Protect Your Important: Do Not Underestimate Steam and Discord Scams and Frauds

The value of gamers' assets is never underestimated by hackers and criminals, even if players themselves don't often think about how important their accounts and information really is. That's why gaming platforms such as Steam or messaging services such as Discord are used by threat actors to go directly after unsuspecting gamers.

What makes gamers a unique target is a blend of circumstances that are not really found anywhere else. First of all, many gamers are always online in some form or another. Even if they're not engaged in multiplayer games, the gaming platforms they use put them in contact with other people. The same gaming platforms will also have mobile clients, meaning numerous gamers are practically online 24/7.

The second problem is that gaming accounts can be undervalued by users, which also means that users won't put a high price on security or even entertain the idea that they could be targeted in the first place. For example, a third-party Steam calculator places the average value of a Steam account at around $1,900, which is a considerable sum.

What they want

Steam account takeover is one of the most common types of attacks against platform users, and given the average value of a Steam account, it's not difficult to see why. There are multiple ways in which a user can lose access to the account, but two stand out.

In some cases, criminals will contact the potential victim, claiming to be from Steam, informing them of a problem. They might say that someone reported your account or you're about to get banned. The discussion will steer in a single direction, as the user is required to provide credentials and even the code for the multi-factor authentication if it's set up.

Once the attackers are inside the account, they will change the credentials and hold the account for ransom. Depending on the hack's severity or the account's value, they might forgo the ransom and simply try to sell it elsewhere.

Another common method is via phishing links from any platform, including Steam itself, Discord, SMS, social media, email, and so on. The use of multi-factor authentication is not enforced on Steam, which means that not everyone will have it enabled. It's a lot easier to take over a Steam account not protected by M.F.A.

Unfortunately, the trouble for Steam users doesn't stop here. Trade scams are also quite common, especially since the Steam market deals with digital items that are exchanged with other users via real currency. Gamers will receive offers for digital items, either to trade for money. The thing is that Steam doesn't support Wallet credit, PayPal, gift cards, or any form of cash-to-trade offer.

The scammers will try to offer low-quality items in exchange, ask for personal information, offer CD game keys or they might even want to go through an intermediary. In some situations, scammers might even want to trade items that they've purchased with fraudulent credit cards.

Trading on Steam is much more dangerous than it might seem. Users need to pay attention when the traders try to transform the transaction into an emergency and to ensure that they take the time to review everything.

Lastly, one of the more dangerous scams involves Steam Wallet Gift Cards, and it's much more complex than any previous one. Criminals will actually contact people by phone and coerce or trick them into purchasing Steam Wallet Gift Cards to cover payment for taxes, bail, debts, or delivery of money won in sweepstakes. The scammers will often claim to be agents from various agencies, including the I.R.S.

Discord is not far behind

Discord is one of the gamers' favorite platforms as it allows them to congregate on dedicated servers, use it as an instant messaging platform that includes audio calls, and even lets them share files. Unfortunately, scammers and hackers can also use the same features that make it a great platform. Not to mention that some users will link Steam and Discord, opening them to fraud.

Just like with Steam, Discord users might get contacted by people claiming to be from Discord, with the sole purpose of providing them with credentials or other relevant personal information.

Some scammers will contact users out of the blue or even impersonate your friends in an attempt to convince you to download a dangerous file. For example, they might claim to be from an indie developer studio and just need help with testing a game.

Account takeover is a reality on Discord as well. Hackers will try to lure victims into offering them session tokens from the Developer Console, which will then be used to steal the account. It goes without saying users should never provide session tokens to anyone.

Discord users will also need to be wary of any messages claiming that you're the beneficiary of free Nitro access. Typically, Nitro is a Discord feature that accesses special perks but costs money. To redeem Nitro credit, users must scan a QR code, which will likely link back to a dangerous link or file.

Finally, Discord is used as a home for files deployed in all types of attacks, like cryptojacking or scams exploiting the war in Ukraine. Our security solutions on Windows, Linux or macOS will intercept malicious links coming from Discord. There's even a unique technology named Scam Alert from Bitdefender Mobile Security on Android that will block malicious links popping out on mobile devices.

In fact, the distribution of the types of links detected by our telemetry in the two months coming from Discord is really interesting and it goes to show why running a security solution is mandatory, not just recommended.

Conclusion and advice

Gaming is a lot more dangerous space than it might seem at first glance. The variety of scams, frauds and types of attacks proves that the gaming space is attractive to criminals and that their attacks work. It's not difficult to stay safe, but it requires users to follow a few simple advice.

• Always enable multi-factor authentication whenever possible.
• Never provide your credentials or sessions token to other users, not matter who they claim to be
• Be wary of any message that carries any kind of urgency.
• Be wary of unknown users that send your links or files. If any of your friends send you links, files or other unprompted items, you can always contact them in different ways to confirm it's them.
• Take time to review Steam trades and other transactions.
• Use security solutions on all your devices, including mobile. Many of these scams will be stopped immediately by the security solution.