Guild Wars 2

Players report that they receive e-mails that pretend to come from us. For the most part, such e-mails are phishing attempts. We want you to know a few things about them.

We will not send e-mails that state that your account will be terminated if you do not respond. We will not send emails that state that an account has been compromised (unless we are responding to a player). Emails of this type are almost certainly malicious in intent.

Updated June 2015: Customer Support does send e-mails for these three reasons:

• Your account was involved in chat violations.
• Your account was closed for botting
• Your account was closed for engaging in, or helping with, gold sales.

• Our Customer Support e-mails will never contain live links.
• Our Customer Support e-mails instead will refer you (without a link) to our Support System for assistance, so you can control accessing the ticket system.

To protect yourself from phishing attempts, please consider the following:

• For matters related to account security, access the official, secure account page by typing account.guildwars2.com. Log in through that page and secure your account.
• To see if a link is suspicious, hover over the URL and carefully review the precise details of the hidden, underlying link in your browser. If the URL in the email is different than the underlying link, DO NOT click the link.
• To be extra secure, type the URL into your browser instead of clicking a risky link. Alternately, you can copy and paste the visible link into your browser. (Take care you do not copy and use the hidden, bad link.)
• Keep in mind that we do out best to write clearly and properly. If you see grammatical errors, if you see odd phrasing, that’s a definite sign that something may be “phishy” with the email in question.

We suggest you take the following steps to make sure both your game account and your email account are secure:

1. Scan your hard drive for viruses, keyloggers, and any other sort of malware, having made sure that your anti-virus software is up-to-date.
2. Change the password of your game account to a complex password you haven’t used before and that you use only for this game account.
3. Make sure you are using the additional email authentication for your game account. You can find further information here: https://en.support.guildwars2.com/app/answers/detail/a_id/9192/kw/Authenticator
4. Alternatively, you can use two-factor authentication if you own a mobile device. You can find additional information about two-factor authentication here: https://en.support.guildwars2.com/app/answers/detail/a_id/9238/kw/Authenticator
5. Change the password of your email account. You should follow similar rules for choosing your email password that you following in choosing your game account password.
6. If your email provider offers any two-factor authentication or similar options, take advance of those to further strengthen the security of your email account.

Further tips about account security can be found in this article: https://www.guildwars2.com/en/news/tips-for-keeping-your-guild-wars-2-account-secure

And an in-depth look at security is presented in this post by ArenaNet Founder Mike O’Brien: https://www.guildwars2.com/en/news/mike-obrien-on-account-security/

While we may not learn of every phishing attempt, or may not be able to post each one, I’ll attempt to add those we’re aware of. This list is not comprehensive, and if you are unsure about the legitimacy of an email, please contact Support.

KNOWN PHISHING EMAIL:

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

[LINK REDACTED]

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

KNOWN PHISHING EMAIL

Account Security Alert: ArenaNet
noreply@guildwars2.com;

Greetings!
Due to an unusual change in your access pattern, the Guild Wars 2 account under this email address has been locked. This can be caused by logging in from a new location, but it may also signal an attempt to compromise your account. If you feel that your account’s security is at risk, please follow the steps below.
Step 1: Verify Your Account Ownership
Click on the link below to verify your e-mail address of the Guild Wars 2 account:

[LINK REDACTED]

KNOWN PHISHING EMAIL

Greetings!

It will be ongoing for further investigation by ArenaNet’s employees.

We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.

[LINK REDACTED]

Once your account authentication has been completed, we will check your account and let you know what we can do for you.

Need help or have questions about your account? Visit our support site:
[LINK REDACTED]

The Guild Wars 2 Team

KNOWN PHISHING EMAIL (with helpful image)

I really like this image, kindly created by forum member basher. Follow these steps with any unsolicited email and it will help protect your personal security! (Alternately, you can right click and hit “properties” to learn a whole lot more about the sender of an email. Do this for emails so that you can see if they come from where (and whom) they say they come from.

KNOWN PHISHING EMAIL

Subject: Guild Waes 2 Account Support (Yes, Guild Waes)

Dear Players

This is the Guild Wars 2 team for further investigation be.

We appreciate that your account has been stolen concerned. To ensure the legitimacy of your account, click on the link below.

[LINK REDACTED]

Once your account is complete certification, we will check your account and let you know that we can do for you.

Need help or have questions about your account? Please visit our:
[LINK REDACTED]

The Guild Wars 2 Team

KNOWN PHISHING EMAIL

FROM: ArenaNet <support@guildwars2.com> (<— bogus “sender” of course)
SUBJECT: GuildWars2 Account Will Be Shut Down

MESSAGE: Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:

[LINK REDACTED]

Recently, account abuse is obviously rising up. Please pay attention to the safety your account. Don’t share account with any other people. We will not ask for your email password in any forms on our end. With the password, hackers will be able to log in the account through our security verification. If you have any account problem, please click on the link below:

[LINK REDACTED]

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.
Need help or have questions about your account? Please visit our:
[LINK REDACTED]

The Guild Wars 2 Team

KNOWN PHISHING EMAIL

Subject: Guild Wars 2 Account New Security Measures

Due to large amounts of the players’ accounts were stolen, we found that all methods used to steal is E-mail authentication. To protect your account, and avoid account theft or stolen by hackers which will cause account closed, our security department has developed a new dynamic password card security measures. Now they will be distributed free of charge to all players. Please click on the link to receive dynamic password card to ensure account security.

[LINK REDACTED]

To maintain account security is the responsibility of the account holder. Please note that if your account has been stolen, it will be blocked by the security sector. If this happens, please click on our account recovery channel.

[LINK REDACTED]

We will come up with certain security protection measure to protect this account.If your account is limited due to our negligence, we will remove the restriction on our end and offer you a mysterious gift in game as compensation for the inconvenience.

If you need additional help, Please visit our:

[LINK REDACTED]

If you receive emails NOT on this list, feel free to post them and I’ll add them to this thread. Thank you.

KNOWN PHISHING EMAIL:

Good grief!

I just received the following:

— SAMPLE —

From: ArenaNet <noreply@guildwars2.com> <— looks legit, right? Not even close. Check the real sender in properties and you’ll find the IP is in The Netherlands, and is undoubtedly a proxy used by account thieves to hide their real location.

Guild Wars Account Will Be Shut Down Inform (<— because we use terrible English like that, right? ~rolls eyes~

“We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate::

[ the link that was included in this bogus email wouldn’t be bad if the link actually lead to our site! ]

Guild Wars 2 Team"

— END SAMPLE —

The very long URL looks ok at the start — account.guildwars2.com — BUT it then has a bunch of numbers separated by dots and it ends in .tk. We do not have a .tk site!

Always, always look very skeptically at links in any email that you receive that is related to something of value: your bank account, your game account, medical records, etc. Look at where you’re really going, not where it appears you’re going if you were to click the link. But really, the best practice you can use is to copy and paste the displayed URL in your browser, rather than clicking the link. Consider the few seconds it takes to do that an investment against account theft.

Here’s one I received today. ~sigh~ It’s a variation of a couple of those you’ll see above. And I can assure you, I have and would never try to (or want to!) sell my Guild Wars 2 account.

KNOWN PHISHING EMAIL:

Greetings!

Please read this e-mail carefully, as it is related to your account state of Guild Wars 2 account.

First and foremost, I’d like to let you know that we take matters of account very seriously. It has come to our attention that you are trying to sell your personal Guild Wars 2 account. As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled.

Click on the link below to verify your Guild Wars 2 account e-mail address:
[[[link redacted, but yes, it looks legitimate, but it leads somewhere very, very bad]]]

If you ignore this mail, your account will be permanently closed. Once we verify your account, we will promptly reply to your E – mail to inform you that we have abandoned the investigation.

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
[[[link redacted]]]

We’ll see you in-game!

The Guild Wars 2 Team

— END SAMPLE —

I have pointed to this thread in response to emails, tickets, and other contacts from concerned individuals who are not Guild Wars 2 players who believe we are sending these mails. I point out in my responses, we are very sorry that people are getting these bogus mails, but as you can see, when the doofuses who try these phishing attempts are targeting even employees of the company who makes the game, it’s a pretty widespread situation.

Just delete.
Do not respond.
Do not follow any links.
Do not provide any information of any kind.

KNOWN PHISHING EMAIL:

Just received this from a player, and I believe this is a new one. Please, people — Be careful out there in E-mail Land).

— SAMPLE —

We are sorry to inform you that your login account [name of account redacted] is temporarily closed because it was involved in the sale of in-game items for cash or other items with real world value, or otherwise engaged in gathering items to be sold for cash or other items with real world value. Both actions are against our User Agreement: https://www.guildwars2.com/en/legal/guild-wars-2-user-agreement/

If you wish to reactivate your account, you should immediately verify your account ownership. Click the link below to validate: [fake email address that starts with"account.guildwars2.com/login/allow?token= {bunch of numbers and dashes here} and ends with .html]

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
https://www.guildwars2.com/en/legal/

Regards,

GM [name may vary, often “Cuache”]
Guild Wars 2 Support Team
http://support.guildwars2.com

— END SAMPLE —

This is not from us. Do not click links. Delete immediately

Well, the phishers keep trying, but we all are much to smart to be taken in by these, right?

Here’s the latest I received on Friday, December 13th. I just found it in my junk mail folder, so at least it’s getting sorted properly. But keep in mind that due to e-mail issues rather out of our control, some of our real mails are also sometimes ending up in Junk or Spam. So it requires diligence on our parts — as players — to be sure we’re not taken in by the phonies.

KNOWN PHISHING EMAIL:

Dear customer,

Due to suspicious activity, your ArenaNet account has been locked. You tried to login your [NAME REDACTED] account too many times (403). We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, we need you follow these steps:

Step 1: Secure Your Computer

In the event that your computer has been infected with malicious software such as a keylogger or trojan, simply changing your password may not deter future attacks without first ensuring that your computer is free from these programs. Please visit our Account Security website to learn how to secure your computer from unauthorized access.

Step 2: Secure Your E-mail Account

After you have secured your computer, check your e-mail filters and rules and look for any e-mail forwarding rules that you did not create. For more information on securing your e-mail account, visit our Support page.

Step 3: Restore access to Your account

We now provide a secure link for you to verify whether you have taken the appropriate steps to secure the account, your computer, and your email address. Please follow this site to restore the access to your account:

[gg: I’ll talk about the link below]

If you still have questions or concerns after following the steps above, feel free to contact Customer Support at https://www.guildwars2.com/en/legal/ [gg: This is actually an ok e-mail address, but you can be sure I checked it to see if it lead elsewhere!]

[gg: signed by non-existent team]
Sincerely,
The ArenaNet Account Team
Online Privacy Policy

END SAMPLE*****

Now, about that link:

This is how the link appears (and I’ve added spaces and deleted stuff, so it’s invalid):
https:// account. guildwars2.com/ login/ allow?token = [bunch of letters and numbers]

This is where the link really goes if you check where it’s sending the poor, unfortunate soul who clicks it:
http:// www.guildwars2.com. login. account. aoes.xe-osa.asia /?login.html ? [bunch of letters and numbers here]

So what’s the lesson here? Once again…

1. Never click a link in an e-mail unless you know, I mean know it’s legitimate.
2. Hover over the link and see where it really goes.
3. Copy the link from the e-mail and paste that into a browser. You then go where the link says, and not where it secretly leads.
4. Pay attention to the e-mail that is receiving the message. In this case, the phisher sent to an e-mail account of mine that has no relation whatsoever to my game accounts. If you have associated all your games with @this-email-provider.com and the e-mail arrives in the inbox of @that-other-e-mail-provider.com, you know it’s fake.

Important Update from Customer Support — January 2014

In the past we have said we would not send warnings or notifications about support actions. However, as of January 2014, we are sending some e-mails that warn a player of a chat violation or that notify a player and his/her account has been suspended for a chat violation. This system will help players avoid a suspension by making better in-game choices. It also will help suspended players learn what they did to earn that suspension so that they can avoid further impact on their account.

Please note:

• These notification and warning e-mails from Customer Support will never contain live or active links.
• The e-mails instead will refer you (without a link) to our Support System for assistance so you can control accessing the ticket system.
• At this point, warnings and notifications are only for chat violations.

If you are not sure about the legitimacy of an e-mail, please never hesitate to ask through a ticket or on this forum. However, the easiest way for you to check on this is to look for a link. If you see a live link in an Customer Support-oriented e-mail that you did not request, it’s not from us and you should delete that e-mail as probable phishing.

And remember, the warnings and notifications are sent only as a courtesy. You’re safe to delete all such mails, and may do so if you’re more comfortable taking that step.

KNOWN PHISHING E-MAIL

Subject Line: Account Ownership
Alleged Sender: ArenaNet <noreply@guildwars2.com>

Body:

Greetings!

It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:

[[Note: E-mails says https://account.guildwars2.com/allow-login?token= and then contains a bunch of letters and numbers that look pretty realistic on the e-mail body.
However, mouse over the e-mail and you’ll see that it actually leads to an address that ends in .vu, which is a small nation in the Pacific called Vanuatu. Please be aware: We don’t have anyone working for us in Vanuatu and we don’t send mails through that sort of address! ]]

If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.

Regards,

Account Administration Team
Thanks! —The ArenaNet Team

— END SAMPLE —

This is fake. Delete it immediately.

KNOWN PHISHING E-MAIL

Greetings!

It has come to our attention that your Guild Wars 2 account [EMAIL REDACTED] for engaging in or assisting wiht gold or item sales for real-world money, If this proves to be true, your account can and will be disabled.

It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.

You can confirm that you are the original owner of the account to this secure website with:
[rediculously long website address]
We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction. If you ignore this mail your account can and will be closed permanently.

Thank you for your understanding in this matter and respecting our position and all statutes within the Guild Wars 2 Terms of Use.

Regards,

Kenrich
Guild Wars 2 Support Team

KNOWN PHISHING E-MAIL

Please note: This is not coming from an ArenaNet address, but I wanted to include it because those who have an IT Department might think this is legitimate. Hopefully everyone will delete immediately, if only because of the horrible writing.

Your Mailbox is schedule for maintenance as it has exceeded it’s louted Quota as set by your IT Service Admin. This notice is to let you know that all emails sent from your account will no longer be deliver and you can no longer receive all emails. To reset your email account, you are to use the link below.

[[[link redacted]]]

IT Service

Here’s a recent mash-up of previous phishing e-mails, no less phony than the others:

Guild Wars 2 Account Will Be Shut Down Inform

We are sorry to inform you that your login account [e-mail address redacted] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:

https://account.guildwars2.com/login? [<—- Actually points to long ****.tk domain]

Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
https://www.guildwars2.com/en/legal/ [<—- actual real GW2 Link]

Guild Wars 2 Account Support Team

A new e-mail reported today:

Subject: Gems Donated According To The Achievement System

Hello Guild Wars 2 Player

We have recently decided to donate all the players 1000 germs, and at the same time, more germs are donated according to the acheivement, players with achievement score over 8000, 1500 germs are donated, players with score over 10,000, 3000 germs are donated, players with score over 1,5000, 5000 germs are donated, players with score over 20,000, 8000 germs will be donated, Please log in our website and verify that you are the account owner, and we will donate the germs within 72 hours if the verification is passed, the verification webpage: :
[Link deleted]

Gems are donated according to the achievement system.

Guild Wars 2 Operation Team’’

First, we would never share “geRms” with our players! Secondly, this is just entirely bogus. If we were to offer such a reward, we’d make sure you knew about it through our website. Please do not click any links in anything that is questionable. As far as I know, we do not send clickable links unless you request something, like a password reset or assistance through Customer Support. Any e-mail coming to you unbidden should be viewed very, very skeptically.

If you have any questions about an e-mail or in-game mail that you receive, hold off on doing anything until you check with Customer Support.

Here’s a new one.

Hello (account name here)

Your request (1388298:Change Account E-mail), Someone hpefully you!- requested change e-mail address associated with your guild Wars account

For the security of gamer , the confirmation messae is sent to you in gme. If it is not your own reuet, Visit our support site:
Http://support.guildwars2.com.6qqt3c-h42l.pw make a requestand ancel the request of changing the gaming account.if it is you in peson, please ignore it.

GM Matthias Schuter
Guild Wars

Needless to say, this is entirely bogus. I am checking with the player who submitted this and this is the way in which it was received, typos and all. Please remember that we don’t ask you to go through this process (of actively canceling a request) in relation to e-mail changes.

Here is an in-game mail that people are receiving. This one was translated from French, but we know it’s appearing in multiple languages:

Hello <player>,

We are sorry to inform you that your account will be closed or partially limited in 72 hours because of a monetary transaction. If you want to remove this restriction, click on the following link:
<non-clickable link to phishing website>

Keep at heart that Guild Wars 2 is a global game with thousands of players. It means a certain standard of behavior must be respected.

GM <fake GM name>

Even if they use a GM name that you know to be real, do not go to that site, and do not provide any account information — this is utterly fake.

Customer Support has expanded the reasons that they may reach out to a player via e-mail. Here are the current things that may prompt an official e-mail from ArenaNet:

• A chat violation. This e-mail may contain a warning or, in rare cases, may inform someone of an account closure due to the large number of violations involving the account or the sensitive nature of the chat violation(s).
• Botting: These e-mails will point out that the account was closed for botting.
• RMT/Gold Sales: Accounts are closed for engaging in gold sales, for advertising, for delivering, or for supporting this disallowed activity in any way.

Please keep in mind that e-mails will come from Guild Wars 2 Support. Official in-game mails will always bear the ArenaNet logo, and will not bear the warning that the mail is coming from an unofficial source.