The dangerous part of a clone is how ordinary it looks. The logo matches. The card images look familiar. The copy may even be lifted word for word. Then the page asks for your wallet connection, your deposit, or details that should never leave your hands.
MPay has warned that fraudulent websites are copying its content to impersonate the service and target user assets. Treat every link as untrusted until you check where it actually leads. A familiar design proves nothing.
Start with the official surfaces
Keep this list somewhere you can check without relying on a message from a stranger:
- mpay.cards
- app.mpay.cards
- t.me/MpayCardBot
- t.me/MpayCard
- x.com/MpayCard
- instagram.com/mpay.card
- Support: @RomanPovolo
- Business: @MemesGlo
Type an address yourself when you can. For the web app, the live address is app.mpay.cards. The official marketing site is reached through the MPay web surface, while the app is separate. A clone may use the same name in its page title, profile picture, or browser tab. The address is what matters.
You can also begin from the MPay security guide and keep the official channels in your bookmarks. Don’t trust a new account that claims to be support simply because it uses the same avatar. Scammers copy those too.
Read the domain, not the decoration
Here’s the useful habit: read the address from left to right and stop at the first single slash. The part before that slash is the domain and path begins after it. In a simple address such as https://app.mpay.cards/login, the host is app.mpay.cards, and /login is only the page location.
Scammers count on people reading only the first familiar word. These addresses are not MPay surfaces:
- mpay.cards.example.com
- mpay-login.com
- app.mpay.cards.example.net
- example.com/mpay.cards
In the first example the real domain is example.com. The second belongs to mpay-login.com, the third to example.net, and the fourth is fine: everything after that slash is just a path on example.com. A dot in the wrong place changes everything.
Watch for spelling changes, added words, unusual endings, and lookalike characters. A secure padlock doesn’t settle the question. It means the connection is encrypted to that address, not that the address belongs to MPay.
Search ads deserve extra suspicion
Search results can be useful, but the first result isn’t automatically the real one. Attackers sometimes buy ads for phrases such as “MPay card” or “MPay login” and send visitors to a page built to collect wallet connections or deposits. The result may appear above the genuine site and carry a small “Sponsored” label that’s easy to miss.
So don’t use a search ad as your source of truth. Check the domain character by character, open the official address directly, or use a bookmark you made after verifying it. Search for information if you need to, but don’t let an ad choose the door through which you connect a wallet.
This matters most when you’re in a hurry. A fake page may claim your card will be closed, your top-up will expire, or your account needs immediate verification. That pressure is deliberate. It shortens the time you spend checking the address.
Real security rarely needs panic. Close the page. Find the official channel from your own saved list. Then check the situation there.
A wallet prompt can be the whole attack
Here’s a blunt rule: if you reached a page from a random DM and it puts a “Connect wallet” button above the fold, treat the prompt itself as the attack.
Above the fold means the part visible before you scroll. A polished clone may show a card graphic, a countdown, and a large wallet button before explaining anything. The design is there to make the transaction feel routine. It isn’t proof that you’re on MPay.
Don’t connect a wallet just to inspect a page. Don’t sign a transaction because someone says it’s needed to “verify” your card. Don’t approve a token transfer you don’t understand. If a message promises a special card, a private allocation, or urgent account recovery, leave the page and verify the claim through an official surface.
No MPay channel will ever ask for your seed phrase. Not in a DM. Not in a support chat. Not in a form that looks official. Never send it, type it into a website, or store it in a browser extension prompt. Anyone asking for it is trying to take control of your wallet.
Physical-card reservations are a useful scam story
The MPay Physical Card is coming soon. It isn’t out yet, and MPay has not announced a launch date or price. That gives scammers a simple script: “Reserve yours today,” “pay a refundable deposit,” or “secure early access before the list closes.”
Don’t pay a reservation fee based on a DM, a pop-up, or a page that copied MPay’s card art. There is no published date or price for you to confirm against. A countdown timer is not an announcement.
The physical card is described as a future product. The physical card page should not be treated as evidence that orders are open, and a clone may copy that page almost perfectly. Until MPay publishes clear ordering information through its official surfaces, keep your USDT and USDC where they are.
The virtual Visa card is live now. That doesn’t make every page offering it genuine. For legitimate product details, start with the how MPay works page or the app address you verified yourself.
Use habits that make mistakes harder
Bookmarks beat search when money is involved. Save the verified MPay site and app addresses, then use those bookmarks instead of typing the brand into a search engine each time. Check the address again after a redirect. A bookmark can be changed, too, so don’t stop checking forever.
Keep only what you need available on a card. A small balance is sensible, especially because some merchants may make a $0 pre-authorisation check before a payment. ChatGPT, Claude, Spotify, Netflix, and Amazon are examples mentioned by MPay. A small available balance can help with those checks without leaving more funds exposed than necessary.
And reveal card details only when you need them. In the MPay app, tap the card, hit CHECK, and then view the details. Don’t paste the CVV or expiry into a support chat, a prize form, or a page reached from an unsolicited message.
For deposits, check the asset and network before sending anything. MPay accepts USDT on BEP20, ERC20, and TRC20. USDC is accepted on BEP20, ERC20, and Base. Other networks and crypto assets will not be credited. A clone may use the right branding while showing you a wallet address that has nothing to do with the service.
If the address is wrong, the message is urgent, the offer is private, or the page asks for a seed phrase, stop. Open your bookmark and start again from a verified surface.
