If a website, email or chat says your installed wallet extension must be updated, verify the request through the wallet's official documentation and the browser's extension controls before acting. Do not install an attached patch or enter recovery words into the page making the demand. A real update can exist while the message advertising it is fraudulent; authenticate the route, not just the version number.
Locate the installed item independently of the warning
Open extension management through your browser's own menu. Find the wallet you already use and inspect its details and version. Do this independently of the link in the warning. A page can imitate a browser or store screen, and a familiar icon alone does not identify the installed package. Record the exact item you are checking before deciding whether you need another download.
MetaMask's extension-management instructions describe reaching the installed item through Chrome or Firefox controls. Its update guide describes the official browser update route and checking the version under Settings and About. These are product-specific instructions; use the corresponding official guide for another wallet.
Compare the requested action with the actual update channel
| Request you received | Independent check | Decision boundary |
|---|---|---|
| Restart the browser for an available update | The wallet's official update guidance and installed item | Follow the verified route without using the unsolicited download |
| Install a second extension with the same logo | Official site link, store item and publisher | A matching name does not establish continuity |
| Load an unpacked patch from a chat attachment | Whether your actual product requires this workflow | Do not replace the production channel with an unverified build |
| Enter recovery words on an update page | Whether you deliberately started a verified restoration | Ordinary update instructions do not authenticate a seed-entry website |
| Approve new browser permissions | Origin, installed item and documented changes | A genuine browser prompt still needs review |
| Send crypto to activate the update | What operation the official documentation actually requires | A payment demand is not proof that it updates the package |
Chrome's Web Store update documentation describes publishers updating an existing store item. That helps explain why an established installation and its update channel matter. An attachment sent by a person claiming to be support is a different delivery route, even when its filename contains the same version shown in a genuine release announcement.
Check availability without rushing into reinstalling
The current MetaMask guide recommends the normal browser update process and notes that a full browser restart can be relevant. Closing a tab is not the same as restarting all browser windows. It also distinguishes manually installed developer builds from production-store installations. If your installation came from a manual build, read that specific migration guidance instead of assuming that pressing Update must fix its channel.
Do not remove a working wallet installation simply because an unsolicited page tells you to. A genuine change of installation can require a recovery plan for the accounts you use. Preserve your documented recovery material before following an official migration, including the separate needs of accounts not covered by the same backup. The problem here is verifying the update route, not improvising a new wallet-restoration procedure under pressure.
If the expected version is unavailable, record what the installed item and official channel show. Browser state, product differences and release availability can require investigation. Do not treat a stranger's promise of an instant patch as evidence that the normal channel failed. Use the official support route with the browser, extension version and exact observed message; never send the wallet backup as a troubleshooting attachment.
A fictional migration warning with a real version number
Imagine an email claims that your wallet must migrate to version V before you can use its balance. You independently find a genuine announcement for V, but the email's link opens a page requesting recovery words and an attached extension. The real announcement confirms that a release exists. It does not authenticate this email, its domain or the package. Continue through the independently opened official route and leave the email's workflow untouched.
In a second situation, the genuine browser identifies an updated installed extension and asks you to review permissions. That prompt deserves inspection, but it is not automatically equivalent to a fake website's seed request. Check the origin and what authority is being added. Google's extension management guidance is a starting point for the browser side. Do not approve merely to clear a warning quickly.
Recovery and update are separate reasons to enter secrets
Restoring a wallet in a verified installation is a legitimate feature. It is not the same action as entering a phrase into an unexpected update page. MetaMask's official FAQ highlights restoration as a context in which an existing phrase may be needed and warns about unexpected requests. Authenticate the installation and the reason for restoration before supplying recovery material.
An ordinary extension update is also different from signing an onchain transaction. Read any transaction or account-authorization request separately rather than assuming it is part of downloading new code. A site can combine a believable update story with a harmful signature request. The signature-phishing guide explains why a familiar-looking message may authorize more than a login.
- Stop the unsolicited workflow and retain the message or page address for reporting.
- Find the existing extension through the browser's own management controls.
- Open the wallet's official update guide independently and compare the documented channel.
- Review any genuine permission changes and preserve recovery access before a required migration.
- Check the resulting version through the installed wallet, not the warning page.
- If you installed an untrusted package or disclosed secrets, assess that exposure separately from updating.
If you already followed the prompt
Distinguish viewing the message, downloading a file, loading the extension and entering secrets. These establish different exposure levels. If an untrusted package ran or your own phrase was disclosed, use a trusted environment to protect affected accounts and remaining assets, and seek qualified help where needed. Installing a later genuine version does not itself prove that a previous secret disclosure has been undone.
Our wallet-download verification guide covers initial package verification. For a later no-account swap, check the order through the official site independently of any wallet-update demand. A successful swap does not authenticate an extension, and an order issue should not force you into a stranger's software-migration flow. Keep the installed-item check, update result and any security investigation as separate records.
FAQ
Should I follow a MetaMask update email?
Verify any claimed release through independently opened official instructions and the installed extension. A real release number does not authenticate an email link or attachment.
How should I check a MetaMask update in Chrome?
Find the existing extension through Chrome's management controls and follow the current MetaMask update guide. Do not replace that process with a patch supplied in chat.
Does an update-required message mean I must enter my recovery phrase?
The message alone establishes no such requirement. A deliberate restoration in a verified installation is a separate process that needs its own authenticity and backup checks.