Hello. The aim of this post is to rise awareness and to bring this to the attention of the devs.
My girlfriend received an in-game mail today telling her that her account has been suspended and that she needs to go to a website (link given in the mail) and enter some information. The link seemed legit because it contained the correct http://account.guildwars2.com part. The trick was with the rest of the link, the domain, did not actually end with .com but was followed by another string of text, thus making it seem like it is a correct guildwars 2 site while it is actually not.
Heres an image of what the mail looks like (names removed):
https://lh5.googleusercontent.com/NWUQbyJEc5W0LaC_T2QwJWe7yd7-WrwzKAhQV2BNQBzKm-YyG_xICp5ADE1ZTccg6Rs-W33p7-k=w1896-h875
I opened the link on a virtual machine (just in case… you know
) to see where it led and it took me to a site which looks identical to the real Guildwars 2 site (see image below) that asked me to enter my e-mail, my serial code and my character name. I don’t know if they can get past the log in procedure with that information (especially with the IP check on top of that), but I guess they have some trick up their sleeve for that.
Here is what the site looks like:
https://lh6.googleusercontent.com/7LsrVRgwKCpan2-xvBaoPnDFntzvrB52E_4Ke8SHrsjFpdMFGXO2PUSe3-AANkUFJoVKBXAsAJI=w1896-h875
Anyway. If anyone receives an email like this then please don’t give away your account information and instead report the email sender to the devs. I think Arenanet would NEVER ask for your account details like that. Also, good job devs adding the little bar at the bottom saying “This mail is not from Guildwars 2 team”, it really helps in cases like this.
I hope this gets the relevant attention and that people don’t fall for the scam.
Happy exploring!
(edited by Khadez.4958)