Fake support agents and 'staff' who contact you first

How real support teams actually reach you

Genuine support usually works through a ticket you opened on the platform's own help website or app, or through official notices in your account. Steam, for example, handles support through its ticket system on the Steam Support site. Discord's guidance says Discord staff will never ask for your password through direct messages.

Microsoft's guidance on tech support scams says Microsoft does not make unsolicited contact to offer technical support, that genuine error messages do not include a phone number, and that it does not ask for payment in gift cards or cryptocurrency. The same patterns apply across the gaming world.

If you are told something is wrong with your account, close the conversation and check the account yourself through the official app or website.

The same goes for emails. A message can display any sender name it likes, and some fake support emails come from free webmail addresses or lookalike domains. If an email asks you to act on your account, sign in separately and look for the same notice there. If it is not in your account, it did not come from the platform.

Platforms also publish their official social media accounts, which some use for status updates. They do not use replies on social media to ask for account details. If a 'support' account replies to your public post asking you to message them privately, check that it is the platform's verified account before engaging, and even then never share codes or passwords.

Fake helplines found through search results and adverts

Some people search for a support phone number when they are locked out and call the first one they see. Scammers buy adverts or create pages listing fake numbers. The person who answers asks for account details, a code or a remote connection to your computer, and may charge a 'recovery fee'.

Many game platforms do not offer phone support at all for account issues, or only offer it after you start a request online. Always start from the platform's own help site and follow its contact options from there. You can report a misleading advert to the Advertising Standards Authority, and a scam website to the NCSC.

Remote-access requests: the most damaging step

Remote-access tools are legitimate programs that let someone control your computer. In a scam, they let the caller see your screen, open your browser and email, and make purchases. Some scammers pretend to refund you and then claim they sent too much, asking you to return the 'difference'.

If you have allowed a stranger to connect:

1. Disconnect from the internet straight away.
2. Uninstall the remote-access program.
3. Run a full security scan.
4. Change passwords from a different device, starting with email and banking.
5. Call your bank on 159 if you used online banking or entered card details while they were connected.

Recovery scams that target people who were hacked

After a hack, people often post publicly asking for help. Scammers watch for these posts and reply offering to recover the account for a fee, claiming to be 'ethical hackers' or 'contacts inside the company'. They cannot do anything the official recovery process cannot, and many simply take the money.

Our hacked account triage explains the official recovery route for each major platform. Recovery can be slow, but it does not cost anything and does not require a third party.

Telling children who 'staff' really are

Children are often told by scammers that they will be banned and their parents will be charged. That fear makes them more likely to comply and less likely to ask an adult. A simple family rule helps: real staff never ask for codes or passwords, and anyone who says 'don't tell your parents' is not staff.

Our parents' guide covers communication settings that limit who can message a child in the first place.

Questions to ask anyone who claims to be staff

You do not have to argue with a fake support agent. You can simply leave. But if you are unsure, a few questions make the situation clear quickly:

• Did I contact you first, through the official help site? If not, why are you in my messages?
• Can I check this case myself in my account? Real notices are visible inside the account or in official emails.
• Why do you need a code? One-time codes exist so that only you can use them.
• Why is the payment a gift card? Microsoft's guidance says it does not ask for support payments in gift cards or cryptocurrency, and that pattern is a recognised fraud warning sign.

A genuine agent will be fine with you checking through the official site and coming back. A scammer will push harder, add new threats or go quiet. Any of those confirms you were right to stop. Then report the account using the platform's own report tools so others are not targeted.