Hello everyone I hope things are going smooth despite the batshit that's happening around the world. I was planning to make a blog about a different topic but seeing that a dangerous scam is roaming freely across Steam, Discord, Bluesky, Xampp, Telegram and other socials and it's affecting users (I've came across five blogs about Discord accounts lost because of this so far), I decided to talk about it hoping more people are aware of this scam. I've already contacted privately my close friends and warned them about it. This is the blog that inspired me to write down this one:
Bluesky Scam affecting Newgrounders!! Accounts have been hacked!
"I accidentally reported you" scam and social engineering
The so-called "I accidentally reported you" scam is a very common scam that uses social engineering and phishing through fear-inducing wording. But what is social engineering? In the context of information security, social engineering is the use of psychological influence of people into performing actions or divulging confidential information. All social engineering techniques are based on exploitable weaknesses in human decision-making known as cognitive biases. One example of social engineering is an individual who walks into a building and posts an official-looking announcement to the company bulletin that says the number for the help desk has changed. So, when employees call for help the individual asks them for their passwords and IDs thereby gaining the ability to access the company's private information. Another example of social engineering would be that the hacker contacts the target on a social networking site and starts a conversation with the target. Gradually the hacker gains the trust of the target and then uses that trust to get access to sensitive information like password or bank account details (1).
Types of social engineering techniques
There at least six types of social engineering techniques: pretexting, water holing, quid pro quo, baiting, tailgating and scareware.
- Pretexting= it is the act of creating and using an invented scenario to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances. This involves some prior research or setup and the use of this information for impersonation (e.g., date of birth, Social Security number, last bill amount) to establish legitimacy in the mind of the target in order to make up an elaborate lie.
- Water holing= this is a strategy that capitalizes on the trust users have in websites they regularly visit. The victim feels safe to do things they would not do in a different situation. A wary person might, for example, purposefully avoid clicking a link in an unsolicited email, but the same person would not hesitate to follow a link on a website they often visit. So, the attacker prepares a trap for the unwary prey at a favored watering hole. The attacker guesses or observes which websites an organization often uses and infects one or more of them with malware. Eventually, some member of the targeted group will become infected. Hacks looking for specific information may only attack users coming from a specific IP address. More info about it here: https://www.techtarget.com/searchsecurity/definition/watering-hole-attack
- Quid pro quo= An attacker offers to provide sensitive information (e.g. login credentials) or pay some amount of money in exchange for a favor. The attacker may pose as an expert offering free IT help, whereby they need login credentials from the user (are you noticing a pattern? Well, we will see it later).
- Baiting= it's the irl Trojan horse that uses physical media and relies on the curiosity or greed of the victim. Attackers leave malware-infected floppy disks, CD-ROMs, or USB flash drives in locations people will find them (bathrooms, elevators, sidewalks, parking lots, etc.), give them legitimate and curiosity-piquing labels, and wait for victims. Unless computer controls block infections, insertion compromises PCs "auto-running" media. Hostile devices can also be used. For instance, a "lucky winner" is sent a free digital audio player compromising any computer it is plugged to. A "road apple" (the colloquial term for horse manure, suggesting the device's undesirable nature) is any removable media with malicious software left in opportunistic or conspicuous places. It may be a CD, DVD, or USB flash drive, among other media. Curious people take it and plug it into a computer, infecting the host and any attached networks. Again, hackers may give them enticing labels, such as "Employee Salaries" or "Confidential" (2).
- Tailgating= here the attacker pretends to be a company employee or other person with access rights in order to enter an office or other restricted area. Deception and social engineering tools are actively used. For example, the intruder pretends to be a courier or loader carrying something in his hands and asks an employee who is walking outside to hold the door, gaining access to the building.
- Scareware= in this type of social engineering the fear and scare are the main tool used to bombard the victim and induce them to do everything the attacker wants. The intent is to cause shock, anxiety, or the perception of a threat in order to manipulate users into buying unwanted software (or other products). Scareware is part of a class of malicious software that includes rogue security software, ransomware and other scam software that tricks users into believing their computer is infected with a virus, then suggests that they download and pay for fake antivirus software to remove it.
So for those who know this scam, did you notice some traits in this type of scam? This scam is a mix of pretexting, water holing, quid pro quo and scareware techniques. After all social engineering attacks are not monoliths but can be a dominant trait with many sub-traits. I want to leave here a link to a beautiful Reddit post about some of the best books about social engineering you can find and that I suggest you to give it a read:
https://www.reddit.com/r/SocialEngineering/comments/kvr07b/the_best_social_engineering_books/
Social engineering can also be used for good, think about Christopher J. Hadnagy, an American social engineer and information technology security consultant founder of Innocent Lives Foundation, an organization that helps tracking and identifying child trafficking by seeking the assistance of information security specialists, using data from open-source intelligence (OSINT) and collaborating with law enforcement. It's a fascinating world actually, but back to our scam.
How it works?
from: https://www.reddit.com/r/Scams/comments/1aywxnj/i_accidentally_reported_you_for_fraud_steam_scam/
Out of the blue, a user tells you they’ve accidentally reported you for something you didn’t do, like making an illegal purchase, and that your Steam/Discord/Bluesky/any other social media account is going to be suspended.
They ask you to message an admin, whose profile they kindly provide, to help you sort out this dilemma. It emerged in late 2018 on Steam and spread across other media. The compromised account receives the same message that you did, and they send over information that led to their account being taken over. That account then sends hundreds of DMs to all of their mutual followers, and you just happened to be on that list. This is why I privately contacted my close friends to make them aware of this because some of them didn't even know this scam was a thing despite being known since 2018. I repeat this scam infects Twitter, Bluesky, even Newgrounds (I've seen a blog of someone who got via NG DMs a similar message, nothing bad thankfully happened as the person was wary enough to avoid the worst) and many other social media, don't fossilise your mind solely on Discord or Steam!
A common trait of this scam and its variants is the screenshot of an alleged support ticket to make it look like more legit and gain the user's trust (social engineering element). The ticket (and trick I would add) instructs you to reach out to somebody on Discord for help to “resolve the report” so that you don’t get banned. There is no word-for-word script that scammers stick to, but the gist is this: someone posing as you scammed them, but they reported you instead of the impostor. Another variant of this scam is the "doing illegal purchases” made by your account—another reason to cause a degree of alarm but flawed, nonetheless. The scammer then insinuates that help is on the way: a “Steam admin” that will cancel the report and remove the target’s account from the ban pile. However, they should confirm that the report against them was a mistake first. The sharing of a legitimate profile—or what appears to be legitimate—that is connected to Steam or its developer, Valve, is one of the tactics scammers employ to make their claims look more truthful.
If you raise the possibility that this Steam admin might not accept your friend request, the scammer suggests that you contact them via Discord. Now that you are convinced you need to do something to save your account, you get in touch with the Steam/Discord/Twitter/any social media admin. Of course, this admin is fake and likely either the scammer or an accomplice. Note that the tone of the conversation changes here. The scammer’s concerned and helpful front is gone once you start chatting with the fake admin (it's more stern and cold). After you briefly explain the situation, the fake admin asks for a screenshot of the chat that transpired between you and the scammer. The proof they ask for is a screenshot of your purchase history. They will also ask you to log out of your Steam account on your computer and/or mobile so they can “start the scanning of your account status”. Of course, there is no scan. The fake admin asks this as a lead in to asking for more information—for starters, the email address tied to your Steam account.
An email address is needed when a Steam user finds themselves locked out of their account and they forgot their account name or password. The fake admin asks you to get the verification code sent by Steam to your email address. If you happen to have Steam Guard enabled, the fake admin will ask for the code as well. SERIOUSLY, NEVER DO THAT!
If you comply with the fake Steam admin you can lose your accounts, your game items, and even money.
Targets who question any of the tasks the fake admin asks them to do are met with the pressure to respond quickly because they’re “running out of time”, they are presented with a fake certificate, or they are threatened with having their accounts deleted. Note the threatening tone aimed at inducing fear and despair:
Here another screenshot of a threatening tone, seriously fuck these bastards!
The scammers behind this scheme also come prepared. Not only do they have the materials—screenshots and a guide script—they need to counter frequent questions raised about their credibility, they are also not afraid to play on Steam users’ fears, even at the risk of losing the credibility they already built up with their target (3).
I copy-paste these important info taken from the website I took most of my knowledge on this scam on Steam. It's a list about Steam main traits for those who use it but might not fully know it:
- There is no such thing as “Steam admin”, false report, or a “Certificate of Eligibility”.
- There are Valve employees with Steam profiles. And they proudly display a legitimate badge to prove this. They are top-tier moderators (mods) who have full administrator privilege in Steam.
- Real Valve employees belong to two invite-only groups, which are Valve and Steam.
- There are Steam Community Moderators. Like Valve employees, current and retired moderators have their own badges, too. Community moderators can ban users, among other things.
- Real Steam Community Moderators, both active and inactive, belong to the invite-only group, STEAM Community Moderators (SUFMods).
- There is a page where you can look up all Steam Community Moderators.
- Scammers link back to legitimate profiles of Valve employees or Steam moderators to hook targets into reaching out to through Discord. These Discord accounts are not manned by Valve employees but by scammers.
- There is no such thing as an illegal item. That said, there is no need for anyone to review an item.
- If an item does need inspection, Valve employees would not require you to hand them over. They will just look it up in their database.
- Duplicate items (or dupes) exist, but they are not illegal. Duplication was done years ago by Steam Support to restore scammed or stolen items for hijacked victims. Steam Support doesn’t do this anymore.
- If you have handed over an item to someone claiming to be a “Steam admin”, consider it gone forever. The current policy is that Steam Support does not restore items that have left an account, including scammed ones.
- If there is a problem with your account, or you have an impending ban, Steam will let you know either via email, a Support ticket, or account alerts. Here is an example [link to account-alert-sample] (taken from Steam on Reddit).
- A Steam moderator will never contact you via chat or a third-party app like Discord for any reason.
- A Steam moderator will never mediate between you and another user.
As for Twitter, its personnel is not permitted to do any support work offsite. Their support people work internally, which means that they have a policy to avoid talking to you unless necessary to you. All Twitter support personnel are prohibited from opening accounts on mass chat platforms such as Discord by company policy.
What to do if you receive this message?
Disclaimer: sorry for the caps locks but I really want people to fully carve this into their eyes and minds.
1) DON'T DO ANYTHING, JUST IGNORE AND REPORT!!!
2) Do not panic, because nothing has happened to you or your account. YOU ARE SAFE!
3) If you are unsure (don't waste your time talking to the scammer!) CONTACT DISCORD/STEAM OFFICIAL PAGES which are:
https://help.steampowered.com/en/
https://support.discord.com/hc/en-us/requests/new
4) BE ALWAYS WARY OF MESSAGES LIKE THIS AND KEEP IN MIND THAT NOW MANY TEXTS CAN BE GENERATED WITH ChatGPT
5) USE LOGIC: how can someone "ACCIDENTALLY" report you????
To report someone, a person shall have a minimum knowledge of the potential reporty-worthy account. Just think about what you do here on Newgrounds when you have enough proof an account is causing trouble: you observe, analyse and only after collecting enough data, you will contact Tom to take action.
6) If there is a problem with your account, or you have a ban headed your way, in the case of Steam, it will let you know either via email, a Support ticket, or account alerts
--------------------------------------------------------------------------------------------------
Some security settings for Discord to be safe:
https://www.newgrounds.com/dump/item/2f8598b006204b51e3618cbf48b92848
https://www.newgrounds.com/dump/item/e7e70460fee5aac93399d7e985f341d2
https://www.newgrounds.com/dump/item/c0daec0f795fa0fa6118e3c2994ac868
With AI-generated content increasing over the years, the risk to create very legitimate e-mails from staff members, G-mails inbox messages featuring the ones that support sends to confirm they received a report, official Discord (but not only them) staff members impersonator, legitimate Chat-GPT-generated messages, deepfake and so on, these types of scams, which rely on the most effective tool to scam people (social engineering and phishing), will become incredibly common and more subtle. So my advice is to always keep updated to these threats and start building a thread model for Internet and online experience in general. To start a decent threat model, use this site:
Discord support scam, it's very interesting how these mofos use false certificates (maybe generated partially with AI and then corrected manually) to circumvent any suspect from the victim. Take a look at the screenshots especially the last ones.
What shall I do if my account gets compromised?
https://help.steampowered.com/en/faqs/view/0a94-f308-34a5-1988
https://steamcommunity.com/discussions/forum/1/1746720717353050137/
I leave here a list of links that talk about the main scams you can encounter on Discord but this applies on every social platform (remember to always be pro-active when it comes to threat model):
https://discord.com/safety/protecting-users-from-scams-on-discord
https://www.scam-detector.com/discord-scams/
https://www.aura.com/learn/discord-scams
https://www.howtogeek.com/879634/discord-scams-and-how-to-protect-yourself/
Totally unrelated scam that happens in the shape of phone text but it's important to know it, because it's a fucking scam:
https://www.malwarebytes.com/blog/news/2025/07/that-seemingly-innocent-text-is-probably-a-scam
So yeah, that's all for now. If I find other stuff to add I will do. Please take care, stay safe and INFORM YOURSELF and GET EDUCATED on the topic of online security ALWAYS and CONSTANTLY because scammers, criminals etc. act in a way very similar to bacteriophage viruses: they evolve rapidly. And we are the bacteria who need to adapt constantly if we don't want to be eaten in this evolutionary race.
References and footnotes:
(1) Hatfield, Joseph M (June 2019). "Virtuous human hacking: The ethics of social engineering in penetration-testing". Computers & Security. 83: 354–366. doi:10.1016/j.cose.2019.02.012. S2CID 86565713
(2) Conklin, Wm. Arthur; White, Greg; Cothren, Chuck; Davis, Roger; Williams, Dwayne (2015). Principles of Computer Security, Fourth Edition (Official Comptia Guide). New York: McGraw-Hill Education. pp. 193–194. ISBN 978-0071835978.
https://web.archive.org/web/20180622204958/http://news.bbc.co.uk/2/hi/technology/8313678.stm
https://www.reddit.com/r/Scams/comments/1aywxnj/i_accidentally_reported_you_for_fraud_steam_scam/
https://toyhou.se/~forums/5867.service-reviews/477785.beware-discord-scam-going-around
https://www.reddit.com/r/Scams/comments/1aq34ac/discord_support_scam/
Yomuchan
I like to act like I'm getting along with the scheme, then start wasting the scammers' time. "Its not loading." or "there's no response" or "I'm getting a white screen when I click your link."
[NEVER CLICK THOSE LINKS]
... I'm probably on some sort of blacklist now since it's been a while since the last message I got lol.
ShangXian
I tend to do this with phone scammers. Literally two days ago I made waste time after three days she contacted me. I kept her on the hope I would fell, but instead I told her to wait and call me the day after just to repeat the same thing with the excuse I was busy during that day. Then I contacted the official number of the electricity company and they confirmed my intuition.
When she called me back I coldly replied "I thought about it and I'M NOT INTERESTED, bye!"
Online if it ever happens I just ignore and report.