urgent wallet update wants Vera’s recovery words.

Estimated 4 min read

FAKE WALLET APPS & UPDATES6 scenes

A search result offers a wallet update.

Vera searches for wallet update instructions. A prominent result claims her access will expire unless she updates at wallet-upgrade.example. The logo looks familiar; the source is unverified.

Vera
“The logo looks right.”
Illustration: A search result offers a wallet update.

Do not treat a search position or advertisement as proof of authenticity.

The fake app copies the familiar screens.

The linked page copies the real app’s screens and advertises a download. The scammer has spent more time on the icon than on anything customers would appreciate.

The Scammer
“Same buttons. Very different owner.”
Illustration: The fake app copies the familiar screens.

A copied interface can look polished. Appearance is not a security check.

The “update” asks for her recovery words.

The fake update page asks for Vera’s recovery phrase to activate the new version. She pauses without entering words or using the installer. Updating and deliberately restoring a wallet are different actions.

Vera
“An update wants to become my wallet?”
Illustration: The “update” asks for her recovery words.

Pause unexpected recovery prompts. A legitimate restore is a separate, deliberate action.

Captain checks the installation route.

Captain starts again from the maker’s independently verified website. They check its installation instructions, linked store listing and publisher identity. A polished icon or store presence is not enough.

Captain Obvious
“We are verifying the publisher, not the icon.”
Illustration: Captain checks the installation route.

Use the maker’s verified installation instructions. A store listing alone is not a guarantee.

Vera closes the fake installer.

Vera closes the fake installer page and follows the verified update route. If software had been installed, she would stop entering secrets and follow trusted device guidance; exposed words would remain compromised.

Vera
“Your update has been declined by common sense.”
Illustration: Vera closes the fake installer.

Removing malware is not enough to make an already stolen recovery phrase secret again.

Her recovery phrase never reaches the clone.

Her recovery phrase never reaches the clone. The real update comes through verified instructions. The scammer’s interface looks familiar, but Vera has checked who supplied it.

Vera
“I updated my suspicion instead.”
Illustration: Her recovery phrase never reaches the clone.

The habit: verify where software came from before trusting it with keys.

The useful bit

A download link can be the attack, even when the app looks familiar.

  1. Go to the maker's website yourself and install from there. Never from a search ad or a message.
  2. Check who published the app. An 'update' that asks for your recovery words is the attack.
  3. If a suspect app ran, stop typing secrets on that device. Uninstalling does not take back words you entered.

I already did this

Stop entering secrets on that device and follow official malware guidance. If you entered recovery words, the wallet is compromised even after uninstalling. Use a clean setup and MetaMask’s incident guide for a new wallet and remaining assets.

Sources & further reading