A good clone looks better than you expect it to.
The logo is right, because they copied it. The card images are right, because they copied those too. The wording may be lifted sentence for sentence from the real site, which means it reads exactly as well. Every check your eye performs automatically comes back clean, and that is not a coincidence: everything your eye checks automatically happens to be the stuff that is trivially copyable.
MPay has warned about this publicly, which is worth knowing because it means the fakes are not hypothetical. Someone is running them right now.
One thing is not copyable, and it is the only thing worth checking.
The only official surfaces
Website mpay.cards. App app.mpay.cards. Bot t.me/MpayCardBot. Channel t.me/MpayCard. X at x.com/MpayCard. Instagram at instagram.com/mpay.card. Support @RomanPovolo, business @MemesGlo.
That is the complete list. Not "these and a few others". If a site is not on it, it is not MPay, regardless of how convincing the page looks or who sent you the link. We keep the same list on the security page so there is a second place to check it against.
Read the address the way a machine does
Here is the skill worth ten minutes of practice, because it generalises far beyond this brand.
Read left to right and stop at the first single slash. The part immediately before that slash is the domain. Everything after it is a path, and a path can say absolutely anything the attacker wants, including the real company's name.
Work through these. The real domain is in bold:
- mpay.cards.example.com (the familiar bit is only a subdomain)
- mpay-login.com (a hyphen is not a dot, so this is a different company)
- app.mpay.cards.example.net (same trick, longer runway)
- example.com/mpay.cards (everything after the slash is just a page name)
Each one contains the string "mpay.cards" and none of them is MPay. That is the whole technique, used four ways, and it works because people read domains left to right and stop as soon as they see something familiar.
Urgency is the tell that survives everything
Attackers cannot copy patience.
Every version of this scam needs you to move faster than you think, because thinking is what kills it. A limited allocation. A migration deadline. An account that will be closed. A card reservation expiring tonight. A verification that has to happen right now or the balance goes away.
Real payment products do not work like this. Nothing legitimate about opening an account requires you to hurry, and I cannot think of a single case where genuine urgency and a wallet connection arrive in the same message.
If a page is rushing you, that is sufficient grounds to close it. You do not need a second reason.
Where the link came from matters more than where it goes
Rank your sources honestly.
A bookmark you made yourself is the only one that is actually safe. Typing the address is next, assuming you type it correctly. Everything else is somebody else's choice about where you end up.
Search ads deserve specific suspicion. Impersonating crypto products through paid search is a well-worn route precisely because the fake result can sit above the real one, and the little ad label is not something most people register. A link in a direct message from someone who messaged you first is worse still. A QR code posted in a group chat is worst of all, because you cannot read a QR code before you follow it.
The seed phrase rule, which has no exceptions
Nobody at MPay will ever ask for your seed phrase. Not support, not the bot, not a moderator, not someone who says they are escalating your ticket.
There is no legitimate technical reason anyone would need it. None. Which makes this the single most useful rule in crypto: the request itself is the proof. You do not have to evaluate the story, judge how official the page looks, or work out whether the person seems credible. Someone asked, therefore it is a scam, therefore you leave.
Same logic for a deposit to reserve a physical card. The physical card has no announced date and no published price, so there is nothing to reserve and nobody who could take your money for it.
Two habits that make most of this unnecessary
Bookmark the app now, while you are calm and definitely on the right page, and use only that bookmark afterwards. This removes the decision from every future visit, and the decision is where the risk lives.
Keep the balance to roughly what you plan to spend. Not because MPay is risky, but because this is how anyone should treat any online card. A card holding forty dollars is a forty dollar problem at absolute worst, and topping up takes a couple of minutes whenever you need more.
And reveal your details only when you are about to use them. The CHECK screen exists so the number is not sitting on your display while you screen-share, and it is a small habit that costs nothing.
If something looks wrong, the official Telegram channel is where MPay posts warnings. They have done it before. That is how we know the clones exist at all, and it is a better source than anything you will find by searching.
