Octopus Overlords

There have been a number of phished OOer Steam accounts lately. We need a single, visible thread in which to collect those reports rather than scattering them over multiple forums. I'm setting up this thread for that purpose. Yes, we already had a thread in Meta, but I want to ensure that the first post contains the necessary information as to what to do.

What the phishing scam looks like, with apologies to Scoop:

You get a message from a friend asking you to vote for something (or an offer for free whatevers.) Your friend gives you a link to what looks like an official Steam page. You log in, and within seconds your authenticator is removed, your email address is changed, and the scammer now controls your account. They sell off/trade your high value items, then begin to contact all of your friends with the same message until they get another bite. Here is an example of the chat:
If you get a message like this from a friend, do not respond, as they may immediately unfriend you to stop you from taking action.

First, report them. It takes less than a minute. After a few people report them, the account is locked by Steam. That reduces the damage done to the rest of the victim's friends. Here is the process, starting from the person's profile page:
Second, respond that you know it is a scam if you want to (but again, this may result in them unfriending you, forcing you to look them up again later.) There is no need to block them or unfriend them. They rarely waste time messaging you again once they know you're a failed target - they want to move on to as many people as possible before they are locked out.

Third, post in this thread to warn other OOers.

Bonus community service: Send them a PM on OO, or contact them elsewhere to let them know ASAP that their account is compromised. They'll want to act fast. Then link them to this thread.

If you are the victim:

1. Open a ticket with Steam support immediately. You do not need to be logged in to do this. It is also best if you do it from the original email address the account was created with (if still available.) Get the ticket in to get in the queue, then go back and edit it to update it with more information later.
2. Update the ticket with the information they're going to want. Some bits that will help if they're in there:
[*]The name, billing address, and last four digits of a credit card used on the account
[*]Screenshots of receipts/pages showing keys redeemed on the account (for instance, a Fanatical or Green Man Gaming page showing redeemed keys.)

Apiece of account security advice: Buy a Steam Wallet card. Even a cheap one. Scratch it off, redeem it on your account, then put the used card and the receipt from the store in a safe place. This one thing could be enough to regain control of your account should you ever lose it, as it gives you a piece of hard evidence, that Steam accepts as proof, that the account is yours.

Previous threads on the topic:

/edit - I missed a fourth thread.

https://www.octopusoverlords.com/forum/ ... hp?t=98660
https://www.octopusoverlords.com/forum/ ... hp?t=98686
https://www.octopusoverlords.com/forum/ ... hp?t=97864
https://www.octopusoverlords.com/forum/ ... ?p=2864921

I am asking that this thread be stickied, and the duplicate threads be locked, Mod willing.

And Adventurene

/edit - who is apparently Sectoid on OO.

Blackhawk wrote: ↑Sun Nov 28, 2021 3:44 pm And Adventurene

/edit - who is apparently Sectoid on OO.

Yup. About to post. Though I wasn't sure who the OO counterpart was.

Same here.

There is no need to block them or unfriend them. They won't waste time messaging you again - they want to move on to as many people as possible before they are locked out.

Actually they keep on pestering you to click that link and to hurry time is short blah blah

Blackhawk wrote: ↑Sun Nov 28, 2021 3:44 pm And Adventurene

/edit - who is apparently Sectoid on OO.

And when I told him, after the second time he chatted, "Go scam someone else. Message me through the website if you need me", the scammer unfriended me. Probably so I couldn't report the account. Should have reported first, but was busy when it happened. I'll know for next time.

Just got a phish attempt on Steam posing as [OO]Adventurene. Unfortunately, they forgot they already got me once.

Daehawk wrote: ↑Sun Nov 28, 2021 3:50 pm Same here.

There is no need to block them or unfriend them. They won't waste time messaging you again - they want to move on to as many people as possible before they are locked out.

Actually they keep on pestering you to click that link and to hurry time is short blah blah

Do you keep responding? I noticed that both of the ones today follow the same formula. I suspect that there isn't anyone actually monitoring. It's likely a program/script. So every time you respond, it triggers the program to send something new. It's probably best to not respond at all. Just follow the steps to report them.

I"m kind of sad that it's all automated - I enjoy toying with scammers




Thanks Blackhawk detailing the process of reporting the account.

He hit me too.

Another one for adventurene. Man, nobody real ever messages me.

SHAME

Im sorry everyone. Please block to feel safer.

Baroquen wrote: ↑Sun Nov 28, 2021 4:24 pm And when I told him, after the second time he chatted, "Go scam someone else. Message me through the website if you need me", the scammer unfriended me. Probably so I couldn't report the account. Should have reported first, but was busy when it happened. I'll know for next time.

I have updated the OP to change the order of responses and to give a warning about messaging back, thanks.

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Ding-ding

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Ding-ding

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Ding-ding


No worries. The fact that this thread even exists, and that it's the fifth of its line, shows that lots smart, careful people have fallen for it.

[OO]Adventurene messaged me too. i ignored

Changed my password. Sorry about that, everyone. These scammers really suck.
Is there anything else I need to do?

No worries.

Sectoid wrote: ↑Sun Nov 28, 2021 5:50 pm Changed my password. Sorry about that, everyone. These scammers really suck.
Is there anything else I need to do?

I'd activate SteamGuard if you haven't, and check the bit up above about a Steam card.

Also, they "blocked" all the friends they tried to scam on my account. So, it made it easy to see who I needed to contact about securing their accounts. If you got hit, check your friends list for Blocked friends. It doesn't mean they blocked you (you wouldn't see them in your friends list if they did). It means YOU blocked THEM. So, click on their name, View their profile, and Unblock them by clicking on the '...' and click 'Unblock'. Then you can message them about the scam.
You can also click on this to see your entire chat log and see who you need to notify:
https://help.steampowered.com/en/accoun ... essagesLog

That way, if they did block you, you can still message them outside of Steam and let them know.

Also, once you change your password, click on this link and DeAuthorize all other computers:
https://store.steampowered.com/twofactor/manage

The wording in these is interesting, as you can tell the primary language of these scammers is not english, as it's less indirect with 'vote for the team of my friends' vs vote for my friend's team. That would stick out like a sore thumb to me.

Sectoid wrote: ↑Sun Nov 28, 2021 6:50 pm Also, they "blocked" all the friends they tried to scam on my account. So, it made it easy to see who I needed to contact about securing their accounts. If you got hit, check your friends list for Blocked friends. It doesn't mean they blocked you (you wouldn't see them in your friends list if they did). It means YOU blocked THEM. So, click on their name, View their profile, and Unblock them by clicking on the '...' and click 'Unblock'. Then you can message them about the scam.
You can also click on this to see your entire chat log and see who you need to notify:
https://help.steampowered.com/en/accoun ... essagesLog

That way, if they did block you, you can still message them outside of Steam and let them know.

Also, once you change your password, click on this link and DeAuthorize all other computers:
https://store.steampowered.com/twofactor/manage

Yeah, this happened to me as well Sectoid. They blocked almost everyone so they couldn't message me back.

I'm starting the question the wisdom of friending people on steam or other platforms except with people who I play board games online or multiplayer with. I enjoy the social aspect of knowing what games people are playing on the activity stream but really it also opens me up to bad actors. I'm souring on social media as a whole. I hope everyone doesn't mind but I am unfriending people except for gamers I am active with and I talk to frequently.

Sectoid wrote: ↑Sun Nov 28, 2021 6:50 pm Also, once you change your password, click on this link and DeAuthorize all other computers:
https://store.steampowered.com/twofactor/manage

You do not have any other devices authorized by Steam Guard.

Good tip there. Thank God I didn't have any.

These phishing tactics are becoming more and more sophisticated. Even money on true sentience first being developed by a phish or spam bot.
Doesn't bode a single bit of well for us.


"Hey man u busy" indeed.

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Im sorry everyone. Please block to feel safer.

This not how my first mention in the OO Meta forum would happen.

Scoop20906 wrote: ↑Sun Nov 28, 2021 9:59 pm

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Im sorry everyone. Please block to feel safer.

This not how my first mention in the OO Meta forum would happen.

Long time no see!

Drazzil wrote: ↑Sun Nov 28, 2021 9:55 pm These phishing tactics are becoming more and more sophisticated. Even money on true sentience first being developed by a phish or spam bot.

Nah, I took a lesson writing chatbots. Doesn't take much nowadays. A script kiddie can do it.

Why wouldn't we sticky this in EBG? I would think we'd want the most eyes to see it right away if there's an update.

I wonder if there is any correlation to those of us who post our Steam links/ID’s in our sigs? Maybe that’s not a great idea…

Carpet_pissr wrote: ↑Wed Dec 01, 2021 12:34 pm I wonder if there is any correlation to those of us who post our Steam links/ID’s in our sigs? Maybe that’s not a great idea…

Very unlikely. In fact, near zero probability. There are tens of millions of Steam users, and if they wanted to just find accounts, they could plug in a dictionary-based script that would find them accounts by the thousand. They don't target people based on finding their steam profile, they target people via friend lists. An it's incredibly widespread right now, not an OO thing. This is everywhere. And here it is a result of one person with OO friends falling for it, then hitting enough OO people that some of us fell for it, too.

Besides, being targeted isn't a problem at all. It's like getting a spam call or text - as long as you recognize that you didn't stay in their resort/your warranty isn't expiring. As long as you recognize that a friend sending you links that require signing in to something is a red flag, there is zero risk. Getting the message does you zero harm. You have to act on it.

Blackhawk wrote: ↑Wed Dec 01, 2021 1:22 pm

Carpet_pissr wrote: ↑Wed Dec 01, 2021 12:34 pm I wonder if there is any correlation to those of us who post our Steam links/ID’s in our sigs? Maybe that’s not a great idea…

Very unlikely. In fact, near zero probability. There are tens of millions of Steam users, and if they wanted to just find accounts, they could plug in a dictionary-based script that would find them accounts by the thousand. They don't target people based on finding their steam profile, they target people via friend lists. An it's incredibly widespread right now, not an OO thing. This is everywhere. And here it is a result of one person with OO friends falling for it, then hitting enough OO people that some of us fell for it, too.

Besides, being targeted isn't a problem at all. It's like getting a spam call or text - as long as you recognize that you didn't stay in their resort/your warranty isn't expiring. As long as you recognize that a friend sending you links that require signing in to something is a red flag, there is zero risk. Getting the message does you zero harm. You have to act on it.

Blah, blah, blah! Are you to vote for my CS:GO friend team or NOT?! DO IT NOW PLASE.

Hrothgar wrote: ↑Tue Nov 30, 2021 6:19 pm Why wouldn't we sticky this in EBG? I would think we'd want the most eyes to see it right away if there's an update.

My thought was in Video Games. Right next to the Steam friends sticky... I would think active gamers on Steam read that forum most?

Can't it just be a forumwide sticky

LordMortis wrote: ↑Wed Dec 01, 2021 3:06 pm

Hrothgar wrote: ↑Tue Nov 30, 2021 6:19 pm Why wouldn't we sticky this in EBG? I would think we'd want the most eyes to see it right away if there's an update.

My thought was in Video Games. Right next to the Steam friends sticky... I would think active gamers on Steam read that forum most?

Not all of the people who have OO friend lists are active gamers anymore. And not all of those who are check that forum regularly, and might ignore the fact that there are new posts in there for a few days at a time. My suggestion was to put it here only because it's rarely posted in, but when it does get a post it's usually something of significance, so people are more likely to pay attention.

But if others decide elsewhere would be more effective, then by all means! I've had stickied threads in most of the forums by this point, so I won't be offended!

Scoop20906 wrote: ↑Sun Nov 28, 2021 9:59 pm

Scoop20906 wrote: ↑Sun Nov 28, 2021 5:28 pm SHAME

Im sorry everyone. Please block to feel safer.

This not how my first mention in the OO Meta forum would happen.

It's ok. We can go all hangout together on leper island.

Molokai

Now jaddison80

Alefroth wrote: ↑Thu Dec 09, 2021 4:11 pmNow jaddison

Ditto

LOL, just came to report this.

Come on down, you're the next contestant on "Can I Steal Your Account?!?"

Just dropped in to report the same.

ya Jaddison