Fake Fortnite Reward Pages Steal Player Accounts
Scammers are using fake Fortnite reward pages to trick players into revealing their Epic Games login credentials, leading to account theft and potential fraud.
Cybercriminals are actively targeting the massive player base of Fortnite with a persistent phishing scheme that leverages fake reward pages to steal user accounts. These deceptive websites are designed to mimic legitimate Epic Games login portals, preying on players' desire for in-game currency like V-Bucks or curiosity about their account's "locker value." By presenting enticing offers or tools, scammers lure unsuspecting users into entering their Epic Games username and password, effectively handing over the keys to their accounts.
The tactic, while not new, remains highly effective due to Fortnite's immense popularity, boasting around 110 million monthly players and over 650 million registered accounts. The audience's demographic also plays a role; younger players, who are often more active on social media and less familiar with social engineering tactics, are particularly vulnerable. This vulnerability was highlighted when Epic Games was fined $520 million by the FTC in late 2022 for alleged practices that exposed children to strangers and financial exploitation.
Stolen Fortnite accounts are a lucrative target for cybercriminals. Compromised accounts can contain rare or valuable in-game items like skins, which can be sold on underground marketplaces for real money. Attackers can also exploit saved payment methods within the account, use it to scam the victim's friends, or attempt to reuse the stolen credentials on other online services, hoping for password reuse.
Scam pages often employ various lures. Some promise free V-Bucks or cash through fake collaborations, while others offer to calculate the monetary value of a player's in-game "locker," which contains all their acquired cosmetic items. Another variant impersonates settlement claims, falsely suggesting players are owed money from past legal actions against Epic Games, such as the FTC settlement, but directing users to a fake login page instead of a legitimate claim process.
Regardless of the specific hook, the ultimate goal is the same: to capture login credentials. The fake login pages are meticulously crafted to look identical to the official Epic Games login, making it difficult for users to distinguish them from the real thing. This sophisticated impersonation is key to the scam's success.
To combat these threats, security experts advise players to exercise extreme caution. It is crucial to recognize that Epic Games does not offer official tools for valuing accounts, nor do legitimate giveaways require logging in through third-party websites. Players should always ensure they are logging into their Epic account directly through the official website, epicgames.com.
If a player has inadvertently submitted their login details to a fraudulent site, immediate action is necessary. This includes changing the Epic Games password instantly, enabling two-factor authentication (2FA) for enhanced security, and reviewing linked email accounts for any suspicious activity. Additionally, reporting the phishing site to Epic Games support and flagging it in the browser can help prevent others from falling victim.
Security tools like Malwarebytes Browser Guard can proactively block known phishing sites, providing a crucial layer of defense. By staying vigilant, verifying offers through official channels, and prioritizing account security measures like 2FA, players can significantly reduce their risk of falling prey to these account-stealing scams.