A lot of people are getting phishing attempts through an email that pretends to come from us. For detailed information about this, please read this thread.
I will merge threads about this topic into this thread.
An email is being sent out to player that does NOT come from us. It states that “we” have discovered that the recipient has been trying to sell his/her Guild Wars account, and threatens immediate closure without contact from the player.
I have merged a bunch of threads about the subject here. If you have received an email that you’re concerned about, please read this thread.
I have merged two threads about this subject so that forum members could see the questions that others have had about the phishing email.
Again, do NOT click the link, and DO delete the email — it is bogus.
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!
Oh, and I’m glad this thread was helpful to you. 
The recent light of these ‘emails’ i would like to know if you, Anet or Guildwars 2 have a security issue which is why are email addresses have been linked to Guildwars 2?
Considering the fact that the one i got was to an email address that was not ever affliated with either Guild Wars its highly doubtful that a-net has been breached.
ArenaNet has decidedly not been breached. This is an external effort and pretty easily detected as such.
I just received one of these and was going to post a thread asking about it. I am glad to see it is a scam that is being addressed.
{removing link in case this exposes any account info}
Hey there. I worry the image may show personal account info, and because we don’t need to see the image, I’ve redacted it. Hope you don’t mind!
Oh, and I’m glad this thread was helpful to you.
Actually i edited out any info that would give away my account. I don’t really mind it being removed though.
Oh thanks for doing that, Sylv. I have a tendency to act right away if I perceive there may be a privacy/security risk. Thanks for understanding.
Four more emails from these clowns today alone. Well, they’re as persistent as they are annoying.
They’re not even going to the email I have my account tied to, which is relieving.
You are very wise to use a separate email for your log-in, and not a general one that is more vulnerable to attack. (And yes, they are persistent.
)
Please note this thread for more information: https://forum-en.guildwars2.com/forum/info/news/E-mail-from-ArenaNet/first#post1807866
Just as a reminder, please note this thread for more information: https://forum-en.guildwars2.com/forum/info/news/E-mail-from-ArenaNet/first#post1807866
The simple answer to this sort of thing: Do not click a link that you believe may pose a security risk. In this example, simply access your account through the account page, which is https://account.guildwars2.com/account. Log in, and secure your account.
Alternately, type the URL into your browser instead of clicking a risky link. Where clicking a link can take you someplace other than where you intended, if you type the URL, you control where you’re heading, right?
The simple answer to this sort of thing: Do not click a link that you believe may pose a security risk. In this example, simply access your account through the account page, which is https://account.guildwars2.com/account. Log in, and secure your account.
Alternately, type the URL into your browser instead of clicking a risky link. Where clicking a link can take you someplace other than where you intended, if you type the URL, you control where you’re heading, right?
Exactly. I haven’t clicked it yet, because it’s probably just a terrible phishing email, but I am not worried about my account security, either. I have a strong password and I am using the authenticator, though I could change my password just in case.
Sounds as if you taken good steps with your personal security, which is great. I always think a password change can’t hurt, and might help.
To be clear: This is a new phishing attempt. Do NOT follow the link.
More information about recent phishing efforts in this thread above.
Even ArenaNet folks are getting these nasty, sneaky emails.
Be safe, people, and don’t fall for the “You get get free gems if you visit our site” nonsense, or the “We’re going to close your account if you don’t immediately provide us with your serial code” emails.
If in doubt, shoot the team a ticket before responding. But most importantly, read up on the subject so you can protect yourself.
@DJ
You might want to edit that picture so that it doesn’t show your email address for all to see.
Thank you for pointing that out. I’ve flagged it for removal.
I’ve been getting alot of these mails, just this week. What I’m most curious about is how they get the “[email protected]” adress as sender. Or am I missing something?
There are ways to fake just about anyone’s email address as the alleged “sender” or “from” bar. The important thing to do is look at the email’s properties and not the face-value “sender name.” The sender might say “ArenaNet” but the properties might expose that fake email as coming from BadAccountTheftRing.
Can’t be too careful!
The latest twist on this unfortunate situation is that people who receive the emails who do not have GW2 accounts (or any accounts with any NCSOFT games) think that we are sending them the spam. I’ve had a few emails to write today assuring people that they are being phished, and that the emails about “your account” are clearly going to just about every living person on the planet.
Also, there is a third phishing effort — somewhat different than the other two — so be watchful, as always!
I would like to know how these scammers got our e-mails in the first place?
Anyway i got a new one today different than the normal ones.
Gw 2 questionnaire.
The usual stuff click this link and log in and answer the questions bla bla bla.
I just hope ppl don’t fall for these stupid scams.
I do not know where they got your email address, except to say they did not get it from us. If you read Mike O’Brien’s article on account security I think you’ll get some insight into the matter.
I would like to know how these scammers got our e-mails in the first place?
I have my own domain name that I use for email. This makes it easy to use a different email address whenever I register at a web site. Most of the spam and scam emails I get are addressed to one of the following:
- admin/email/owner/some-other-generic-word @ <mydomain> — I don’t actually use these email addresses but get spam there anyway.
- email addresses I used at sites currently in existence. I don’t want to name them as I don’t want to suggest they had security breaches or sold my email addresses. Sometimes I’ll start getting spam from a site after it is transferred to another owner.
- email addresses I used for sites that are no longer in existence, such as those stupid “freebies” sites from years ago during the dot-com boom.
I get a ton of spam and I’ve had a lot of email addresses over the years, at least several hundred. I’ve never received spam/scam emails at the email addresses I’ve use for GW1 or GW2.
Thank you, gassy! I think that will set a lot of people’s mind’s at ease.
ArenaNet will never contact you about your account, unless you have contacted them first. Never click on links in emails, without first ascertaining where it is they actually lead. Please remove those links from your post, to prevent others from visiting potentially harmful sites. I hope you have changed your passwords and email address associated with your game account to keep your account safe from being compromised again. Best of luck to you in the future. =)
Sorry I did not see the message when I wrote the earlier message. I already changed the password ,but not email. I will take note about the “ArenaNet will never contact you about your account, unless you have contacted them first.” as a life lesson. Thx both of you for answering my problem.
The only exception I can think of will be emails along the lines of “We’ve detected your account doing X, we’ve suspended/banned your account. Please submit a ticket at support.guildwars2.com to appeal”
The email you see as the origin can be spoofed, so no need to block the [email protected] address, just only go to their site (or your banks, etc) by typing in the website URL.
We do not send emails when we suspend or terminate an account, so an email of that type would not be legitimate.
I recently recived an email from [email protected] about my account being stolen? Its not written really well, like who ever wrote it was not very good at English. Im worried about my account now! Should I change my password?
I received it, too. Phishing.
Hello everyone, I’m using an authenticator on my account and I’ve checked my account security and it says I only have my two IP addresses accessed to this account which is from my computer and my laptop, so no one hasn’t logged into my account from a different place other than my laptop and pc, but I keep getting loads of these GW2 Support emails and I’m too worried to click on the links they tell me to click on in case it’s a scam pretending to be ArenaNet.
The first email I got was this:
Account Security Alert: ArenaNet
[email protected];
Greetings!Due to an unusual change in your access pattern, the Guild Wars 2 account under this email address has been locked. This can be caused by logging in from a new location, but it may also signal an attempt to compromise your account. If you feel that your account’s security is at risk, please follow the steps below.
Step 1: Verify Your Account Ownership
Click on the link below to verify your e-mail address of the Guild Wars 2 account:
(And then here is a link telling me to click it to sort it out)
I have several of these emails also:
Guild Wars 2 Support
[email protected];
Greetings!It will be ongoing for further investigation by ArenaNet’s employees.
We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
Once your account authentication has been completed, we will check your account and let you know what we can do for you.
Need help or have questions about your account? Visit our support site: http://support.guildwars2.com/.
The Guild Wars 2 Team
Are these emails legit? I don’t see any reason for me to have any emails like these since I even checked security on this website and the only two IP addresses accessing my account are both my laptop and pc, so I’m really concerned.
Thank you for reading
Fake. Fakeity fake fake. Please delete and of course do NOT click any links.
Do you have authentication on your account? Is the email asking you to confirm that you want someone to access from XYZ IP address? That would be legitimate, and it’s offered to give you a chance to add a new, approved IP address or to do nothing and the IP will not be accepted.
We do not send emails that ask you to “verify your account.” We send emails to verify that you want to allow an IP to access your account, but that’s entirely different.
Guys,
THIS EMAIL IS FAKE. DO NOT CLICK LINKS, DO NOT RESPOND
GW2 logo at top
Greetings!
Due to an unusual change in your access pattern, the Guild Wars 2 account under this email address has been locked. This can be caused by logging in from a new location, but it may also signal an attempt to compromise your account. If you feel that your account’s security is at risk, please follow the steps
We do NOT lock accounts for the reasons expressed.
I figured as much, I was alarmed purely because they had somehow hijacked the official email address hence it showing up as on my safe list.
They didn’t highjack our email address. They are simply inputting it as the sender. Anyone can do that. I could send a mail as Robert E. Lee, Catherine the Great, or Captain Kirk. So could you. This is because the sender name is never verified against the sending address.
So as a savvy email user, don’t look at what it says but examine the email’s behind-the-scenes properties by doing a right-click and then reviewing “properties” on the popup. You’ll see who really sent the mail, and in these cases, it’s not us!
I today received an email, which Hotmail determined was sent by a safe sender, from GW2, it looks really authentic but my “Spidey-sense” was tingling so I didn’t click on the link provided by it.
Does Arena net send out such “click this link to confirm your account” emails? because the email address was exactly the same as the one used to send prior official emails, suggests to me that scammers may have somehow been able to send emails that appear to be authentic.
I can provide the link address for you to check, I didn’t include it in this forum post for security reasons.
No, we do not send such emails. We send emails that allow you to “white-list” an IP address, but those are entirely different. I still encourage you to check properties and review the mouse-over information to see where you really are going with the link provided. If it doesn’t say guildwars2.com, be very, very careful!
This spam gets really annoying, can I add “[email protected]” to my spam filter or would this probably block some legit ArenaNet Emails too?
I would strongly recommend that you not do that. There may be other options to block that won’t prevent you receiving legitimate mails from us. Although honestly I don’t know that we send out with a “from” address of “Support!GuidlWars2.com.” We own that inbound address, but it seems to me our outbound mails say things more like “The Guild Wars 2 team” and the like.
I merged a thread into this main thread about phishing attempts.
Please note our helpful thread (with samples!) about this topic: https://forum-en.guildwars2.com/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388
I keep getting these? [redacted link]
Hello,
Please read through this thread for information on the phishing attempts. I removed the link because we wish to keep links off this thread and do not want to send someone to an externally-hosted image.
Thanks for understanding.
Gail; Today I recieved an e-mail from what appears to be Guild Wars 2 support however something does not feel right about it. All the included links refer to “de.support.guildwars2.com.account.verification.loing.entvasss.gulldwars2.pw/.” Yes that is “gulldwars2.” Would you like me to forward it to you with the header information in a seperate text?
Here is the part of the e-mail that set off alarms first: “Once your account is complete certification, we will check your account. Once verified, you will receive in the near future in the game mailed mystery gift. If you do not complete the verification we will limit risk account or close the account” There was no period at the end.
Ken /|\
Of course that’s a fake. Note misspelling. Note horrible grammer. And the process makes no sense. Delete and ignore. Do NOT click links. And no, thanks, I don’t need to see the header information, although if you want to copy (without clicking links) the full body of the email and provide it here, I can add it to my phishing archives. Please do NOT include the links in the copy, if you do paste it here.
Just thought I’d inform of a New Phishing scam email that’s about That I got this morning. It had the GW2 Logo Looked rather legit however It tried to state due to a payment not going thru that my account was getting Shut down. It also states in this email that you get a 72 hour ban. didn’t make sense but like most of these emails ( I’ve seem plenty from WoW gaming) I didn’t click no links but the link they had when hoovered had .tk at the end.
This email is plenty to put fear not just in your account closing, banned for nothing but Credit card users may wanna be aware also.
I know from reading over forums you guys don’t have a hacks or abuse section to report headers of these such emails but its prolly an Idea to consider it will end up a monster later on.
I will add this one to my sticky thread on the subject, but can you send me the exact email content via PM? Thanks.
I keep getting email that says guildwars2 thinks my account was stolen
How do I know if these are legit
This is a phishing attempt I will merge into the main thread about this subject. For more information, please see this informative thread: https://forum-en.guildwars2.com/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388
yes, yes, I’ve read all the instructions, it’s really quite sad how many hoops must be jumped through to get something done around here.
My personal email isn’t even this ridiculous, and I have millions of dollars in paper assets in my email.
WHO?? actually knows what their serial key is. screw that. kitten was deleted a long time ago LOL.
Anyhow, I want my email address changed. I sent in a ticket about an hour ago and no one responded. This will need to be done today since I’m closing my other email account tonight.
Quick and easy fix, just update the email address on my account or give me the big boy button to do it myself as I see fit and I’ll be on my way.
this isn’t a request that can linger for 2 days. Ok? Treat me well, and I’ll do the same for you. that’s how a business relationship works.
I just want to point out that this question was asked via ticket and answered within one hour. Forums members should not post to rant, nor post instant follow-ups on tickets. Please allow our Support Team time to receive and review your ticket. They will do their very best to help you as quickly as possible.
Matter resolved – closing ticket as per member request.
I got the “mystery gift” one today as well.
Gaile, I’d offer to PM it to you in its entirety, but it’s already posted multiple times in this thread. Of course, if it will help, just say the word.
I’m tempted to simply reply to the email informing them that I’m investigating them “for further investigation be” and demanding that they send my Balthazar-blasted mystery gift at once.
Thanks — I have that one.
Personally, I would not respond to that thing. I’d delete it, using rubber gloves and tongs.
Here’s the situation: I’ve been getting weird messages supposedly from ArenaNet with the content in [LINK REDACTED] I thought it could be some kind of phishing attempt, since after the first time I followed the mail’s link and input my information, I couldn’t log into the game with it.
But the thing is, I’ve been getting them from time to time and today, I decided to use an online link scanner and it gave me [LINK REDACTED] these results. I’m now in a situation in which I don’t understand what I should do in fear it’s a really elaborate phishing scheme, because the message doesn’t quite elaborate on the problem.
What you received is a phishing emails. Searching this forum for “email” or looking for “phishing” would have answered your question.
With all due respect, putting up images about phishing emails on an external site is a very bad thing to do. I have redacted those links, and ask others who want to post images to do so on this forum, because I’m not at all comfortable having people blindly follow a link to an external site. That is just a very bad thing indeed.
Thanks for understanding.
i have got thist mail on my none gw account mail
so please be carefull ( evertyhing looks ok only the url beneath the links is weird )
i changed the links so no one can click them( if arenanet wants the links i will give them in pm )Greetings!
It will be ongoing for further investigation by ArenaNet’s employees.
We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, click the link below.
hxxps://account.guildwars2.com/account/login-support.htmlOnce your account authentication has been completed, we will check your account and let you know what we can do for you.
Need help or have questions about your account? Visit our support site: hxxp://support.guildwars2.com/.
The Guild Wars 2 Team
Covered here: https://forum-en.guildwars2.com/forum/support/account/A-Note-about-Phishing-Emails-1/first#post2074388
Please note that there’s a very informative post – with samples — on this link. It would be great if you would read that thread and make yourself aware of the emails that are known phishing emails and only post if there’s something new.
Having said that, I’ll try to continue to update this thread and post these information from time to time — or forum members can use the “quote function” to repeat this post — so as to keep everyone informed.
Even team members here at ArenaNet are receiving this phishing attempts.
Please read this thread on a regular basis to keep yourself informed of the latest attempts to steal your game account.
If you have received an email that is not on the samples — and I have a lot so please check carefully — then feel free to post that new phishing email here. Please remove all links before posting.
The last thing we want is to have anonymous links appear on the forums, particularly since they seem to pertain to potential phishing.
Please see our post about phishing above.
Hi Gaile,
Isn’t there a way to block these fishing emails?
I have pondered on this one, hoping there was a “If the sender reasonably doesn’t match the sending address, block it” filter. (Like “GuildWars2.com – ok! Gulidwaes2.com – NOT ok.” No such filter exists. I hoped for a “If there are ridiculous grammatical errors, block this email” filter. However, that would block a couple of my friends, so… 
The best thing to do is to simply delete it and to be careful with any email that contains links. When I reset my password, I still check the clickable link to make sure it’s not just some coincidental phishing email that showed up right when I expected a legitimate one.
I have received an email from “ArenaNet” and it is asking me to follow this link: https://account.guildwars2.com/account/login-support.html i need to know if this is from a phishing email
any help would be appreciated
Need a little more information. Do you have email authentication? Did you ask for a password reset? If the link truly DOES take you to that address, you’re simply heading to your account page. However, a lot of times it’ll look like that on the page, but really contain a different link underneath, that is, it says one address but goes elsewhere.
I really think you should read the sticky post about phishing emails to better understand what you’re seeing, and then react accordingly.
We really encourage folks to use this thread and not make new posts about phishing emails. If you cannot see it, look on page 2, or do a search for Phishing.
Thank you for your cooperation.
Remember folks — Please read this post before adding to the thread:
For a while now I’ve been getting emails that say my account has been stolen/hacked. The emails come from this email address, [email protected]. It says
snip
Those emails are fake, there are multiple threads about them as well as a sticky at the top.
https://forum-en.guildwars2.com/forum/support/account/A-Note-about-Phishing-Emails-1Please remove those links from your post above as they pose a danger to other players. If you have clicked on any of the links, you should change your password at once to avoid having your account stolen.
This is correct, and an important reminder for anyone: If you get a questionable email, please remove all links before posting.
I will merge this into the existing thread. Please review the thread into which this is merged and the following thread for more information and samples of actual phishing emails received by Guild Wars 2 players and non-players alike: https://forum-en.guildwars2.com/forum/support/account/A-Note-about-Phishing-Emails-1
