Beware of Fake Trion Sites!

[D35TR0Y3R17]

Ok, I got an e-mail today and I almost fell for it / almost logged in to their fake site :S.

Here's a screenshot of the e-mail.



Greets DESTROYER17

[Fiach]

I got this today, crikey they dont even try to use english properly, well I hope its fake lol :



Greetings!

Recently, the problem of account invasion is getting worse and worse which cause enormous players equipments and virtual

currency stolen. This severely damages the benefits of mass players, also causes our company lose a lot of customers.

made to your RIFT account.
Your Information has recently been attempt modified through the Account Management website.
*** If you made this Information change, please disregard this notification.
However, if you did NOT make changes to your Information,
Cancel Changes Please log in :

http://www.riftgame.com/



Sincerely,
Trion Worlds

[iCeDrAgOn2025]

I got this today, crikey they dont even try to use english properly, well I hope its fake lol :



Greetings!

Recently, the problem of account invasion is getting worse and worse which cause enormous players equipments and virtual

currency stolen. This severely damages the benefits of mass players, also causes our company lose a lot of customers.

made to your RIFT account.
Your Information has recently been attempt modified through the Account Management website.
*** If you made this Information change, please disregard this notification.
However, if you did NOT make changes to your Information,
Cancel Changes Please log in :

http://www.riftgame.com/



Sincerely,
Trion Worlds

That honestly looks like it's been translated from another language and judging from the way things are worded I would have to say it's Chinese.

As for how they are getting e-mail addresses. A lot of ISP's and other e-mail providers haven't secured their e-mail server by disabling cretin commands which would allow a bot to log on to the server and basically find out if a user exists on that server or not. Some ISP's and mail providers have disabled these commands and have implemented authentication to check for valid e-mail addresses. I know this is something that Hotmail has done. But as others have said if you use your account for more then just Rift, you're leaving your fingerprints all over the internet which people can gain access to

[Rineff]

The payment method we have on file for your $$$$ subscription has been declined. Trion Worlds will try to authorize the following payment again:

- Renewal date: $$$$ [...]

If you continue to experience difficulties, contact the Trion Worlds customer service team at [censored the url]

I got this recently too. It used my name, so even though the "$$$$" was weird, it was better than most phishing mail I see.

Every subdomain of cust help dot com looks like a disaster waiting to happen.

[Matriarche]

Yikes, this happens more often than not -- think before you click!

[Jame]

This email seems to fill all the characteristics of a phishing email, yet all the links seem to be legit. I went through RIFT's homepage and when going to support, the URL is what it is in the email. Also it's from the same source as the newsletters before. No spelling mistakes and it didn't go to my SPAM folder (I marked it as SPAM without thinking about it, since at first glance I was sure it wasn't legit). But if this is a legit email, Trion sure make their official emails a lot like phishing mails. Doesn't Trion use your full name when they send you email?

[Basalt]

This email seems to fill all the characteristics of a phishing email, yet all the links seem to be legit. I went through RIFT's homepage and when going to support, the URL is what it is in the email. Also it's from the same source as the newsletters before. No spelling mistakes and it didn't go to my SPAM folder (I marked it as SPAM without thinking about it, since at first glance I was sure it wasn't legit). But if this is a legit email, Trion sure make their official emails a lot like phishing mails. Doesn't Trion use your full name when they send you email?

I got that exact e-mail yesterday, though I did not let it run the image scripts, it's almost believable until you get to the part where they advise you to copy paste the e-mail link. That just throws a red flag, and checking the forums doesn't bring up any annoucement to confirm the e-mail. Also every other bit of correspondance I have ever received came from Trionworlds.com, not riftgame.com

Even the hyphen jumps out at me as it's not their style. For good measure after deleting the mail, I logged into my account section as I normally do and changed my password.

[Elrar]

Hi all,

Editing my original response -

Some of the emails shared below are not legitimate. DO NOT CLICK ON ANY LINK THAT GOES TO A URL OTHER THAN riftgame.com; trionworlds.com; or trionworlds.custhelp.com (our Customer Support Knowledge Base.)

If there is anything between riftgame, trionworlds, or trionworlds.custhelp and the .com domain DO NOT CLICK THIS LINK. This is likely an attempt to spoof the link. They are using variations of legitimate messaging - the only recent email we have sent out concerning this is the following text. We strongly encourage anyone to contact our Customer Support at trionworlds.custhelp.com if you have any questions or concerns regarding the security of your account.

Thanks all for your constant reports and assistance in spotting these attempts.

Recent Email Sent to a Small Number of Players

Greetings Ascended!

It has come to our attention that your account has logged in from multiple IP addresses and may have been compromised. For your protection, we have suspended your account. Please contact Trion’s customer service department and verify ownership of your account over the phone with our account support team in order to remove the suspension.

You may find our telephone support numbers in the link below or by clicking the Support button at RIFTgame.com.
https://trionworlds.custhelp.com/app...etail/a_id/478

Thank you for your continued support of Trion Worlds and for playing RIFT!

Sincerely,

Trion Worlds Account Services

[Kragorn]

it's almost believable until you get to the part where they advise you to copy paste the e-mail link. That just throws a red flag,

It's not a red flag at all, it's excellent advice, copying the displayed text will defeat any attempt to fake the link with an underlying 'A' tag containing a different URL from the one displayed.

You need to educate yourself about this before spouting rubbish and misleading others.

[Basalt]

It's not a red flag at all, it's excellent advice, copying the displayed text will defeat any attempt to fake the link with an underlying 'A' tag containing a different URL from the one displayed.

You need to educate yourself about this before spouting rubbish and misleading others.

And you need to learn how to communicate like a civil human being.

[Basalt]

This email is legitimate; please contact CS as we have concerns over the security of your account if you have received this.

Thank you!

Sorry, but all other e-mails I've had in the past have been from Trionworlds, so it definitely looked supsicious in conjunction with the other attempts I've received aimed at getting my phishing my account. I'll contact CS then.

[Pixel Monkey]

This email is legitimate; please contact CS as we have concerns over the security of your account if you have received this.

Thank you!

hey its elrar

[Jame]

This email is legitimate; please contact CS as we have concerns over the security of your account if you have received this.

Thank you!

Thank you, I did call last night. The funny part is, that the guy who answered me said the mail is a phishing mail since according to him all such mails from you come with an incident number. XD

Anyhoo, changed my pass so all should be ok.

[brittcarter]

just got this email from aj_dean2010@hotmail.com

Recently you requested personal assistance from our on-line support center. Below is a summary of your request and our response.

We will assume your issue has been resolved and your account will be terminated if we do not hear from you within 48 hours.

Thank you for allowing us to be of service to you.



To access your question from our support site, click here.




Subject



Code of Conduct Violation: Suspicious account activity - britt_carter@hotmail.com







Discussion Thread



Response Via Email (GM Xaxasz)

2011-7-15 10:25 PM



Hello!

Thank you for contacting us regarding RIFT.

I do apologize for the inconvenience but your account has been investigated for the time being due to suspicious activity. Please veriry your account here: Account Management. this is a link to http://www.riftgame.com.issue-techni....com/login.htm

If you have any additional questions or concerns then please don't hesitate to let us know. Thank you for your continued support of Trion Worlds and for playing RIFT. Your reference number for this question is 151293-412098

Sincerely,

GM Eaven
Game Master
Trion Worlds Inc.







Question Reference #110710-002903






Product Level 1:

RIFT



Category Level 1:

In-Game Support



Category Level 2:

Report a Player



Date Created:

2011-7-15 10:25 PM



Last Updated:

2011-7-15 10:25 PM



Status:

Waiting

[Basalt]

Thank you, I did call last night. The funny part is, that the guy who answered me said the mail is a phishing mail since according to him all such mails from you come with an incident number. XD

Anyhoo, changed my pass so all should be ok.

The CSR I spoke with also stated there should be an incident number on the original message, though one wasn't, though we did change my password and secret question. Perhaps inter-company communications has lagged a bit here?