Guild Wars 2

Hello guys,

I’m new here so…bear with me
On Monday (27th of May)…I got this mail from Anet and I don’t know if it’s really from them or not…anyway I don’t know why should I get this mail or at what exactly they are refering to…I mention that it’s true I have installed the GW2 game on 3 PCs..one at work and 2 at home…..‘cuz when my housband works on one, I can play on other one…So now I came with one question WHY THIS E-mail?I haven’t made currency transactions and the login…well I know my pass and user…maybe someone else is trying to access my account?

“Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[[REDACTED LINK]]

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

Need help or have questions about your account? Please visit our: [[REDACTED LINK]]

Thx in advance…
Ali

This is a phishing email trying to gain access to your account. Please remove all links from your post to prevent others inadvertently visiting the scam website.

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2106371

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/page/10#post2122952

Welcome to Tyria! =)

I received this one today …….

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://en.supportaccount.guildwars2.com/AccountVerification/login?

Recently, account abuse is obviously rising up. Please pay attention to the safety your account. Don’t share account with any other people. We will not ask for your email password in any forms on our end. With the password, hackers will be able to log in the account through our security verification. If you have any account problem, please click on the link below:
https://Support.guildwars2.com/account/login?

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

Need help or have questions about your account? Please visit our: https://support.guildwars2.com/.

The Guild Wars 2 Team

checked ip looks like it was coming from Atlanta to Tasmania then to me

Gaile Gray.6028:

Tanith.5264:

I got the “mystery gift” one today as well.

Gaile, I’d offer to PM it to you in its entirety, but it’s already posted multiple times in this thread. Of course, if it will help, just say the word.

I’m tempted to simply reply to the email informing them that I’m investigating them “for further investigation be” and demanding that they send my Balthazar-blasted mystery gift at once.

Thanks — I have that one.

Personally, I would not respond to that thing. I’d delete it, using rubber gloves and tongs.

Yessum. So others have advised me, and so I have done. It’s fun to think about, though.

I just got this one a few minutes ago. Is it legit? Usually phishing attempts go straight to my spam filter but seeing as this one got through to my inbox it got me concerned.

Depotboy.6204:

I just got this one a few minutes ago. Is it legit? Usually phishing attempts go straight to my spam filter but seeing as this one got through to my inbox it got me concerned.

It’s not legit. If you check the link in your pic again, it ends with a weird “.mxnz.pw”. That gives it away that it is a phishing mail, probably of a new kind if it has passed through your filter. Just put it on the spam filter too.

Depotboy.6204:

I just got this one a few minutes ago. Is it legit? Usually phishing attempts go straight to my spam filter but seeing as this one got through to my inbox it got me concerned.

Yep, got this one today through (went through my spam filters as well). Hovering over the links will show that they’re a redirect and obviously a phishing scam. It’s a pretty clever one though, as the grammar is decent and the writing style + phrasing is similar to real support messages

just got this, almost had me fooled until i saw that tiny little error in their subject line. rookie scammer mistake.

I have recently received an email which I havn’t seen posted before. A picture of the email has been attached, I would like some more information on whether this is just a phishing email or something else? The IP address comes from Los Angeles unlike others that come from Korea and China.

Thanks in advance!

Wynter.5431:

I have recently received an email which I havn’t seen posted before. A picture of the email has been attached, I would like some more information on whether this is just a phishing email or something else? The IP address comes from Los Angeles unlike others that come from Korea and China.

Thanks in advance!

I think the poor grammar is one giveaway. Not to mention the password card and free gift. This is just another phishing email.

Thank you for notifying me, its something I was unsure about and would like to ask.

Much appreciated.

Wynter.5431:

Thank you for notifying me, its something I was unsure about and would like to ask.

Much appreciated.

You are most welcome. You can read more about phishing emails here:

https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2106371

and here:

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/first

See you in Tyria! =)

I doubt this is legit, grammar is pretty good other than a couple parts.
Links look strange.
How the heck could they have my email? It was sent to my GW2 email that is not used for much of anything else. Its not used for facebook or any other game related stuff.

I received several of them everyday, the worst part is that sometimes are also for allowing an IP and i must read carefully for knowing if is a verification from me or from the hackers
I haven’t static IP and this is a problem

Hey all,

I’m not sure if this may have happened to any of you, but I keep receiving E-Mails, stating:

“Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.

Email link removed to prevent temptation to click

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site:

Link removed again, to remove risk of myself getting in trouble!

The Guild Wars 2 Team"

I’m just a little worried about the legitimacy of this, and I was wondering if any of you have gotten the same sort of thing, on one hand, I want to click it, and do what it says, in case it’s real, as I don’t want to lose my account!

On the other hand, if I click it, and it’s not legitimate, I WILL lose my account, so please, help!

Virule

Hello, this should answer your question

https://forum-en.gw2archive.eu/forum/info/news/E-mail-from-ArenaNet

And this thread:

https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/first

Here’s the situation: I’ve been getting weird messages supposedly from ArenaNet with the content in [LINK REDACTED] I thought it could be some kind of phishing attempt, since after the first time I followed the mail’s link and input my information, I couldn’t log into the game with it.

But the thing is, I’ve been getting them from time to time and today, I decided to use an online link scanner and it gave me [LINK REDACTED] these results. I’m now in a situation in which I don’t understand what I should do in fear it’s a really elaborate phishing scheme, because the message doesn’t quite elaborate on the problem.

WhatThePuck.5201:

Here’s the situation: I’ve been getting weird messages supposedly from ArenaNet with the content in [LINK REDACTED] I thought it could be some kind of phishing attempt, since after the first time I followed the mail’s link and input my information, I couldn’t log into the game with it.

But the thing is, I’ve been getting them from time to time and today, I decided to use an online link scanner and it gave me [LINK REDACTED] these results. I’m now in a situation in which I don’t understand what I should do in fear it’s a really elaborate phishing scheme, because the message doesn’t quite elaborate on the problem.

It’s a phishing email. https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/first

If you have entered your information on other scam sites, as stated above, you need to change your passwords for the game account and the email address associated with your game account.

Sorry man, it’s a phishing scam. You can see more info here:
https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read/first
https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2148298

Edit: Inc always beating me to the punch. shakes a tiny fist

Lol…I will try to type more slowly, blue!

I just verified the IPs of 2 of the messages, and they both come from China, with one in particular catching my eye in LookIP. It had “Lanzhou University” in the Company field.

Thank you for the confirmation.

I just received this at 5 am this morning, from ArenaNet@guildwars2.com. The domain name looks legit at first glance but the text still has enough spelling/grammatical errors to make me believe it is fake.

>>

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[[link was here but I deleted it]]

Recently, account abuse is obviously rising up. Please pay attention to the safety your account. Don’t share account with any other people. We will not ask for your email password in any forms on our end. With the password, hackers will be able to log in the account through our security verification. If you have any account problem, please click on the link below:
https://Support.guildwars2.com/account/login?

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

Need help or have questions about your account? Please visit our: https://support.guildwars2.com/.

The Guild Wars 2 Team

<<

There’s a long thread here about the emails: https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read

There’s also a stickied post with some info.

If you got one email, you will probably continue getting emails. The phishers wouldn’t bother sending them except people are clicking on links and providing their credentials. As long as that keeps happening, you are most likely going to continue getting the emails. If you want to post the body of the email I suggest doing so in that thread I linked (this one will likely get merged with that one anyway).

I got one this one earlier:-

Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::

{Removed link, but it obviously wasn’t to a ANet site}

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

The Guild Wars 2 Team

Now I now it’s an obvious phishing attempt,and am pretty clued up on these things but I’m more concerned about just how they got my email address. An address that I only use for Guild Wars.

It’s gotten so bad for me that I’m getting the e-mails in my spam folder and my inbox folder, and they are showing up almost every 2-3 hours….don’t know why they want my account so badly

Someone draw up a bingo grid, we could play GW2 Phishing Email Bingo at this rate…

I’ve got just about all of those mentioned above in my Junk Mail. You know for certain they’re phishing emails if you change the email address GW2 is associated with to something you’ve never used anywhere. As long as the emails don’t hit the new address, you know for certain they’re fake.

drakenfyre.4280:

It’s gotten so bad for me that I’m getting the e-mails in my spam folder and my inbox folder, and they are showing up almost every 2-3 hours….don’t know why they want my account so badly

It has nothing to do personally with your account. They send out thousands, or hundreds of thousands (or more), of fake emails to email addresses that are in various lists. Your email address is in one or more of those lists. If they send out enough of those emails, some people are bound to respond not knowing the email is fake. The players go to a web site and input their GW2 credentials, which are immediately sent to the phisher / thief. That person then takes over the account and sells most/all of the items in the account. The gold is then likely transferred to yet another account, after which it is probably sold. If the gold sellers can steal virtual items this way, it means they don’t have to buy GW2 accounts (likely with stolen credit cards anyway) and farm for gold as that’s much slower than just stealing things from other players.

Because people keep responding to the emails, and because people keep buying gold outside the game, this type if thing is never, ever, going to end.

i have got thist mail on my none gw account mail

so please be carefull ( evertyhing looks ok only the url beneath the links is weird )
i changed the links so no one can click them( if arenanet wants the links i will give them in pm )

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
hxxps://account.guildwars2.com/account/login-support.html

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site: hxxp://support.guildwars2.com/.

The Guild Wars 2 Team

This type of thing has been going on for a few months. See the long thread here: https://forum-en.gw2archive.eu/forum/support/account/Email-from-ArenaNet-Please-read

There’s also a stickied thread on the subject. You’re likely going to keep getting the same emails, along with many other people.

thanks i was posting it just to be sure every one reads it , because im new and did not use the search , just wanted to be quick as i can for every one .

but thanks good to know there is a forum and im not the only one

No worries, someone will likely merge it with the other thread. And welcome!

Problem with this mail, I got one today just now, and a few before, is that these stinking smelly scamers use somehow anets mail on the sender ID.
In my experience that I got a few years from the blizzard forums to stop getting spam WoW mails when I didn’t have any blizzard game, that to “fix” this a bit is to:
Check the message source
Look for an ip next to the Received: and copy(copypaste) the numbers and had them to the block sendersin your mail options.
This the method I use to block any type of spamy filthy mail I used get, and some times you can even see the actual emails from where this unclean filth comes from.

Now here’s the big problem, these wurms are smarter now it seems, and now the only mail info you get the message source is the REAL noreply@guildwars2.com if block this mail you will be prevented from getting true guildwars2 mails, I had this happend when my router decided to reset it self and I had to authorize this log-in attempt?, to my suprise I wasn’t getting any emails and I panic. Then I remembered that I had receveid a few fake emails and decided to be lazy and just block the whole bunch fast instead of my usual process of ip blocking every single one, and by doing so I blocked the real email even when it was on my whitelist.

And this bring to my question, do you have a system to combat these like blizzard use to have, where we would mail the message source to a certain department like they had? I also think that you should add a “How to Identify Fake or Phishing Emails” section.

So, I have recently (6 days ago) received an e-mail I just read from “ArenaNet@guildwars2.com” and I’ve attached it here. It is about some dynamic password cards to protect your account, but the links are wrong and most browsers will detect and not load the URLs. Even my e-mail detected it as SPAM (and it was send to an e-mail I am not using for my Guild Wars account anymore, which makes it suspicious in the first place). So, if you get an e-mail that looks like this, DO NOT click the links!

I have been getting emails like this for a while now. I travel a lot and have played in several places and at first it was all ok. Then I started getting emails about concern for my security because it appeared that someone was using my account. I use a laptop for the game, so I only play on one machine. However, when I get one of these emails, I delete it then check and see if I can get on. Not missing anything but it is a bit of a hassle. I got hacked in GW1 and it was a royal pain, lost lot of stuff, so sensitive to it. Anyway, today is about the 30th email I have received since January. I am really tried of them…

Just set up email filters for each version of the phishing emails assuming your client has filters. Find a string of text that is common in one of the email variations such as

“It will be ongoing for further investigation by”
- or -
“If you want to remove restrictions, please click the following link to validate”

and tell the filter to delete those messages when they come in. The only time you’ll have to see them is when the text of the email changes and you have to set up another filter. It still beats looking at every single phishing email. If you don’t want to delete them, have the filters put them in a separate folder that you can review every few months.

gassy.8975:

It has nothing to do personally with your account. They send out thousands, or hundreds of thousands (or more), of fake emails to email addresses that are in various lists. Your email address is in one or more of those lists.

All of that is very true, but seeing as I only use the address for Guild Wars how did it get onto one of these lists in the first place? I know I didn’t give it to ‘em, so that only leaves ANet and if that’s the case then, as I’m in the UK, the Data Protection Act has been breached.

I just got this one last night.

“Guild Wars Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate"

I left the link out

“We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

The Guild Wars 2 Team"

pretty sure its a scam

Tachyon.5897:

I know I didn’t give it to ‘em, so that only leaves ANet and if that’s the case then, as I’m in the UK, the Data Protection Act has been breached.

No, it doesn’t. I get spam and phishing emails at email addresses I’ve never used anywhere at any point in time. You can create an email address, never use it, check it months later, and see a lot of spam in it.

I know that this topic will probably be closed but I still wanted to adress this “problem”.
I’m getting loads of these “Guild Wars Account-Notice?” about that my account “will be ongoing for further investigation by ArenaNet’s employees”.
I’m getting one of these almost each week….
I’ve already added the sender to my unwanted list but the odd things is the sender is “support@guildwars2.com”?

I’m certain that these are phising mails but I’m wonder is there anything that can be done against these mails?

Set up a filter in your email host that will search for strings of text that are common in the emails you are getting. Have those filters put the emails in different folders for review later (recommended option, in case you accidentally filter something you didn’t want to filter), or have the filter delete the emails. If you don’t know how to create filters within your email provider / client, try a google search of your provider / client and add the word “filters” to the search.

And no, ArenaNet can’t do anything about the emails.

Well thanks for the help, I’ll see if I can setup filters then.
Too bad Anet can’t do anything against those mails or the people behind them, it would make all our lives a bit easier.

Just want to report that I’ve had 2 of the “We are sorry to inform you that your login account will be shut down or partially limited within 72 hours” spam/phishing attempts within the past 4 days (June 9-12, 2012). Both were in my spam filter & emptied, so not a big issue for me. I will continue to ignore any similar emails.

Received another one today.

Hi Gaile,

Isn’t there a way to block these fishing emails?
I’m getting these emails like once a day on my old, and new email adress which I both have used for Guild Wars. And a lot of different ones as well.

It would be great if I can block these emails!

Can you help me?

TjahJadi