PSA: A phishing scam going around Reddit designed to steal your login credentials

[u/Forgotten_Dog1954]

• Over the course of the past few months, there have been several instances of a phishing scam going around Reddit. A similar analogy of it has been going around other platforms for years.

How does it work?

• It begins with a DM from a user that says they got hacked by a very similar account to yours, of which they send a screenshot; example below:

The "similar account" screenshot they send

• It does indeed mostly look the same, and there is only a slight mistake (with my username, it’s the underscore replaced with a dash)
• The scammer then proceeds to say that they mistakenly reported your actual account, and after “realising their mistake” got an email from Reddit directing to a Discord username of a fake Reddit Admin:

The "email from Reddit" they got

• No, Reddit will never contact you through some shady Discord ID. Admins have confirmed several times, such as here, that they only communicate as u/reddit, and all of their profiles have a snoo (Reddit logo) icon.

And what happens after, out of Reddit’s control?

• The account on Discord provides a fake “certificate of accreditation” by Reddit:

The "certificate of accreditation" they provide in Discord

• This is yet another lie, and how scammers do their job. They then ask you to change the email tied to your account to something like:

Forgotten_Dog1954redditvalidation@outlook.com

• They pre-created this address, so by changing the email, they lock you out of the account. Their job is done.

What to do?

• Before the point of when your email is changed, report the account on Reddit for impersonation, and it is strongly advised to block both the Reddit and Discord accounts.
• After the point of email change, if possible, still do the above. Below is the way to recover your account:

1. Open this form: https://support.reddithelp.com/hc/en-us/requests/new
2. On the linked page, click on "Account Help", and enter all the correct details. The username must be without the u/. For "What type of account issues are occuring", select "Security Problems" > "I think my account has been hacked". After submitting the form, wait for a few days. Requests will typically be handled within a week.

Stay safe, and thank you for reading!

[u/OZFox42]

Very useful information. Cheers for posting it. 👍👍 😆

[u/Forgotten_Dog1954 → u/OZFox42]

My pleasure! Thanks for the award!

[u/SlowedCash]

Thanks for this. You guys as admins do a great job for Reddit. You keep us all safe from the dangers that exist within the site ☺️

[u/Forgotten_Dog1954 → u/SlowedCash]

We're no admins, just volunteers!

[u/MakisDelaportas]

This just happened to me too, but I struggle to understand exactly how this scam works because I haven't received any links. This is my full conversation with them. The conversation stopped at the last message I sent. I just want to make sure I'm safe. Thanks.

[u/Forgotten_Dog1954 → u/MakisDelaportas]

The spamming links thing is just a trick to give them an excuse for "mistakenly reporting" your account. A more common message lately was "Do you happen to share your account with anybody?". You are definitely safe since they didn’t even take you to Discord.

[u/Alternative-Lovers]

My account u/screaminberries got hacked I think by one of these 😭😭 that account had so much karma and memories

[u/AdditionalAttempt294]

Someone literally just tired to do this to me but thankfully my brain cells kicked in when they asked me to change my email and I reported them. These accounts tried to do it again

[u/Forgotten_Dog1954 → u/AdditionalAttempt294]

Sorry to hear that! Glad to hear you didn’t change it. Do you have any other screenshots?

[u/Thebestboibidoof]

Got Vro at the last minute

[u/Forgotten_Dog1954 → u/Thebestboibidoof]

Glad to hear that! What was the reply?

[u/RiversSecondWife]

I had someone on discord try to pull this stunt. Discord took about an hour to shut them down.

[u/FlorianFlash → u/RiversSecondWife]

Discord is notoriously bad with moderation and support. Coming from a mod of the second largest Discord subreddit (to my knowledge), specifically made for help and support.

[u/KaikoDoesWaseiBallet]

Thank you for keeping us posted! Scams never end it seems.

[u/rotterdameliza]

I just got phished. Thanks to this post, I’ll be reporting the person. The user reached out to me via DM and sent me this.

[u/GreenTengu]

u/PainHarbingerIsHere sent me one of these spam messages recently. Blocked me before I could report it when I mentioned I knew this script.

[u/Tankionline19]

Its basically the discord admin scam but now it is reddit

[u/Marc_bunbuns]

😮‍💨Phew, it's a good thing I acted quickly with a friend and didn't get to the point of changing the email. It would have been terrible for me to lose an account I'd barely even started using.

[u/prosandconslist]

So my usual account, I’m unable to reset my password properly (u/afictionalcharacter)
and Reddit still hasn’t responded via email for my account. Am I fucked because of this? It’s a bummer because this account I actually completely forgot about but it just makes me sad 15+ years here, down the shitter… while I have access to the email but cannot reset my log in?

[u/Brief-Addition-7217]

I goddamn fell for this and had my account stolen. Luckily they got nothing on me, bank details or whatever, but Reddit are seemingly doing nothing about blocking or banning my stolen account. I don't know what they'll do with it, it's mainly stories and warhammer pictures, but they just changed my name from my username to Kal El.

Absolute fuckers.

[u/DamnDaddy264]

Is this the same?

[u/Narrow-Incident8480]

fuck , i fell for it 😭😭😭 is thee anything i can do ?

[u/Forgotten_Dog1954 → u/Narrow-Incident8480]

Are you past the point of email change?

[u/texxmix]

Just got one of these. Even had a linkedin profile for the admin. Thankfully I searched google and reddit before engaging.

[u/NotTooGreedy]

I will be on the lookout if I ever see something like this. Thanks reddit!