Scams in games: free currency and stolen accounts

The website would look like the game's login page. But Sara's username and password wouldn't go to the game – they'd go to a scammer. The scammer would log in to her account, change the password and take everything valuable – ships, spacesuits and crystals. Then they could send the same “offer” from her account to Sara's friends.

The Czech police, for example, warn that scammers in games often offer cheap in-game currency, rare items or cheap game accounts. They're after login details or money. According to the police, fake competitions, “free gifts” and links to sites that imitate well-known gaming services are just as risky.

• Free currency or skins (new looks for your character). A “crystal generator”, “I'm giving away skins”, “you've won a competition”. You only get in-game currency in the game itself or in the official store. Anyone offering it elsewhere usually wants your account or your money.
• Fake support. A message “from the game team”: your account will supposedly be deleted unless you send your password or a code right now. Game companies themselves say they never ask players for their password – not by email and not in a chat message.
• Trades outside the game. “Send me the item or the money first, then I'll give you the rarer one.” Outside the game's official trading, nothing protects you – and the other person may never get back to you.

Nebulark is a made-up game. But the tricks in this lesson work in every real one.

Your password is the key to your account. A verification code from an email or text message is a second key – that's why scammers want it too. If you get a code when you're not logging in, don't send it to anyone, and change your password.

The police advise: don't use the same password in several places, turn on two-step verification (the game then asks for a code as well as your password), and don't give your login details even to your best online friends.

Skip the “https://” at the start. What matters is the name with its ending (like “.com” or “.eu”) just before the first slash “/”. That's the real owner of the page. Anyone can make up everything in front of it.

In the address nebulark.free-crystals.com/login it's free-crystals.com – and that has nothing to do with the game. The word “nebulark” at the start is just a disguise.

It's best not to open links from messages at all. If you want to know where one leads, paste it into the Link X-ray – it shows you without opening the page. Only log in to the game in the app or through an address you type in yourself.

Anyone can get caught out – adults too. What matters is speed:

1. Tell your parents straight away, or another adult you trust.
2. Change your password for the game and for the email linked to the account.
3. Write to the game's support team – through the official website or app, not through a link from a message.
4. Warn your friends not to respond to messages from your account.

If someone threatens you or pushes you into something, tell an adult you trust. You can also call a child helpline: in most EU countries the number is 116 111, and the call is free.

Find out more about the “Too good to be true” trick in the Manipulation atlas.