Is this email genuine? I got hacked!

#0 - July 30, 2010, 2:06 a.m.

I was hacked, so I changed my Battle.net password to something new. Now I had to re-log and couldn't, and got this email:

Greetings,

Account Name: (MY NAME IN CAPS)

Thank you for contacting the World of Warcraft Game Master Department regarding the compromised account.

Information regarding the status of this account has been forwarded to a specialist for further analysis. When their evaluation is complete you will be notified via e-mail of the status of the above account and the possibility of reimbursement. This may take a few days for you to receive notice, and we apologize for the wait.

To ensure the security of your account, we recommend following the http://us.battle.net/security/checklist/ on our Account Security Site, which can all be found at http://us.battle.net/security/.

To protect your privacy and security, we have reset the password for this account. A new, randomly generated password will be emailed to you shortly.

Since the password reset email will be coming from [email protected], please ensure that any email filters are set up to accept this message. If you are unsure how to do this, please contact your email provider. If you cannot locate the email you should check any spam or junk folders in case the message has been filtered out. Troubleshooting tips on how to remove email filters from specific email providers can be found at http://us.blizzard.com/support/article/21051.

If you are still unable to locate the email containing your new password, please contact us using this form: http://us.blizzard.com/support/webform-us.xml.

*** Please do not respond to this email as a Specialist will contact you upon the conclusion of their investigation. ***

I hoped this might really be from Blizzard, but then it said to expect an email from [email protected], an address which has been trying to phish me for a while now. I'm not sure how they got me, I never followed any links - I reset my Battle.net password after typing in "battle.net" and being directed to what appeared to be the real us.battle.net/en page. If this is another part of the scam and I can no longer log in to contact a GM, what do I do?

#36 - July 30, 2010, 8:44 p.m.

This account has been reported as compromised, so some correspondence and password changes are to be expected.

It sounds like you may have been phished at some point.

The best way to tell a 'good' email from a phish is to pop open the internal routing headers on the email.

If it didn't originate from the Blizzard domain, it's not blizzard.

Don't trust the FROM address that normally shows in an email - from anyone. That is as easy to spoof as writing a bogus return address on an envelope. They often use 'real' information there to further confuse and trick players. The internal routing information isn't the easiest thing to decipher, but it will show you where something came from.