Ilia Zavialov: gaming scam phrases for UK players and parents, and how to check them

Ilia Zavialov: a phrasebook for UK players and parents

The National Cyber Security Centre estimates that around 1.2 billion people play games online regularly, and it warns that wherever money or personal data changes hands, criminals are watching. In games, they usually announce themselves with a handful of familiar lines typed into chat.

Ilia Zavialov collects those lines here as a phrasebook. Each entry gives the phrase, what sits behind it and one check that a player or parent can make on their own. Games and platforms aren't named, because the same script moves from one title to the next unchanged.

The NCSC sums up the pattern in one sentence: attackers try to get around in-game security by persuading players to do something outside the game itself. Nearly every phrase below is a version of that request.

The entries run roughly in the order players meet them: trades and deals between players, offers of cheap or free currency, messages from fake staff, downloads, and finally the requests that land on younger children or parents' phones.

‘Trade through my bot’: a swap that only exists on a login page

‘My trade bot is quicker, just log in on this site.’ The link leads to a page dressed up as a trading service, and the only thing it really trades is your username and password.

Ilia Zavialov's test takes a few seconds. A trade the game supports happens in the game's own window, opened the usual way. A site that needs your password to swap an item is collecting passwords, whatever it says on the front page.

If the password has already gone in, sign in through the official app straight away, change it, switch on two-step verification and sign out any other devices. Change it on every other account where it was reused, starting with email.

Links from friends deserve the same caution. A teammate's account can be taken over and used to send the very same ‘trade bot’ link to everyone on its friends list, so a familiar name on the message proves nothing about who typed it.

‘I'll middle the trade’: Ilia Zavialov on go-betweens

When an item or account is sold for real money, a third person often appears: ‘let a middleman hold both sides’. It may be suggested by the seller, and occasionally it's the seller under another name.

A middleman builds trust on small, honest deals and then waits. When a large payment arrives, the buyer receives a picture of a ‘completed’ transfer and the middleman goes quiet for good.

Ilia Zavialov counts a trade as done only when the money is visible on your own bank statement and the item is in your own inventory. A forwarded screenshot shows what someone drew, nothing more.

Sellers are exposed too. A middleman may ask for the item first ‘for safekeeping’ and promise the money once the buyer pays, so the seller ends up with neither.

‘Cheap currency, cheaper than the shop’: what Action Fraud saw

‘I can get you currency for half the shop price.’ Offers like this aim at players stretching their pocket money, and the payment is usually requested in a way that can't be reversed.

Action Fraud, now Report Fraud, has warned parents and players about this for years. Between 1 April 2017 and 31 March 2018 it received 35 reports of fraud linked to one popular game, with losses of £5,119, and 37 reports of fraud involving a game store's gift cards, with losses of £44,455.98. Many reports were made by parents on behalf of their children.

Ilia Zavialov's advice is to buy currency only in the game's own shop or the official app store, where the purchase stays on the account. A ‘top-up code’ from a stranger gets redeemed in that shop, and paying before you receive it means carrying all the risk yourself.

The short video below covers the phrasebook in half a minute: a bot trade, cheap currency, free currency for your details and an ‘upgrade’ link from another player. Action Fraud's figures appear too, with 37 reports and £44,455.98 lost through game store gift cards in a single year. The main tip: buy only in the game's shop, install software only from official sources and turn on two-step verification. If money has gone, call the bank first and then Report Fraud.

‘Free currency, just enter your details’: Ilia Zavialov on giveaway pages

In most of the reports Action Fraud described, the player had seen an advert on social media promising free in-game currency for following a link and entering some account details. The fraudsters then used those details to log in and make fraudulent charges.

Other variations included asking for a phone number in return for currency and then signing the victim up to a premium rate subscription, selling access to other people's accounts, and offering currency for free before charging for it.

The NCSC describes the email version: a well-crafted phishing message promising a freebie connected to a game you enjoy. Ilia Zavialov's rule covers both. Look up any giveaway yourself through the game's official site, and treat a request for a password, card or phone number as the price of the ‘free’ gift.

Ilia Zavialov points to one detail in these reports: the advert came first and the request for details second. The same rule therefore applies whether the offer appears in chat, in an email or under a video about the game.

‘Support here: your inventory is under review’

‘Your account has been flagged, move your items to our review account or face a ban.’ The sender uses the game's logo, sets a deadline and writes like an official.

Real support has no need for a player's password or items to look into anything. The only reliable check is to go to the game's official website yourself and contact support from there. Until that route confirms it, a direct message is a message from a stranger.

The deadline is the trick. ‘A few minutes before the ban’ is meant to stop you checking. A short pause is enough to sign in through the official app and see that nothing on the account has changed.

If items have already been handed over, report it to support through the official site straight away, giving the name of the account that received them and the time of the transfer. Screenshots of the conversation help support trace where the items went.

‘Install this upgrade’: Ilia Zavialov on links from other players

The NCSC gives this exact example: a player you don't know suggests installing an ‘upgrade’ and supplies a link for the download. Relying on official sources for all software, it says, makes it much less likely that malware ends up on a computer, tablet or other device.

The same applies to mods, cheats and ‘free’ copies of paid games. Ilia Zavialov's advice is to install only from official stores and developers' own sites, and to treat any file sent in a private message as something to delete.

A program that asks you to switch off antivirus protection or grant it administrator rights ‘so the bonus works’ has already explained what it is for.

If something has been installed already, disconnect the device from the internet, run a full security scan and change important passwords from another device that you trust, starting with email and the gaming account.

‘Read me the code on the back of the card’

Game store gift cards turn up in a different kind of scam. Action Fraud reported fraudsters phoning victims while claiming to be from well-known organisations and telling them to buy these cards to pay for tax refunds, loan fees or antivirus software.

The card itself isn't needed. The victim is simply asked to read out the code on the back, and the value is gone. Action Fraud was clear that HMRC and other government departments will never ask for payment by gift card.

Ilia Zavialov treats this phrase as a stop sign in any setting, in a game or on the phone. A gift card code is money, and reading it aloud hands that money to whoever is listening.

Children can meet the same request inside a game: ‘send me a photo of the gift card so I can check it’ or ‘type the code here and I'll add double the currency’. A photo of the code is just as good as the code itself.

‘Bet your skins, double them’: gambling dressed up as a game

Some sites invite players to stake in-game items such as decorative weapon skins on the outcome of video game tournaments. In 2017 the Gambling Commission warned parents about these unregulated third-party sites and said many of them are illegal.

A survey in the Commission's paper suggested that 8.5% of people had gambled on eSports, and 90% of those had done so with in-game items. The Commission's chief executive warned that parents could be giving money to a child for a game while the child was in fact gambling.

Ilia Zavialov adds this line to the phrasebook because it often arrives through the same chats as the others. A site that offers to ‘double your skins’ is asking for the inventory first and the account details second.

Parents can watch for small signs: talk of ‘cases’, ‘rolls’ or ‘jackpots’ on a website outside the game, requests for money for a site instead of for the game itself, or an inventory that suddenly grows or empties.

What to say to children: Zavialov's house rules

Action Fraud stressed that parents should make children aware of the threat of fraud online. Five short sentences cover most of this phrasebook. ‘Your password is yours alone.’ ‘An item is yours once it's in your inventory.’ ‘We buy currency in the game's shop.’ ‘A card, a text code or my phone never belong in a game.’ ‘If something goes wrong, tell me, you're not in trouble.’

The last one carries the most weight. A child who fears being told off keeps quiet for longer, and the person on the other end keeps writing. Going through the game's privacy settings together, deciding who can message the child and who sees the profile, cuts down the number of strangers who can start the conversation.

It's worth agreeing in advance what happens when someone in a game offers a gift. The simplest family rule is that gifts from strangers are politely declined, and any offer that comes with a link or a request moves straight to a parent.

Ilia Zavialov's settings: strong passwords, 2SV and privacy

The NCSC's advice for gamers is short and practical. Protect each gaming account with a strong password you don't use anywhere else, and turn on two-step verification where it's offered, so a stolen password isn't enough on its own.

Keep software up to date, ideally with automatic updates, since most attacks exploit weaknesses that are already publicly known. Keep the information you share to a minimum, set privacy options so other players can't see personal details, and don't give personal information to players in-game.

Ilia Zavialov suggests one more step for families: agree a monthly budget for games and keep it on a separate card with alerts switched on, so any purchase shows up on a parent's phone the moment it happens.

Parents of younger children can also use the console's or phone's own family settings to require approval before any purchase and to limit who can send messages. Setting these up together means the child knows why a request is waiting for a parent and doesn't go looking for a way around it.

If an account or money has gone: Zavialov's first steps in the UK

If a card has been used, call the bank first, using the number on the back of the card. If card details were typed into a fake page, Report Fraud's advice is to note the website address, close the browser, report it and contact your bank.

If an account has been taken over, contact the game's support through its official website and change the password everywhere it was reused. Keep the other player's username, links and chat screenshots.

Then report the fraud to Report Fraud on 0300 123 2040 or through its online reporting service. Ilia Zavialov adds one warning: anyone who offers to ‘get the account back for a small fee’ is running the next round of the same scam.

When the victim is a child, the first words matter more than any setting. Find out calmly what was sent and to whom, then go through the steps together. A child who wasn't told off this time is far more likely to ask before paying next time.