Lolz, wut ur chars phishing skill?

What would you do if you received an email like this?

Clickz the link right?

Wrong

As pointed out on this question, your World of Warcraft account is probably the hottest phishing target after you bank account. The deal already looked to good to be true: 7 days of free playing? From an Activision owned company? Get out of here!

Actually that’s not entirely true, Blizzard does offer 7 free days of playing if you never played the game before or your account needs to be revived when an expansion comes out. But if you accepted the deal when you started (like I did), you’re not eligible any more.

So how do I know I’m getting phished?

Well first you need to recognize a scam. Epictoon summed up a few linkbaits they will use to lure you in:

• Your WoW Account is being investigated. (“Blizzard is investigating your account after finding evidence that it is being sold or traded, which is against the Terms of Service. Please click here to verify your account and avoid being banned.”)
• Your WoW Account is being attacked/ login failures. (“Blizzard has been alerted of 15 authentication failures in your login account. We have blocked these attacks but we recommend that you ensure your password is sufficiently complex. Please click here to secure your account.)
• Verify that you are the original owner of the account. (“Your World of Warcraft account has been compromised. To verify that you are the original owner of the account in question, please click here”)
• You have been selected to a closed beta invite. One example is this phishing scam email sent to us by an EpicToon fan:

Thottbot Legends has a few other identifiers:

• Bad Grammar, while you’d expect the scammers would be smart enough not to use bad grammar, if you do spot it, this is a huge red flag!
• Different From: and Sender:, I just checked my Spam box and found I had an email from: WoWAccountAdmin@blizzard.com, but when looking at the sender: bsunws@elr.net. Right…
• Is it really from Blizzard? The only real domains from Blizzard are: http://us.blizzard.com, http://eu.blizzard.com, http://us.battle.net,http://eu.battle.net. Anything other than that is definitely not from Blizzard itself.
• Badly formatted, the first picture shows some scammers put in effort when trying to scam you. But luckily most scammers follow the example of the above post, which makes it a lot easier to recognize!

Luckily our users also have some nice tips:

• Blizzard knows who you are, you registered remember? So they won’t address you as Player, but with the first name you used when creating your account, like so:

• Check the WhoIs record for the domains that are linked in the email. In the example from the Gaming question, the domain was registered on the 11th of March 2011 by some nondescript Chinese guy…

And lastly Blizzard has some guidelines too:

• Emails from Blizzard Entertainment will originate from an @blizzard.com or @battle.net address.
• Blizzard employees will NEVER ask you for your account password. No matter how legitimate an email may appear, if it asks for your password, it is not from Blizzard Entertainment.
• Correspondence from Blizzard Entertainment will employ proper spelling and grammar. If you’re able to spot multiple spelling and/or grammatical errors within an email, proceed with caution.
• Phishing emails will frequently offer free in-game pets or mounts, several days or months of game time, or Alpha/Beta invites to upcoming Blizzard Entertainment games. If the offer sounds too good to be true, then it probably is. Don’t accept any offer until you can confirm it’s official.
• Phishing emails will also frequently claim that an account has been found in violation of a specific policy and will be closed if the owner does not “verify ownership.” The “verification” process usually includes replying directly to the email and providing very detailed account information (name, password, email address, CD key, etc). This is not a standard practice of Blizzard Entertainment.
• In some cases, phishing emails will ask account owners to visit a malicious website instead. These websites will frequently ask the account owner to “log in,” a process which will require the both an account name and password. Through this process, these malicious websites able to glean your account information. If you are ever asked to visit a website linked within an email, please be extremely cautious and always double-check the destination of the hyperlink.

So after reading this post, hopefully none of our users should get caught in any phishing scams!