Fake Email From Blizz?!?!?!

#0 - July 15, 2010, 7:37 a.m.
Blizzard Post
I have been receiving emails from Blizz that my account may be closed due to "Payment Method Exception". Now I do not know what this is, but after reading and clicking the link in the message it took me to a site that was in Chinese writing. I immediately left the site and that is when I decided to come here. The weird thing about this email is that it is COMING FROM [email protected]. No because I have been receiving these emails for a while I dont think they are real but here is a copy of the email anyway. ALSO LOOK AT THE battle.net address is wor1dofwarcraft.com and that is what made me also think this is a bunch of bull. At the end of the email Blizzard entertainment is spelled wrong as well. It is spelled Blizzard entertainmet. I was just wondering how they send me an email containing the @blizzard.com in the senders address as I dont want to ignore the email if it is actually legit.

****Notice of Account Investigation****

Account Action: Investigation
Reason for Action: Payment Method Exception

After a recent investigation, we have found that the payment method of your account violated the interest of third parties
This activity violate the World of Warcraft Terms of Use. We ask that you take a moment to review your account payment
history at Account Management(), or you can click here to review it.
This World of Warcraft account could be closed by the Account Administration staff if the situation becomes more serious.
This action has been taken in accordance with the Terms of Use and our Game Policies ().
Only the Account Administration department can address disputes or questions you may have about this account action. To
learn more about how we are able to assist you, please visit us at
Regards,

Account Administration
Blizzard Entertainmet
#5 - July 15, 2010, 11:22 a.m.
Blizzard Post
As others have said - those aren't coming from Blizzard.

The From line in an email is as easy to forge as writing another return address on an envelope.

The internal routing headers give a true picture.

In this case, they didn't even disguise and misdirect the links - they are cleverly misspelled using a 1 for an i or an L for instance or two v's together instead of a w.