Guild Wars 2

I got an email just now saying that due to strange purchases on my account my GW2 account is going to be suspended in 72 hours. WHAT!?

Im guessing this is fake since it asks me to click on a link to ‘validate’ my account. Just sent a ticket to support so be careful they’re sending out new ones now.

Yes, phishing. See the phishing thread.

This is probably a phishing email as Anet will never warn you before actually suspending you if you did something wrong.

It happens a lot, take a look here for some examples: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3557700

Yeah thought as much, well Ive sent a ticket off and reset my password, can never be too safe.

unfortunately I was dumb enough to fall for that kind of pishing mails >.> but I already change my password and I have google authenticator so I should be fine, my only concern is the serial code, can they log in my account through that?

Kingdarkshadow.3175:

unfortunately I was dumb enough to fall for that kind of pishing mails >.> but I already change my password and I have google authenticator so I should be fine, my only concern is the serial code, can they log in my account through that?

You should contact support and explain what you did. Having the serial code could allow them to claim your account as their own.

hi does anyone knows if this is a fishing mail? i received it in my spam folder
i am not trying to sell my account so i dont know what this is about. here is a copy paste of the mail. i havant klikked on any link in this mail.

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

Removed phishing link

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

Yes, it is a phishing email. You can see others just like it in this Sticky: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3524563

thank you for the reply

I received a mail apparently coming from Arena Net, it’s the first phishing attempt that doesn’t go directly to gmail’s spam folder, so I think it’s relevant to inform here and let others to be aware.

The mail informs me to verify my account here (I separate the http: part from the rest just in case, the original URL obviously doesn’t have spaces)

Removed phishing link via Moderation

Which presents a very similar layout to official ArenaNet web, but with some weird details that may remain unnoticed to other people. The first of all the very long URL ending with .tk

At the bottom, there is another hint, a small image similar to a graph directing to some chinese? statistics site.

Once detected, and proved that I can login here with my account as usual, I’ve see some weird things in the mail itself, if I go to the “full headers/show original”. Not sure how they surpassed gmail’s spam filters.

I hope this helps someone else to not fall in phishing attempts

Is it one of the ones displayed in the Sticky showing the phishing emails? If not, maybe you could add it there for others to see (redacting the links, of course).

I’ve got a letter today from “ArenaNet” with following text

“Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account [redacted] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://******** ****** */login?##
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

/*/

Guild Wars 2 Account Support Team"

That “validation link” leads to site quite similar in appearance to GW2 site but with strange address on .tk domain. It asks you to enter your serial key, character name and e-mail to complete the “validation”.
Just wanted to warn ya. Cheers.

P.S: I strongly suggest you to not follow the link above!

Thanks for the warning!

That’s not new. Probably the oldest one we’ve had. https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388

It’s always good to keep the playerbase informed, though.

always mouseover links without clicking to see where they REALLY go. anywhere but something.guildwars2.com/ or something.ncsoft.com/ is never a legit address. The ones to really be aware of are like something.guildwars2.com.kissyouraccountgoodbye.cn/ always make sure the end of the domain is guildwars2.com or ncsoft.com with no more dots after that.

Also, always remember that ArenaNet will not warn you about an account action. They will simply ban/suspend your account and wait for you to reach out to them to reverse it.

Just received one too. I’ve made sure to change my passwords etc just in case.

Just got this one, too.

How can your read beyond the subject and even consider this as possibly being a legit email?

Brother Grimm.5176:

How can your read beyond the subject and even consider this as possibly being a legit email?

Some people may be English as a Second Language (ESL) and thus wouldn’t be as capable at picking up on the bad grammar being used.

mtpelion.4562:

Also, always remember that ArenaNet will not warn you about an account action. They will simply ban/suspend your account and wait for you to reach out to them to reverse it.

Actually, they’ve started sending out emails when it’s a chat violation, apparently. However, according to Gaile, those emails will ONLY be for chat violations, and NEVER have active links.

I just got an email too. The link was just so weird, i didn’t trust it at all.
They sent me this link *******.****.com
Thought i let you guys know

Post edited by moderator.

bump for Gaile
1234567890

Bump for Gaile.

Bump for Gaile

Just got an email from noreply@guildwars2.com which was clearly a fake.

1: It was sent to an email that is not directly linked to my GW2 account, I use a different email for it.
2: It was claiming I reset my secret question
3: There were a lot of spelling mistakes throughout

I probably should have saved it but quickly deleted it. Just becareful out there. There were several links I did not even attempt to scroll over.

Hello!

Seems like I just got one of those phishing emails too. It was sent to a different address (not the one I signed up for Guild Wars 2 with), contains ridicolous grammar mistakes, and considering I haven’t played Guild Wars 2 for very long, I immediately got suspicious.

The email was sent from noreply@guildwars2.com, but is clearly fake.

Here’s the content (I removed my personal information):
————————
Greetings!

It has come to our attention that your Guild Wars 2 account <My email here> for engaging in or assisting wiht gold or item sales for real-world money, If this proves to be true, your account can and will be disabled.

It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:
<Suspicious link, probably to allow access from new computer?>

We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction. If you ignore this mail your account can and will be closed permanently.

Thank you for your understanding in this matter and respecting our position and all statutes within the Guild Wars 2 Terms of Use.

Regards,
Kenrich
Guild Wars 2 Support Team
————————

Like I said, this is obviously fake, so be careful and don’t click that link!
Have a great day.

Yep just found that exact email in my junk folder of an email address that is not linked to my GW2 account. Quite odd.

I received several phising e-mails in the past weeks like the one below :
________________________________________________________________
We are sorry to inform you that your login account xxxxxxx@xxxxxxxxxx will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:

" FAKE LINK HERE "

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

Guild Wars 2 Account Support Team
_______________________________________________________________

The link is FAKE and is a phising attempt. DO NOT USE IT.

I just got this email from a phisher

Guild Wars 2 – Security question reset request

Greetings!

It has come to our attention that your Guild Wars 2 account [My email address] for engaging in or assisting wiht gold or item sales for real-world money, If this proves to be true, your account can and will be disabled.

It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

[suspect weblink that I just removed]

We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction. If you ignore this mail your account can and will be closed permanently.

Thank you for your understanding in this matter and respecting our position and all statutes within the Guild Wars 2 Terms of Use.

Regards,
Kenrich
Guild Wars 2 Support Team

I have a feeling that it is a fake as they couldnt even spell “with” correctly.
but I am going to change my password just encase anyway.

Got one a few hours ago. It asks for a lot of information.

Bumping for Gail

Hi,

I just got what turned to be a phishing email, but I found out after I replied to it. I’m so stupid, I panicked. I manage to change my passwords at once, but is there anything more I should do, just to be safe ?

Here is the email I got :
Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account ************** ********* will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
************************

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

https://www.guildwars2.com/en/legal/
Guild Wars 2 Account Support Team

Thank you for your help.

Hello I recently received a email very similar to the listed examples of Pishing Emails:

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate

- Ofc I did not do this, I decided to copy and paste the return path for your convenience

Return-Path: <noreply@guildwars2.com>
Received: from guildwars2.com (2-229-33-135.ip194.fastwebnet.it [2.229.33.135])
by mtaig-mcb03.mx.aol.com (Internet Inbound) with ESMTP id D96C0700000A6
for <My email>; Sun, 30 Mar 2014 11:27:06 -0400 (EDT)
Received: from lvwgemc (unknown [210.96.31.75])
by guildwars2.com with SMTP id 80qrJzCHlIeRY1ZI.1
for <My email>; Sun, 30 Mar 2014 23:27:10 +0800
Message-ID: <30C54ABAA4648AC2E65D31FB39662A03@lvwgemc>
From: “ArenaNet” <noreply@guildwars2.com>
To: <My email>
Subject: Guild Wars 2 Account Be Shut Down Inform
Date: Sun, 30 Mar 2014 23:26:59 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset=“utf-8”
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
x-aol-global-disposition: S
Authentication-Results: mx.aol.com;
spf=permerror (aol.com: while processing the SPF record for guildwars2.com we encountered a fatal error.) smtp.mailfrom=guildwars2.com;
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1a32a3533837ca4d0e
X-AOL-IP: 2.229.33.135
X-AOL-SPF: domain : guildwars2.com SPF : permerror

Hope some of this is helpful

Tom

A quick anti virus scan would probably be good

You might want to consider opening a support ticket and changing the email associated with the account, too. To be extra safe.

You should remove your personal information, as displaying it publicly gives hackers half the information they need.

Also, remove those dangerous links from your post so others don’t compromise their accounts.

A thorough scan of your computer for malware, viruses, etc. is in order. Once your computer is safe, you should change all passwords, again. Good luck.

Thank you guys, I’m gonna be extra careful but I think I reacted quickly enough to avoid troubles.

Thanks again.

Hello,

I’m afraid I foolishly (especially now that I read all these posts) clicked on the link answered some of their questions, including the serial key.

here’s the mail:
[
Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account m*******@hotmail.com will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[suspicous link]

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.

[most likely another suspicious link]
Guild Wars 2 Account Support Team
]

Ever since I answered this mail (using the link) whenever I look at my security on my account, it seems logged in on 2 different area’s at the same time:
from Belgium, which is where I come from and from China.
This is what appears on security:
22 , CN (183.198.42.104)

I checked the IP-adress and it apparently is from China Mobile Communication Organisation.

What am I supposed to do about this?
Is there a way to resolve this because every time I disconnect the login from China, I just have to reload the page, and they have logged on again.

On a side note (in case it might be relevant):
yesterday I logged of somewhere in south of Far Shiverpeaks (north of Steampunk Mountains) but when I logged on today (just over a hour ago) I apparently was standing beside a bank in Ascalon City (the human main city). Thankfully none of my items were stolen (as far as I can remember)

I sincerely hope this information can help the ArenaNet with their wonderful work and to keep the game safe and that my case will ensure that others won’t have the same problems.
Greetings from Belgium
Maragorn

Edit: Removed content that may pose a security risk to our players.

I received and email saying my account was being suspended because of excessive currency activity ,I am 700miles from home and have not been in my game since 3/20/14. When I tried to sign in it says password not correct and goes to restore screen. I can’t restore with out key code and its700 miles away and I won’t be home for 2 weeks. I can’t even submit a ticket without it,I was able to sign in to here with old password but this is as far as I can go. If any Dev’s read this please put a freeze on my account till I can get home and get my key and do a restore.I have been playing since GW1 came out and have 2 years invested in GW2 that I hate to lose.

Had one of these mails on the 31st:

Guild Wars Account Be Shut Down Inform

We are sorry to inform you that your login account (my email) will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[suspicious link]
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
[suspicious link]
Guild Wars 2 Account Support Team

recommend the typical changing of your password if you catch one of these just in case

Bump for Gaile

I got this in the in-game mail and the only difference is that with the in-game mail it is obviously fake