For some reason, I have been experiencing a major upswing in phishing emails regarding World of Warcraft. Not only that, but over the past few days I've also received some regarding my "compromised Aion account" (I don't play and never have played Aion). These are pretty much all landing in the Blizzard folder on my email account, since they are all spoofed to look like they're official emails from Blizzard.So, instead of deleting them all, or forwarding them all to hacks@blizzard.com, I do what I often do when faced with new data: I studied them.
Looking at the emails, I learned patterns and keys to identifying scam/phish emails. Some of them are quick and easy, some are blatantly obvious, and some are far more subtle. The worst one I have seen nearly exactly mimicks the real email Blizzard sends when you change your contact information or password, but it too has some dead giveaways.
One question I have heard asked in regard to getting these spam mails: "How did they get the email I use with my registered account?"
The short answer is: they didn't. They don't know you have a WoW account. They sent this out to general marketing mailing lists and they're hoping that they hit some people who do have one. That's why these emails are called "phishing" -- they're casting their lines and seeing who bites the bait.
Ever gotten a spam email from a bank you have never done business with? That's phishing. Same thing.
The important thing is this: the purpose of spam/phishing emails is to get you to give them data they don't have so they can steal your account.
So, without further ado, here are ways you can tell if a mail is legitimate or not.
1. Fake emails ask you for your account name and/or account password, OR they ask you to "verify your account information" on an online form. They do this because THEY DON'T HAVE IT. Blizzard has this information already and does not need you to "verify" it.
They attempt to get you to do this by frightening you into immediate action. There are two common scare tactics:
Scare Tactic #1: Your account has been reviewed and you are under suspicion for being hacked, or buying gold, or using powerleveling, or attempting to buy/sell your account. Only by verifying your account information can you clear your name and save your account.
Truth: If Blizzard suspects you of doing any of these things, they don't warn you. The first you will know of the "suspicion" is that you will receive a letter that starts out with "We are writing to inform you that we have, unfortunately, had to cancel your World of Warcraft account" and goes downhill from there. They don't warn. They just do it.
Scare Tactic #2: They send you a faked email that your contact information or password has been changed. The letter looks nearly identical to the real one Blizzard will send under those circumstances.
Truth: You can easily determine if this is true by going to Blizzard's account page yourself, logging in, and seeing if anything has been changed. If you can't log in, you have a problem and need to call Blizzard account services. A real Blizzard notice for a password change will not tell you to log into anything; it will tell you to phone Blizzard account services.
Fake emails will give you a link to a page where you can log in to try to see your account -- this is a simple capture program that will let you give the would-be hackers your login information. And if you look at the letter logically, it's incredibly stupid. First, it tells you that if you made the change yourself to disregard the notice. Second, it tells you that if you did not change it, follow this link to Account Services to review your settings. Well, if someone changed your password without your knowledge, you couldn't very well log into Account Services, could you?
In summary: Blizzard's emails about account changes will direct you to call them if you have questions or concerns. Fake emails will give you "handy" links to check your information online.
In fact, Blizzard never asks for verification of any information through any kind of linked web-based form. Never.
2. Fake emails never greet you by name.
Nearly all Blizzard emails start out with "Hello Jane," (substitute your own name of Jane; they will use the first name associated with this account). This is true for nearly all correspondence that actually comes from Blizzard, because unlike the spammers, they have your actual data.
Fakes will open with "Greetings!", or "Hello", or even "Dear Valued Blizzard Customer".
There is only one exception to this that I am aware of where a Blizzard email does not start off with a greeting. When you email something to Blizzard, they will send you a short automated response acknowledging receipt of the letter. But this is an easy cause/effect relationship; you send an email, you get a response acknowledging receipt, nothing more. In these, there is no greeting at all.
3. Fake emails do not go back to the same address they came from.
Most fake emails will seem to come from a legitimate Blizzard address, such as donotreply@blizzard.com. However, if you do reply, they don't go back that way.
Real Blizzard emails generally come from noreply@blizzard.com. If you hit Reply anyway, it will put "noreply@blizzard.com" in the To: field.
Fake emails will go to a different address -- and not a blizzard.com one. Just hit Reply and see where it goes. Don't hit Send, though, because all you will be doing then is verifying to the recipient that this is a legitimate email address.
On that note:
4. Fake emails often include links that don't go where they say they go.
To repeat: Blizzard will never link to any form that asks you to verify your information. But some try anyway, and many include spoofed web addresses that look like they go one place but actually go somewhere else.
The most subtle of them will make an address that may appear legitimate, such as wowadmin-blizzard.com, but that is an entirely different domain. Dashes are like any other character in a domain name. What they are hoping you will think when you see it is that it's actually a subdomain, like us.blizzard.com, which is a legitimate name. The periods are signs of subdomains. The dashes are just other characters.
Some of them will also do subtle misspellings, like worldofwarcrarft.com or wor1dofwarcraft.com (play spot the inconsistencies!). One fun thing I do (OK, I think it's fun) is to copy these and look them up in the Whois database. One of the ones I found recently is owned by a couple of Chinese men in Toronto.
They may appear legitimate in the email, but it's very easy to have a link show as one thing and look another; it's a basic function of HTML email. See, I can make a link that looks like http://www.blizzard.com, but if you hover your cursor over it, it shows a completely different address. It's a quick way to check links.
5. Some fakes are obviously written by non-native speakers.
Most of them aren't that stupid and very closely mimic the appearance of a real Blizzard email. Some even use it as a standard boilerplate and just change a few things here and there. However, occasionally you get a doozy, like this one I received the other day:
"Today, we are do all activities of the World of Warcraft accounts a routine check. We have evidence to show that your account transactions involved in the disputed. Please visit our web site as soon as possible to clarify [bad link removed] otherwise we will lock your account."
Don't expect all would-be hackers to be this stupid, but it's worth mentioning anyway.
On the subject of stupidity, I got another good one just today that appeared to come from NCSoft. However, both the subject line and the enclosed email were about a supposedly compromised WoW account. For those of you who don't know, NCSoft is the company behind Aion. Looks like the hacker had some cut and paste issues.
So, in summary, fake emails:
- ask you for information Blizzard should already have
- ask you to verify information online
- do not address you by name
- have return addresses that don't match when you hit Reply
- have spoofed web links that don't go to the place they say they go
So what can you do to increase account security?
Buy an authenticator or use the mobile authentication application for certain phone models. This is your absolute best and strongest defense against hacking. There have been a very, very few cases of people getting hacked despite the authenticator -- back in mid-2008 there were some reports of authenticators being removed from people's accounts without their knowledge, but hopefully whatever loophole existed then has been closed. While I have seen many of my friends' accounts hacked, not a single one of them had an authenticator on their account at the time. They have all gotten it since. Get it. Get it now.
Read - don't react. If you get an alarming email about your account being threatened with closure, read it. Remember, Blizzard closes without warning. Analyze the letter and pick out the common weak points of spam.
If you're concerned about your account, pick up the phone. Blizzard never asks for verification over the web. If you have a concern or question about your Blizzard account, call Blizzard.
Use a strong password. There was something on the news recently about large numbers of people who still use passwords like "password", "12345" or "abc123". Sure, it should be something you'll remember, but it shouldn't be something anyone can guess easily. A phrase or quote can easily be turned into a strong password; something like "Pee-Wee's Playhouse" could be turned into "p33weEzpl4yHwz". Microsoft has a good password strength checker and suggestions for how to create strong passwords.
Consider opening an email account only for your game account, particularly if you don't have an authenticator. Most email lists come from the web. If you use your email anywhere else -- forums, websites, contacts for anything -- someone will harvest it. If you make that email account name something similar to a strong password, like p33weEz@yahoo.com, it's also very unlikely anyone will guess it. Since Blizzard made the decision to make your Battle.net ID the same as your email account (a decision I disagree with -- your very discoverable email address is half your security if you don't have an authenticator), you can further fox would-be hackers by making your email address difficult as well.
Help Blizzard by forwarding any suspicious emails to hacks@blizzard.com. You'll get an immediate automated message with no greeting.
Don't worry.
This one's for real.



