Player Safety: Phishing

Written By: -Grogu, Hartlam & ChristianM.0498 / Graphics By: Anna.Marie97

---

No lake, river, or body of water is needed for this type of phishing, but there are bait and hooks involved. Phishing is described as a fraudulent email or link from a reputable source that is opened or clicked by a potential victim, resulting in potential malware or ransomware. Successful attacks can compromise passwords, credit card information, banking information, or in even more severe cases – your identity.

Even in Habbo, you are at risk of falling victim to phishing; however, luckily, there are several techniques you can use to spot suspicious emails or links sent to you. Find some examples below and observe the red flags, so you know what to consider when you find something suspicious. Stick around a little bit, and you can also learn how to enable 2FA or MFA to provide an additional layer of protection to your account(s).

Phishing is usually successful when the attacker makes their email seem as real as possible so that the reader doesn’t realize what they are looking at is fake and unsafe. For example, in May 2020, Habbo addressed an account security warning due to an email appearing to be spoofed as Habbo Hotel asking users to send their email addresses and sometimes payment to reset their passwords. People who fell victim had their accounts immediately compromised and their personal information stolen.

As Habbo says it themselves, “If another Habbo asks you for account information like this, they are almost certainly trying to hack you.”. Always view messages from any source with caution and consider things like the sender’s domain (xyz@company.com) and the urgency of the message. Later in this article, we will show some potential red flags to be aware of to protect yourself.

Another common phishing attempt was users receiving a link from a known friend on their friends list, telling them that they won a “Habbo Idol” and to go to a link to claim their prize. Users who fell victim also had their accounts compromised, and the chain continued with the hackers posing as them to their friends, and so on.

Never, ever give any account information out to anyone, ever. – Habbo Staff

2. The email/message does not address you by name.
Scammers tend to collect your email address from databases that have been breached. As such, their phishing attempts will often not address you by name. Remember, companies you receive emails from have your account name or real name as you provided when you signed up to the service. Legitimate emails and messages will ALWAYS be addressed to you personally.

3. Misspellings, poor syntax, poor grammar or odd language.
More often than not, phishing emails or messages will include a plethora of grammatical and spelling errors. Read the message over again and out loud. Does it sound strange when you say it out loud? Scammers will often use poor syntax in their messages; that is, words arranged incorrectly in a sentence, which in turn makes it sound unnatural.

4. It is an urgent matter that requires your immediate attention.
For example, “Your account has been compromised!”, “Update your account details now”, or “Click the link to change your password”. Phishing emails and messages will often give you a situation that needs your immediate attention, and will attempt to feed off of your panic and subsequent ignorance of safety procedures. NEVER click links in emails – if you are being asked to update your account details, open up a new tab and go directly to the website, log in and change them there. Stay calm, remember to check the message properly and do not act irrationally through fear.

It is requesting you perform the action immediately, no time to consider.

5. The message contains a prize that you never entered for/seems too good to be true.
The golden rule when dealing with scam messages and emails is this; if it seems too good to be true, it is. Under no circumstances should you follow links for ‘prizes’ you’ve won, ‘free NFT’ or ‘free HC’, to name a few examples.

Notice the enticing “gift” along with even more if you just simply click a link.

6. Consider context.
Did you just reset your password on your account and have received an email asking you to click a link to confirm the reset? Have you cross-referenced all of our previous tips and they all check out? In this circumstance, you are free to click the link provided in the email. Always consider context; did you just perform an action on your account that would warrant an email asking you to click a link, and the email itself has passed all of your checks? If it does not, do not proceed further.

We highlighted the red flag(s) in this email that was used to try and phish other Habbo players!