MetaMask Rolls Out Anti-Scam Overhaul: Added Protection Reverts Mismatched Transactions as AI-Driven Fraud Scales

MetaMask is changing how it fights scammers, and the reasoning behind the redesign says a lot about who is actually losing money

MetaMask, one of the most widely used self-custody wallets in crypto, is rolling out a new layer of scam defenses across its mobile app and browser extension. Announced on Monday, the update introduces warnings for lookalike wallet addresses, suspected investment and romance scams, and transfers to first-time recipients, alongside redesigned transaction screens intended to make risks obvious before a user signs anything.

The most interesting addition is a feature called Added Protection. According to MetaMask, it automatically reverts transactions that do not match their previews, closing a gap where a user approves one thing in the UI and something different is executed onchain. Added Protection launches on the browser extension first, with mobile support scheduled to follow. The transfer warnings cover both mobile and desktop from day one.

Why the old warning system was not enough

The backstory, as explained by Martin Peko, Staff Product Manager at MetaMask, is a candid admission about how warnings actually perform in the wild. Users were ignoring scam alerts, and the pattern in the data was specific: they either trusted the recipient far more than usual, or they were being actively coached past the warning by someone on the other end of a chat.

That second scenario is the important one. Modern pig-butchering and romance fraud operations run call-center-style teams that stay with victims through every step of a transfer, telling them exactly which screens to dismiss. A static popup cannot win that argument. “That’s what made us think a different kind of control was needed,” Peko said. “We’re also adding a route to priority support from this flow, so someone who’s uncertain can reach a person rather than simply being told to stop.”

In other words, MetaMask is treating the moment of a flagged transfer not as a checkpoint to block, but as a last chance to interrupt the social engineering. Routing a confused user to a human support agent mid-flow is a notably different philosophy from the industry’s usual answer of louder warnings and scarier red text.

AI on both sides of the fight

Peko also detailed how the wallet’s security stack is evolving. MetaMask’s security partner Blockaid uses large language models and classification models inside custom agent harnesses to analyze unstructured content across websites and social feeds at scale, combined with static and dynamic analysis of onchain bytecode and transaction flows to identify phishing, scams, and malicious behavior in real time.

The wallet then uses those findings to warn users before money moves. Peko described it as part of a broader shift from static warnings to responsive, contextual ones, and noted that much of it is already live: address poisoning alerts, first-time send alerts, and deeper security data on tokens and transactions. The choice of words is deliberate — attackers are using the same class of AI tooling to scale personalized scams and to disguise malicious transactions as ordinary ones, so defense has to automate at the same pace.

Address poisoning, the practice of generating lookalike addresses that mimic a frequent counterpart so victims copy-paste the wrong recipient, has been one of the most persistent low-tech exploits in crypto. Lookalike warnings attack it directly at the moment of transfer rather than expecting users to eyeball hexadecimal strings character by character.

The enforcement backdrop

The rollout lands amid an active stretch for enforcement against fraud infrastructure. In July, United States authorities seized more than 25 million USD in cryptocurrency tied to investment and romance schemes that prosecutors said defrauded thousands of victims across the United States and Canada. Earlier this month, the Secret Service froze 52.8 million USD in cryptocurrency linked to Xinbi Guarantee, a Telegram marketplace supplying services to scammers.

Those cases target the backend of the fraud economy. Wallet-level defenses like the ones MetaMask is shipping target the frontend, where victims actually authorize the loss. Both are needed: seizures rarely return funds quickly, and address-poisoning and approval-drain attacks are designed to look legitimate after the fact.

Timing against the Consensys split

The feature release also comes as MetaMask prepares for Consensys’ planned separation of its consumer and institutional businesses by the end of 2026. A sharper consumer-security story is a sensible asset for whichever entity holds the wallet after the split, since trust features are among the stickiest reasons mainstream users stay with a given wallet. Competition in the space is intense, and scam losses remain one of the loudest arguments against self-custody generally.

For the broader industry, the MetaMask update is a signal of where wallet UX is heading: fewer decisions delegated to users at the point of maximum pressure, more contextual intervention, and AI-assisted detection working quietly in the background. Bitcoin traded around 78,400 USD at the time of the announcement, with the wider market focused on this week’s Federal Reserve decision — a reminder that while price dominates headlines, the everyday loss problem the wallet is addressing never paused.

Whether Added Protection’s revert behavior satisfies users who genuinely intend unusual transactions remains to be seen; friction cuts both ways. But the underlying bet is clear: in a landscape where scammers have adopted AI coaching and lookalike tooling, a wallet that only shows static warnings is no longer competing. The company that wins self-custody’s next wave will likely be the one that intervenes successfully exactly when its user is being lied to.