Fake game login pages: how phishing steals accounts

Reading a web address before you type anything

The address bar is the most reliable clue. The part that matters is the main domain, the words just before the first single slash. Everything before it can be made up. A link such as login.yourgame.account-check.example belongs to account-check.example, not to the game.

Discord's own safety guidance gives examples of lookalike spellings that swap or double letters. Scammers also use letters from other alphabets that look the same as English ones, so a quick glance is not enough.

The safest habit is simple: do not sign in from links at all. Open the app you already have installed, use a bookmark you saved yourself, or type the address. If the message was real, you will see the same warning or reward when you get there.

On a phone, the full address is often hidden. Tap the address bar to see all of it before typing anything, or press and hold a link to preview where it goes without opening it. Shortened links hide the destination entirely, which is another reason to go to the service directly.

Why 2-step verification can still be beaten by a fake page

2-step verification (2SV) stops someone who only has your password. The NCSC recommends turning it on for important accounts, and it remains one of the most useful protections you can add.

A live phishing page can still get around it. While you type your password and code into the fake page, the scammer types them into the real site at the same moment. The code works because it is still fresh. This is why no genuine service asks you to read out or retype a code anywhere except its own app or website.

Stronger options help. Authenticator apps and in-app approval prompts are better than codes sent by text, which Discord notes can be intercepted. Passkeys, where a platform offers them, are tied to the real website and will not work on a lookalike address.

The 'vote for my team' and 'is this you?' messages

Many phishing links arrive from a friend's account that has already been taken over. Because the name is familiar, people click without checking. Common openers include:

• 'Can you vote for my team in this tournament?'
• 'Is this you in this video?'
• 'I'm giving away my old items, sign in here to claim.'

The vote or prize page then asks you to sign in with your game account. Several game platforms' own support pages warn about versions of this trick, so check your platform's security page if you're unsure. If a message from a friend feels slightly off, contact them another way, such as a text or a call, before you click anything.

Fake pages that appear inside another page

Some phishing sites draw a fake browser window in the middle of the page, complete with a fake address bar showing the right website. It looks like a normal pop-up sign-in.

One way to check is to try to drag that window outside the edge of the browser. A real new window can move freely; a drawn one stays trapped inside the page. If in doubt, close the whole tab and sign in through the app instead.

Password managers help here too. They fill in your details only when the address matches the site they were saved for, so a password manager that refuses to fill is a useful warning sign. The NCSC suggests password managers as a way to create and remember strong, separate passwords.

Reporting the page so others are protected

Reporting takes a minute and helps get pages taken down. In the UK:

• Forward scam emails to [email protected], the NCSC's Suspicious Email Reporting Service.
• Forward scam texts to 7726, which most UK mobile networks support for free.
• Report a scam website through the NCSC's online website reporting form.
• Use the report button in the game, chat app or social platform where the link was posted.

If you have lost money or your account has been used for fraud, report it to Report Fraud, the service that replaced Action Fraud in England, Wales and Northern Ireland, or to Police Scotland. The full list is on our hacked account page.

Phishing beyond email: texts, adverts and search results

Fake login pages do not only arrive by email. Gamers often meet them through:

• Text messages claiming a purchase failed or an account is on hold.
• Paid adverts at the top of search results that lead to a lookalike of a game's website.
• Comments and replies under videos and posts, especially around new game launches and seasonal events.
• Chat servers where a 'bot' posts a link to claim a role or reward.

The NCSC's phishing guidance covers emails, texts, websites and calls together, because the same tricks move between channels. The answer is the same each time: go to the service directly rather than through the link, and report what you received. Misleading adverts can also be reported to the Advertising Standards Authority.