MetaMask, the self-custodial wallet that underpins much of the NFT and EVM trading economy, is rolling out a new layer of protections against crypto scams. The update layers fresh scam warnings and an automatic transaction check on top of the address-poisoning defenses the company shipped earlier this year.

According to Decrypt's reporting, MetaMask is adding warnings for investment scams, romance scams, lookalike addresses, and first-time recipients, alongside clearer transaction screens. The centerpiece is a feature the company calls Added Protection, which automatically reverts transactions that do not match their previews — intervening when the transaction that would actually settle differs from what the user saw on the confirmation screen. It launches on the browser extension first, with mobile support described as coming later.

For a wallet that sits at the center of NFT minting, marketplace approvals, and EVM token swaps, scam surface area is a core infrastructure problem rather than a side feature. MetaMask Staff Product Manager Martin Peko told Decrypt on September 14, 2026 that the rollout reflects that reality.

Separating Confirmed Features From Reported Ones

It is worth distinguishing the newly reported warnings from what MetaMask has already confirmed, because the two sets of protections rest on different levels of verification. The company published its Address Poisoning Detection announcement on June 17, 2026, well before the September report. That feature compares a pasted recipient address against addresses the user has previously interacted with and issues a warning when the beginning and end match but the middle differs — the hallmark of an address-poisoning attack, in which a scammer seeds a victim's transaction history with a lookalike address.

The same official announcement introduced a first-time-send warning for addresses a user has never interacted with, and noted that MetaMask now displays more of an address's characters so lookalike swaps are easier to catch. By contrast, the Added Protection preview-reversion behavior described in September is attributed to Decrypt's reporting rather than to any current official release.

Availability and Setup

On the confirmed side, MetaMask states that Address Poisoning Detection is live on both Mobile and Extension across all EVM networks, with additional network support described as forthcoming in the June announcement. That breadth matters for anyone bridging or minting NFTs across chains such as Polygon, Base, or Arbitrum from a single wallet.

The September Added Protection rollout is narrower and less settled. Decrypt reports extension-first availability with mobile to follow, but no release version, precise mobile date, or complete network matrix has been published, and the feature's behavior on individual networks has not been documented. MetaMask's own news index did not surface a matching September announcement at the time of the report, so rollout timing should be treated as unconfirmed.

What the Update Means for Users

For active traders approving contracts and signing transfers throughout the day, the practical shift is a wallet that increasingly reasons about intent, not just syntax. That judgment carries particular weight in self-custody, where the signer is the final checkpoint before a transfer settles. MetaMask's security partner Blockaid uses large language models and classification models to analyze websites and social feeds, alongside static and dynamic analysis of on-chain bytecode and transaction flows, Peko told Decrypt.

Each capability maps to a documented scope rather than a blanket promise. Address Poisoning Detection targets the specific attack in which a scammer seeds a user's history with a lookalike address, per the MetaMask security announcement, while the September warnings extend coverage toward investment scams, romance scams, and first-time recipients, according to Decrypt.

The update also positions MetaMask alongside its broader push into guarded, permissioned wallet flows, echoing its agent wallet with spend limits and guard mode as well as its consumer-facing MetaMask Money account. The through-line is friction placed deliberately at the moment of highest risk.

Prompts, Not Blocks — With One Exception

Crucially, the address warnings are prompts rather than blocks. The June announcement states that users retain the decision over their transactions after a warning appears. Peko framed the design tension around users who repeatedly click past alerts, telling Decrypt: “This told us something specific: they either trusted the recipient far more than usual, or they were being actively coached past it.”

Added Protection is the exception that goes further than a warning, reverting a transaction that fails to match its preview. That is a stronger intervention than the address alerts, though it remains single-sourced and extension-only for now.

Security Limits and Practical Precautions

No claim in the coverage should be read as guaranteed safety. A current official document confirming the September Added Protection rollout, its scam-warning coverage, and its network scope was not located, so feature behavior and timing rest on Decrypt's reporting rather than independent verification. Until such a document appears, users should treat the September features as reported rather than confirmed.

The confirmed protections still leave decisions in users' hands: an address warning can be dismissed, and there is no documented recovery of funds once a transfer is signed and settled. Nothing in the available evidence indicates that Added Protection universally covers every network or reverses losses, and Decrypt itself frames the feature as extension-first.
The broader market backdrop was one of moderate greed. The Crypto Fear & Greed Index read 57, or “Greed,” while Ethereum, the base layer for MetaMask's EVM coverage, was changing hands near $2,503 on the day of the report. Neither figure measures scam-detection effectiveness, and no loss-prevention or detection-rate metrics have been published.

Looking ahead, the concrete milestone to watch is the promised mobile expansion of Added Protection, which MetaMask has said will follow the extension launch. For creators and collectors who sign approvals across marketplaces daily, that mobile parity — together with a formal release note confirming the September features — will determine how much of this protection actually reaches the wallets doing the most on-chain work.

Source: NFTENEX

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.