How to spot fake 'Blizzard' emails

World of Warcraft players are increasingly targetted by fake phishing emails designed to steal the player's account.  These emails are getting increasingly devious in their techniques.  In this guide we will talk about ways to tell whether an email is fake, what to do if you get a fake one, and also some examples of some of the fake emails we have encountered. 

How do you tell if the email is real or fake?

Note: This section of the guide is taken from Nephadne's brilliant guide over on the official forums which can be found here

Here are a few key points you can check straight away in order to determine whether an email is genuine.

• Emails from Blizzard will always originate from an @blizzard.com or an @battle.net email address.
• Any correspondence sent from Blizzard Entertainment will make use of correct spelling and grammar.  Multiple typographical errors, unusual sentence structure or obvious grammatical inaccuracy should serve as an immediate warning to proceed with caution.
• Blizzard employees will never ask you for your account password via any means.  No matter how official or legitimate an email may look, if such information is requested then it is simply not from Blizzard Entertainment.
• Phishing mails will frequently claim that an account has violated, or been found in breach of, a specific policy. These mails often employ intimidating wording and claim extreme actions (including account closure or termination) will be taken should the player not ‘verify ownership’ of their account.  This is not a standard practice of Blizzard Entertainment.
• Phishing mails may also appear to offer complimentary, and often hitherto unheard-of, in-game pets or mounts, periods of game time credit, or special advance access to Alpha and Beta versions of forthcoming Blizzard games.  These mails can often seem too good to be true, and as a result they likely are! Please double-check the existence of anything mysteriously offered to you via an email, and do not accept any ‘offers’ you cannot confirm as official.
• In many cases, these fake emails will request that account owners visit a specific (malicious) website, where they will be asked to “log in”. While these sites can on occasion be extremely similar in appearance to actual Blizzard pages, inputting one’s login details therein will directly submit it to the companies or individuals in question (thereby instantly rendering the account liable to compromise).  If ever asked to click through to a website linked within an email, please be very wary – double-check the destination of the hyperlink before you click.

So, this email comes from someone showing as @blizzard.com  or @battle.net. That means it’s real, right?

Unfortunately, no. The appearance of an official email address as the sender is not enough to guarantee an email’s veracity, and you should still remain cautious. This is due to the fact that it is possible to alter the appearance of a sender address in the “From” field of an email, and this process (known as ‘spoofing’) may cause a malicious email to seem as if sent from Blizzard.

In order to verify the actual sender address of any email you receive, you will need to check the email header information.

What’s an email header? How do I find it, and what am I looking for?

Most email clients and providers will allow you to view more information about the email than is normally shown, including specific details about the sender, the path the email took in reaching your inbox, and any other redirections that the email may have been subject to prior to arriving in your mailbox.

For more information on how to check this data, including some specific details for some of the more common email providers, please see the following Blizzard Support site article;

How to Identify "Spoofed" Email Addresses
http://eu.blizzard.com/support/article.xml?locale=en_EN&articleId=43010

OK, but the links in my email look right. You said something about needing to ‘double-check’ them?

Yes, indeed. Through the use of HTML coding, it is possible for an email link that looks perfectly harmless to lead you somewhere else entirely (and inevitably to a fake website).

Depending on your Internet browser or email client, you can sometimes see the destination URL a link will use displayed in the bottom corner of your window, or in a hovering tooltip.
However, for a non-specific means of uncovering the URL that any hyperlink will direct you to, you may use the following steps;

Right-click the link, and then select ‘Copy Shortcut’, ‘Copy Link Location’, ‘Copy Hyperlink’ or similar;
Paste this information into a text-based application so that you may examine the address to be used.

If you are ever in doubt about the veracity of a link, it is always safer to navigate there yourself.

Why am I getting these emails in the first place? I don’t remember giving my email address out to anyone.

Most commonly, ‘databases’ of potential player email addresses will have been compiled through the use of any unofficial World of Warcraft web pages (such as fan sites, wikis or guild websites), as well as social networking sites (like Facebook, Myspace or Beebo), so your email address will likely have been on display inadvertently without you ever specifically giving it out.

The most reliable way to stop receiving these types of mails, and also to provide an extra bit of security to your account, is to consider creating a new email address purely dedicated to World of Warcraft and Battle.net use.
During the creation process, do make sure that no part of the new address or password coincides with your previous email addresses, passwords, nicknames or profile information on any of the above sites, and that you avoid using this new email account for anything other than Battle.net in the future.

NOTE: As touched on above, with your Battle.net email address also functioning as your account name, using a dedicated, secret email account can actually help secure or increase the protection on your World of Warcraft account.

(Thanks again to Nephadne for the content of this section)

Hmm.....I kinda clicked on a fake email and told them my account details, shoe size, etc..... HALP!

First of all, no need to panic.  Usually all damage is reversable.

If you can, try changing your password at: https://eu.battle.net/account/management/
If this does not work, you will need to follow our account recovery guide: http://www.bamboobix.info/index.php?topic=1331
You should also review our account security guide: http://www.bamboobix.info/index.php?topic=1136

Remember, keep calm, have patience, and all will be fixed up as quickly as possible.

Can I report these fake emails anywhere?

Glad you asked!  There are two places to report these emails.

The first is by sending them directly to Blizzard.  Simply forward them to hacks@blizzard.com

The second option is to send them to us by forwarding them to hacks@bamboobix.info
If you forward them to us, here is what we will do with them.  Firstly, rest assured we will forward them directly to Blizzard for you. We will also check them to see if they are a new variation, and if they are we will add them to the examples section of this guide. By doing this you are helping us, and other players to be more aware of the possible scams.  All personal information will of course be removed prior to publication.  Sending them to us is optional.

Thanks for reading, and keep safe!

Example Phishing Emails

Please note, all these are FAKE emails that players have received.  We post them here (without any personal information or dangerous links) to help players see what kinds of phishing emails are out there.






This next one is something to watch out for.  Unless you have a faction change in progress, Blizzard will obviously not email about one.  So if you do get an unexpected email about one that doesn't exist, then don't trust it!  Below is an example of a fake one.