If I had a dollar for every email I receive from Jagex telling me that my account is under investigation for suspected gold farming, I could afford to buy the internet. Look at the release of any big name MMO, update, or expansion, and you are bound to see a surge of account theft. Since anti-virus programs have come such a long way over the years, thieves have turned to the next, and arguably more reliable method of stealing your information: Tricking you into voluntarily handing it over. After all, writing viruses is at least somewhat difficult and involves a delivery method and the potential that anti-virus software will quickly swoop in and render your work useless. I know what it’s like to be lazy, occasionally I just hold my hand out and hope that a cup of coffee will magically appear. So think of account phishing as the Keurig machine of account theft…or something.

One of the most common methods I have seen over the years is the “your account has been banned” email, where the player is notified that their account has been disabled for one reason or another, and they need to log in and submit an appeal or process something. While some will still attempt at installing a virus, most will take the safe route by simply creating an exact copy of the official site with a slightly misspelled URL. The user enters their login details and sends them straight to the thief. The idea in this case is to scare the user, and the hope is that they will throw out rational thought and log in without thinking.

As with all methods, this has evolved over the years to become more subtle and cunning. When service providers initiated a process of locking accounts that were suspected of being stolen, emails began targeting users with “your account may have been stolen. Please log in to confirm your ownership.” Others masquerade as beta invitations, or promotional emails, other times just harmless “hey check us out,” etc. The idea with most of these is that the player does not log into the game first to check the status of their account and reveal the scam, and some ban emails will actually state “do not attempt to log into your account via the game client or your appeal may be denied.”

With this in mind, your best bet is to assume that any email you receive is fake until proven otherwise. If you do receive a notice that your account has been banned, do not click on the link in the email under any circumstance. Either log in with the game client or log into the game’s official website to confirm. In the case of beta invitations, if possible always check the developer’s website first. Often times they will have instructions on how to accept the invitation that does not involve the email link, and may even have warnings posted about fake emails with screenshots of said forgeries.

As for “please log in to confirm your ownership,” I can say with 99% confidence that game developers don’t send these out. If your account has been stolen, sending an email (which has likely also been stolen) to ask you to log in with the same credentials that have been stolen is pointless, it’s like a police officer asking you to prove that your driver’s license isn’t fake and accepting that same license as proof.