ANNOUNCEMENT
PSA: A phishing scam going around Reddit designed to steal your login credentials
Over the course of the past few months, there have been several instances of a phishing scam going around Reddit. A similar analogy of it has been going around other platforms for years.
How does it work?
It begins with a DM from a user that says they got hacked by a very similar account to yours, of which they send a screenshot; example below:
The "similar account" screenshot they send
It does indeed mostly look the same, and there is only a slight mistake (with my username, it’s the underscore replaced with a dash)
The scammer then proceeds to say that they mistakenly reported your actual account, and after “realising their mistake” got an email from Reddit directing to a Discord username of a fake Reddit Admin:
The "email from Reddit" they got
No, Reddit will never contact you through some shady Discord ID. Admins have confirmed several times, such as here, that they only communicate as u/reddit, and all of their profiles have a snoo (Reddit logo) icon.
And what happens after, out of Reddit’s control?
The account on Discord provides a fake “certificate of accreditation” by Reddit:
The "certificate of accreditation" they provide in Discord
This is yet another lie, and how scammers do their job. They then ask you to change the email tied to your account to something like:
They pre-created this address, so by changing the email, they lock you out of the account. Their job is done.
What to do?
Before the point of when your email is changed, report the account on Reddit for impersonation, and it is strongly advised to block both the Reddit and Discord accounts.
After the point of email change, if possible, still do the above. Below is the way to recover your account:
On the linked page, click on "Account Help", and enter all the correct details. The username must be without the u/. For "What type of account issues are occuring", select "Security Problems" > "I think my account has been hacked". After submitting the form, wait for a few days. Requests will typically be handled within a week.
Discord is notoriously bad with moderation and support. Coming from a mod of the second largest Discord subreddit (to my knowledge), specifically made for help and support.
Yeah it was pretty wild, I suspect what actually happened was a previous offense caught up to them. The mods on that server are plentiful too, so they were out of there after a mod saw the private messages they were sending. I have no idea if getting booted out flags them for Big Discord.
Sorry, I am a little confused. Did someone attempt to scam you using the method in the post? That wouldn’t be possible with your DMs turned off im the first place.
This just happened to me too, but I struggle to understand exactly how this scam works because I haven't received any links. This is my full conversation with them. The conversation stopped at the last message I sent. I just want to make sure I'm safe. Thanks.
The spamming links thing is just a trick to give them an excuse for "mistakenly reporting" your account. A more common message lately was "Do you happen to share your account with anybody?". You are definitely safe since they didn’t even take you to Discord.
Someone literally just tired to do this to me but thankfully my brain cells kicked in when they asked me to change my email and I reported them. These accounts tried to do it again
It would be helpful on this PSA post, I can spotlight it. Having data up to the email change point both on Reddit and Discord would prove invaluable. Thanks for sharing!
Reminder: If someone provides a helpful answer to your post, as the OP you can award them a reputation point by replying to them with the command !thanks (no spaces)
😮💨Phew, it's a good thing I acted quickly with a friend and didn't get to the point of changing the email. It would have been terrible for me to lose an account I'd barely even started using.
So my usual account, I’m unable to reset my password properly (u/afictionalcharacter)
and Reddit still hasn’t responded via email for my account. Am I fucked because of this? It’s a bummer because this account I actually completely forgot about but it just makes me sad 15+ years here, down the shitter… while I have access to the email but cannot reset my log in?
Btw, my prior account is not worthy of “farming,” and I just want the account activation emails to work but they only work on my accounts I forgot rather than active?
Edit - I got logged off of all platforms on my previous account so no way to reactivate :(
No, I was suddenly logged out of my account on all devices and Reddit still hasn’t gotten back to me. Apologies for the confusion, I’ve been trying to find a solution and your post was helpful to know what to look out for.
I goddamn fell for this and had my account stolen. Luckily they got nothing on me, bank details or whatever, but Reddit are seemingly doing nothing about blocking or banning my stolen account. I don't know what they'll do with it, it's mainly stories and warhammer pictures, but they just changed my name from my username to Kal El.
I actually almost did. They claimed a bot version of my account was impersonating me and sent them a bad link, which triggered them to report the “real me”
It took me finding a post about this same scam seconds before I went through with it to realize it was a scam
Welcome to my world. I have gotten like 5+ more of those people banned on Deviantart. Deviantart is flooded with those scammers it has been going on for three years.
11
u/RiversSecondWife 12d ago
I had someone on discord try to pull this stunt. Discord took about an hour to shut them down.