Phishing attacks targeting gamers are on the rise as in-game content grows more valuable and easier to resell. Don’t risk losing your hard-earned items or your account. Here are the top phishing methods every gamer should watch out for.
1. Fake Giveaways
Fake giveaways are one of the most common and effective phishing tactics in gaming. Giveaways are a normal part of the gaming world, hosted by both game developers and third parties, which makes them easy to trust. However, scammers exploit this by creating fake giveaways that promise tempting in-game rewards, only to steal your game account details.
These schemes often take place on social media or streaming platforms like Facebook, Twitch, or YouTube, where they advertise free games or exclusive in-game items. To claim these “rewards”, you’ll likely be asked to log in to a website using your game account credentials. Unfortunately, these sites are fake and designed solely to steal your login details.
How to Spot Fake Giveaways
Fake giveaways often seem too good to be true and rely on urgency or scarcity to pressure you. If an offer appears overly generous or unrealistic – like something that could disrupt the game economy – it’s likely a scam.
Real giveaways typically require nothing more than your in-game name to participate. If the event is organized by game officials, they’ll direct you to log in only on the game’s official website.
No matter how convincing the giveaway seems, never enter your username or password outside the game’s client or official website. Even if a page looks authentic, double-check the URL carefully for slight misspellings or alterations that signal it’s a fake.
For third-party logins like Battle.net or Steam accounts, make sure the URL exactly matches the official pages for authentication.
2. Malicious Game Trading/Auction Websites
Many game trading and auction websites operate without any affiliation with official games. While some are legit, they’re still managed by third parties, meaning there’s no assurance of how they’ll handle your data. Scammers often exploit this by creating fake websites to steal game credentials and payment information.
These fake sites mimic trading platforms for popular games, listing in-game items at tempting discounts. When users attempt to buy, they are prompted to log in using their game account to “link accounts” or to enter payment details to complete the purchase. However, instead of facilitating a transaction, these sites harvest your information to hack your account or make unauthorized purchases.
How to Avoid Fake Auction Websites
Fake auction websites often deal in items or services that breach a game’s terms and conditions – like selling in-game currency for titles that prohibit Real Money Trading (RMT). So if the website sells such items, it’s best to avoid them.
Always verify that the platform uses trustworthy payment gateways instead of requesting direct bank transfers or unregulated manual payment methods. Legitimate sites will also feature clear dispute resolution processes or refund policies, indicating accountability and customer protection.
Additionally, linking accounts isn’t required for transactions on legitimate trading sites, so never provide your game account details. If you have to provide credit card details, try using a disposable virtual card instead.
3. Emails by Popular Gaming Platforms Asking to Log In
Names of popular gaming platforms like Steam, Epic Games, or Riot Games are often used to create trust and manipulate users into opening phishing links. They can use a similar email address to the official game platform along with the logo and professional writing style.
In most cases, the email will create a sense of urgency or fear, like “Your account is blocked due to suspicious activity”. You’ll then be directed to click on the link to login and verify. If you do log in, your account will be compromised.
Thankfully, spotting such emails isn’t any different from spotting any other phishing email. First, check the sender’s email address and ensure it exactly matches the platform’s email. The provided link should also have the same URL as the official website. You can hover your mouse cursor over the link to view it without clicking on it.
Webpages can be designed to look similar to official platform websites, so don’t get fooled by it. If unsure, access the official website in a separate tab and log in.
4. Fake Tournament Sign-Ups
Fake tournament sign-up is another phishing attack method that takes advantage of player’s enthusiasm. Since tournaments are a great opportunity to show off your skills and earn some nice rewards, it can make gamers less cautious when judging a tournament’s legitimacy.
Hackers usually offer big rewards and allow players from all skill brackets to compete. However, they will eventually find a reason to ask for your game’s login details to steal. They might even use the tournament fee as an excuse to steal credit card details.
How to Catch Fake Tournament Sign-Ups
First, try to limit yourself to popular tournament-hosting websites like Challengermode or Battlefy, which cover most of the popular games. Avoid signing up for tournaments on unknown websites even if a friend gives you the link (their account might be hacked!).
If you do have to sign up, look for the following telltale signs of fake sign-ups:
- Unrealistic prize pools. Most legit ones are usually below $1000, only big tournaments with very strict criteria have bigger prize pools.
- No data on the tournament host and their previously arranged tournaments.
- The criteria to enter the tournament are too low even with a big prize pool.
- The website is nothing more than a page to sign up with no other details.
You should also search the tournament hosting website online to see what people are saying about it. It goes without saying, no tournament requires your game account login details to sign up.
5. Phishing Links in Game Chat
There’s a reason why most of the games with in-game chat have a dedicated warning when you try to open a link from the chat. Targeted Phishing attacks are often executed through in-game chats where the main audience is already active.
They can advertise in chat a helpful tool for the game, a hack bot, or even a tempting giveaway with a link to the source. Maybe another player will also follow and say something nice about the advertisement to convince other players. However, the phishing website will ask for account details to access whatever was advertised.
You should never access a link from in-game chat unless you know exactly where it leads. Read the full URL and make sure you know the destination and actually want to access it. For example, for discord links, it should have “discord.com” in the URL. If you don’t know the destination, it’s better to not take risks. Not only it could be a phishing attempt, but it could also be dangerous malware!
6. YouTube Videos With Links to Phishing Websites
YouTube is probably the first stop for most gamers to learn more about a game and ways to get better. Of course, this makes YouTube a prime target for scammers to entice gamers into clicking phishing links.
Scammers often make videos about free in-game currency, skins, or bots that you can easily claim by accessing the link provided in the description or comments. You obviously can’t gain the in-game stuff without logging in, so many gamers take the bait and enter game account details in the fake webpage.
How to Detect Phishing Links in YouTube Videos
In most cases, these links are added to videos demonstrating impossible or illegal things like unlimited in-game currency or automation hacks. So it’s a good idea to stay away from videos that claim such things that game developers don’t allow.
The channel’s popularity and history are often a clear giveaway since scammers can’t create a big following with fake content. The channel will either be new or with a very low number of subscribers.
Furthermore, the comments are often turned off for such videos, or full of fake comments praising the website. If you see multiple signs like this, it’s better to stay away.
Your in-game progress is worth the extra care – treat every unexpected offer or link as suspicious until proven safe. If your account ever gets stolen and you have to start again, here are some tips to progress faster in online games.
Image credit: Vecteezy
