e-Mail from "ArenaNet?" Please read! [merged]
in Account & Technical Support
Posted by: Iluzija.1798
in Account & Technical Support
Posted by: Iluzija.1798
I got an email just now saying that due to strange purchases on my account my GW2 account is going to be suspended in 72 hours. WHAT!?
Im guessing this is fake since it asks me to click on a link to ‘validate’ my account. Just sent a ticket to support so be careful they’re sending out new ones now.
in Account & Technical Support
Posted by: Behellagh.1468
Yes, phishing. See the phishing thread.
in Account & Technical Support
Posted by: SandraSolace.7682
This is probably a phishing email as Anet will never warn you before actually suspending you if you did something wrong.
It happens a lot, take a look here for some examples: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3557700
in Account & Technical Support
Posted by: Iluzija.1798
Yeah thought as much, well Ive sent a ticket off and reset my password, can never be too safe.
Yeah thought as much, well Ive sent a ticket off and reset my password, can never be too safe.
You’re right, it’s good to be safe!
in Account & Technical Support
Posted by: Kingdarkshadow.3175
unfortunately I was dumb enough to fall for that kind of pishing mails >.> but I already change my password and I have google authenticator so I should be fine, my only concern is the serial code, can they log in my account through that?
in Account & Technical Support
Posted by: ShiningSquirrel.3751
unfortunately I was dumb enough to fall for that kind of pishing mails >.> but I already change my password and I have google authenticator so I should be fine, my only concern is the serial code, can they log in my account through that?
You should contact support and explain what you did. Having the serial code could allow them to claim your account as their own.
hi does anyone knows if this is a fishing mail? i received it in my spam folder
i am not trying to sell my account so i dont know what this is about. here is a copy paste of the mail. i havant klikked on any link in this mail.
Greetings!
It has come to our attention that you are trying to sell your personal Guild Wars account(s). As you may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
Removed phishing link
If you ignore this mail your account can and will be closed permanently. Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
Regards,
Account Administration Team
Thanks! —The ArenaNet Team
(edited by Moderator)
in Account & Technical Support
Posted by: Inculpatus cedo.9234
Yes, it is a phishing email. You can see others just like it in this Sticky: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3524563
thank you for the reply
in Account & Technical Support
Posted by: Randall.7306
I received a mail apparently coming from Arena Net, it’s the first phishing attempt that doesn’t go directly to gmail’s spam folder, so I think it’s relevant to inform here and let others to be aware.
The mail informs me to verify my account here (I separate the http: part from the rest just in case, the original URL obviously doesn’t have spaces)
Removed phishing link via Moderation
Which presents a very similar layout to official ArenaNet web, but with some weird details that may remain unnoticed to other people. The first of all the very long URL ending with .tk
At the bottom, there is another hint, a small image similar to a graph directing to some chinese? statistics site.
Once detected, and proved that I can login here with my account as usual, I’ve see some weird things in the mail itself, if I go to the “full headers/show original”. Not sure how they surpassed gmail’s spam filters.
I hope this helps someone else to not fall in phishing attempts
(edited by Moderator)
in Account & Technical Support
Posted by: Inculpatus cedo.9234
Is it one of the ones displayed in the Sticky showing the phishing emails? If not, maybe you could add it there for others to see (redacting the links, of course).
The main post about phishing attempts is here: https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post3557700
Please review any e-mail you have received related to Guild Wars 2 or ArenaNet against this list, as it will help you identify bogus e-mails designed to gather your account credentials.
in Account & Technical Support
Posted by: Beatsbury.1827
I’ve got a letter today from “ArenaNet” with following text
“Guild Wars 2 Account Will Be Shut Down Inform
We are sorry to inform you that your login account [redacted] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://******** ****** */login?##
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
Guild Wars 2 Account Support Team"
That “validation link” leads to site quite similar in appearance to GW2 site but with strange address on .tk domain. It asks you to enter your serial key, character name and e-mail to complete the “validation”.
Just wanted to warn ya. Cheers.
P.S: I strongly suggest you to not follow the link above!
(edited by Moderator)
in Account & Technical Support
Posted by: ozmaniandevil.6805
Thanks for the warning!
in Account & Technical Support
Posted by: Inculpatus cedo.9234
That’s not new. Probably the oldest one we’ve had. https://forum-en.gw2archive.eu/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388
It’s always good to keep the playerbase informed, though.
in Account & Technical Support
Posted by: Devildoc.6721
always mouseover links without clicking to see where they REALLY go. anywhere but something.guildwars2.com/ or something.ncsoft.com/ is never a legit address. The ones to really be aware of are like something.guildwars2.com.kissyouraccountgoodbye.cn/ always make sure the end of the domain is guildwars2.com or ncsoft.com with no more dots after that.
in Account & Technical Support
Posted by: mtpelion.4562
Also, always remember that ArenaNet will not warn you about an account action. They will simply ban/suspend your account and wait for you to reach out to them to reverse it.
in Account & Technical Support
Posted by: Atra Culpa.5012
Just received one too. I’ve made sure to change my passwords etc just in case.
in Account & Technical Support
Posted by: bargamer.1762
Just got this one, too.
in Account & Technical Support
Posted by: Brother Grimm.5176
How can your read beyond the subject and even consider this as possibly being a legit email?
in Account & Technical Support
Posted by: mtpelion.4562
How can your read beyond the subject and even consider this as possibly being a legit email?
Some people may be English as a Second Language (ESL) and thus wouldn’t be as capable at picking up on the bad grammar being used.
in Account & Technical Support
Posted by: Rajani Isa.6294
Also, always remember that ArenaNet will not warn you about an account action. They will simply ban/suspend your account and wait for you to reach out to them to reverse it.
Actually, they’ve started sending out emails when it’s a chat violation, apparently. However, according to Gaile, those emails will ONLY be for chat violations, and NEVER have active links.
I’ve got a letter today from “ArenaNet” with following text
“Guild Wars 2 Account Will Be Shut Down Inform
We are sorry to inform you that your login account [redacted] will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
https://******** ****** */login?##
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.Guild Wars 2 Account Support Team"
That “validation link” leads to site quite similar in appearance to GW2 site but with strange address on .tk domain. It asks you to enter your serial key, character name and e-mail to complete the “validation”.
Just wanted to warn ya. Cheers.P.S: I strongly suggest you to not follow the link above!
I get this one all the time. On my work account. I makes me laugh out loud, oh yes it does.
But please, folks, delete this and keep up on the “A Note About Phishing” thread for samples of these things.
Thanks!
I just got an email too. The link was just so weird, i didn’t trust it at all.
They sent me this link *******.****.com
Thought i let you guys know
Post edited by moderator.
(edited by Moderator)
One of our moderators removed the link immediately above, which is great.
Just a reminder to everyone: Please do not include links if you post an e-mail you received. Deleting the links keeps players safe, so thanks for doing that.
Moving to the front so everyone sees this.
in Account & Technical Support
Posted by: ShiningSquirrel.3751
bump for Gaile
1234567890
in Account & Technical Support
Posted by: Astral Projections.7320
Bump for Gaile.
in Account & Technical Support
Posted by: Astral Projections.7320
Bump for Gaile
Just got an email from noreply@guildwars2.com which was clearly a fake.
1: It was sent to an email that is not directly linked to my GW2 account, I use a different email for it.
2: It was claiming I reset my secret question
3: There were a lot of spelling mistakes throughout
I probably should have saved it but quickly deleted it. Just becareful out there. There were several links I did not even attempt to scroll over.
in Account & Technical Support
Posted by: iAmTheSonic.3957
Hello!
Seems like I just got one of those phishing emails too. It was sent to a different address (not the one I signed up for Guild Wars 2 with), contains ridicolous grammar mistakes, and considering I haven’t played Guild Wars 2 for very long, I immediately got suspicious.
The email was sent from noreply@guildwars2.com, but is clearly fake.
Here’s the content (I removed my personal information):
————————
Greetings!
It has come to our attention that your Guild Wars 2 account <My email here> for engaging in or assisting wiht gold or item sales for real-world money, If this proves to be true, your account can and will be disabled.
It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
<Suspicious link, probably to allow access from new computer?>
We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction. If you ignore this mail your account can and will be closed permanently.
Thank you for your understanding in this matter and respecting our position and all statutes within the Guild Wars 2 Terms of Use.
Regards,
Kenrich
Guild Wars 2 Support Team
————————
Like I said, this is obviously fake, so be careful and don’t click that link!
Have a great day.
in Account & Technical Support
Posted by: Simonoly.4352
Yep just found that exact email in my junk folder of an email address that is not linked to my GW2 account. Quite odd.
I received several phising e-mails in the past weeks like the one below :
________________________________________________________________
We are sorry to inform you that your login account xxxxxxx@xxxxxxxxxx will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
" FAKE LINK HERE "
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
Guild Wars 2 Account Support Team
_______________________________________________________________
The link is FAKE and is a phising attempt. DO NOT USE IT.
(edited by Ilias.8647)
I just got this email from a phisher
Guild Wars 2 – Security question reset request
Greetings!
It has come to our attention that your Guild Wars 2 account [My email address] for engaging in or assisting wiht gold or item sales for real-world money, If this proves to be true, your account can and will be disabled.
It will be ongoing for further investigation by ArenaNet Entertainment’s employees. If you wish to not get your account suspended you should immediately verify your account ownership.
You can confirm that you are the original owner of the account to this secure website with:
[suspect weblink that I just removed]
We will investigate into this case through verifying the account’s ownership. If the verification goes through, we will cancel any restriction. If you ignore this mail your account can and will be closed permanently.
Thank you for your understanding in this matter and respecting our position and all statutes within the Guild Wars 2 Terms of Use.
Regards,
Kenrich
Guild Wars 2 Support Team
I have a feeling that it is a fake as they couldnt even spell “with” correctly.
but I am going to change my password just encase anyway.
Got one a few hours ago. It asks for a lot of information.
Hello,
It has come to our attention that you are trying to sell ACCOUNT NAME/trade your personal Guild Wars 2 account. As you may or may not be aware of, this conflicts with the EULA and Terms of Agreement. If this proves to be true, your account can and will be disabled. It will be ongoing for further investigation by Guild Wars 2 account. This action is taken because we at Guild Wars 2 account takes these sales quite serious.
If you wish to not get your account suspended you should immediately verify your account. We need to confirm you are the original owner of the account. This is easiest done by confirming your personal information along with concealed information about your account.
You can confirm that you are the original owner of the account by replying to this email with:
And attach a screen shot of the key on your instruction booklet ( if possible). Reply to this with the information within 1 week, or your IP will be banned permanently, which will not let you play and/or make an account. Feel free to visit LINK REDACTED to contact us or for more information
Regards,
GM Master Mind
Guild Wars 2 Support Team
http://support.guildwars2.com/
in Account & Technical Support
Posted by: Behellagh.1468
Bumping for Gail
Hi,
I just got what turned to be a phishing email, but I found out after I replied to it. I’m so stupid, I panicked. I manage to change my passwords at once, but is there anything more I should do, just to be safe ?
Here is the email I got :
Guild Wars 2 Account Will Be Shut Down Inform
We are sorry to inform you that your login account ************** ********* will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
************************
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
https://www.guildwars2.com/en/legal/
Guild Wars 2 Account Support Team
Thank you for your help.
(edited by Moderator)
Hello I recently received a email very similar to the listed examples of Pishing Emails:
We are sorry to inform you that your login account will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate
- Ofc I did not do this, I decided to copy and paste the return path for your convenience
Return-Path: <noreply@guildwars2.com>
Received: from guildwars2.com (2-229-33-135.ip194.fastwebnet.it [2.229.33.135])
by mtaig-mcb03.mx.aol.com (Internet Inbound) with ESMTP id D96C0700000A6
for <My email>; Sun, 30 Mar 2014 11:27:06 -0400 (EDT)
Received: from lvwgemc (unknown [210.96.31.75])
by guildwars2.com with SMTP id 80qrJzCHlIeRY1ZI.1
for <My email>; Sun, 30 Mar 2014 23:27:10 +0800
Message-ID: <30C54ABAA4648AC2E65D31FB39662A03@lvwgemc>
From: “ArenaNet” <noreply@guildwars2.com>
To: <My email>
Subject: Guild Wars 2 Account Be Shut Down Inform
Date: Sun, 30 Mar 2014 23:26:59 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset=“utf-8”
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
x-aol-global-disposition: S
Authentication-Results: mx.aol.com;
spf=permerror (aol.com: while processing the SPF record for guildwars2.com we encountered a fatal error.) smtp.mailfrom=guildwars2.com;
X-AOL-REROUTE: YES
x-aol-sid: 3039ac1a32a3533837ca4d0e
X-AOL-IP: 2.229.33.135
X-AOL-SPF: domain : guildwars2.com SPF : permerror
Hope some of this is helpful
Tom
A quick anti virus scan would probably be good
in Account & Technical Support
Posted by: bluestocking.6148
You might want to consider opening a support ticket and changing the email associated with the account, too. To be extra safe.
in Account & Technical Support
Posted by: Inculpatus cedo.9234
You should remove your personal information, as displaying it publicly gives hackers half the information they need.
Also, remove those dangerous links from your post so others don’t compromise their accounts.
A thorough scan of your computer for malware, viruses, etc. is in order. Once your computer is safe, you should change all passwords, again. Good luck.
Thank you guys, I’m gonna be extra careful but I think I reacted quickly enough to avoid troubles.
Thanks again.
in Account & Technical Support
Posted by: Maragorn.8753
Hello,
I’m afraid I foolishly (especially now that I read all these posts) clicked on the link answered some of their questions, including the serial key.
here’s the mail:
[
Guild Wars 2 Account Will Be Shut Down Inform
We are sorry to inform you that your login account m*******@hotmail.com will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[suspicous link]
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
[most likely another suspicious link]
Guild Wars 2 Account Support Team
]
Ever since I answered this mail (using the link) whenever I look at my security on my account, it seems logged in on 2 different area’s at the same time:
from Belgium, which is where I come from and from China.
This is what appears on security:
22 , CN (183.198.42.104)
I checked the IP-adress and it apparently is from China Mobile Communication Organisation.
What am I supposed to do about this?
Is there a way to resolve this because every time I disconnect the login from China, I just have to reload the page, and they have logged on again.
On a side note (in case it might be relevant):
yesterday I logged of somewhere in south of Far Shiverpeaks (north of Steampunk Mountains) but when I logged on today (just over a hour ago) I apparently was standing beside a bank in Ascalon City (the human main city). Thankfully none of my items were stolen (as far as I can remember)
I sincerely hope this information can help the ArenaNet with their wonderful work and to keep the game safe and that my case will ensure that others won’t have the same problems.
Greetings from Belgium
Maragorn
Edit: Removed content that may pose a security risk to our players.
(edited by Moderator)
We need to be very careful when posting in this thread. Please do not post links, and do not offer to expose such links via another means, such a private messages.
Please check this thread — A Note about Phishing E-mails for information about the known phishing e-mails. If you are in doubt about an e-mail you’ve received, delete it and never click any links or provide any information!
I received and email saying my account was being suspended because of excessive currency activity ,I am 700miles from home and have not been in my game since 3/20/14. When I tried to sign in it says password not correct and goes to restore screen. I can’t restore with out key code and its700 miles away and I won’t be home for 2 weeks. I can’t even submit a ticket without it,I was able to sign in to here with old password but this is as far as I can go. If any Dev’s read this please put a freeze on my account till I can get home and get my key and do a restore.I have been playing since GW1 came out and have 2 years invested in GW2 that I hate to lose.
Had one of these mails on the 31st:
Guild Wars Account Be Shut Down Inform
We are sorry to inform you that your login account (my email) will be shut down or partially limited within 72 hours due to currency transactions or abnormal login. If you want to remove restrictions, please click the following link to validate:
[suspicious link]
Please keep in mind that Guild Wars 2 is a global game with hundreds of thousands of players. This means that standards of behavior must be upheld. For your convenience, you can obtain more information about our rules at the address listed below.
[suspicious link]
Guild Wars 2 Account Support Team
recommend the typical changing of your password if you catch one of these just in case
Ralph and Magi — those aren’t from us. You can tell because they ask you to “validate” your account or “dispute the charges” or some other fake way of getting you to input your credentials. We will never send you something and ask for your credentials — we don’t need them to help players, and asking for a password or serial code when they are generating the message is just a huge red flag to phishing. (If we ask you to provide a serial code, it’s because you are initiating the conversation and we need to establish you own the account. You won’t get something out of the blue from us that asks for personal info like that!)
Please submit a ticket by clicking “Support” at the top of this page and then clicking the “Submit a request” option. (Ralph — you do not need to provide your serial code.) Provide as much information as possible in the web form, because that will create a ticket within the support system. Again, you are not required to provide all the information but may leave fields blank when you cannot accurately complete them. The team should be able to help you.
If you later need to update your ticket, simply reply to the e-mail associated with the ticket (with the 6-digit ticket number in the subject line) and provide any new information you wish to have added to your ticket.
in Account & Technical Support
Posted by: Astral Projections.7320
Bump for Gaile
in Account & Technical Support
Posted by: Death Stroke.9875
I got this in the in-game mail and the only difference is that with the in-game mail it is obviously fake
Not affiliated with ArenaNet or NCSOFT. No support is provided.
All assets, page layout, visual style belong to ArenaNet and are used solely to replicate the original design and preserve the original look and feel.
Contact /u/e-scrape-artist on reddit if you encounter a bug.