Billions of e-mail and password pairs from old breaches circulate as "combo lists". Bots try them automatically on thousands of sites. If you ever used the same password twice, the second account is open too.
1How it works
- An old forum, shop or game gets breached. Your e-mail and password end up in a list.
- Bots try that pair on Discord, Instagram, Steam, PayPal and your e-mail provider.
- Variations get tried too:
Summer2023! becomes Summer2024!.
2Warning signs
- "New login" e-mails from places you've never been.
- Password-reset e-mails you didn't ask for.
- Your address shows up in our leak check.
✓Shut it down
- A password manager with a unique, random password for every account. That alone stops this method completely.
- 2FA with an app or passkey, because then a password on its own isn't enough.
- Your e-mail password must be the strongest and most unique one you have, since it can reset every other account.
Info-stealers & token grabbers
Bypasses 2FA
The most dangerous method right now, especially for gamers. A small program copies everything your browser and apps have saved and sends it off within seconds. Because it takes logged-in sessions, 2FA doesn't help.
1How you catch one
- Cheats, mod menus, executors, HWID spoofers, cracked games and "free" software.
- "Can you test my game?" files from Discord friends whose accounts are already hijacked.
- Fake installers from ads in search results, and fake "update your driver" pages.
2What it takes
- Session cookies and tokens (Discord, Steam, Google, Instagram), so attackers are logged in right away.
- Passwords and credit cards saved in the browser.
- Crypto wallets, Telegram sessions, screenshots and files from the desktop.
!Warning signs
- Your Discord account sends links you didn't send.
- Logins on many accounts at the same time, even with 2FA turned on.
- Defender reports something, or someone asked you to turn it off.
✓Shut it down
- Never run .exe, .scr, .bat or .zip files from strangers, and don't run cheats.
- Don't save passwords in the browser. Use a password manager instead.
- If it happened: clean the PC first (full scan, or reinstall Windows if in doubt). Then, from a clean device, change every password and log out all sessions.
Fake log-in pages
Looks real
A page that looks exactly like Discord, Steam, Instagram or your bank. Modern versions pass your input straight to the real site, so they also capture your 2FA code and the logged-in session.
1How it works
- Link in a DM, e-mail or SMS: "vote for my team", "your account will be deleted", "free Nitro".
- Lookalike domains:
discorcl.com, steamcommunlty.com, extra words or odd endings.
- "Sign in with…" pop-ups that are just drawings inside the page (a fake browser window).
2Warning signs
- Urgency, fear or a reward that's too good to be true.
- The password manager doesn't autofill. That's the best alarm signal there is.
- The address bar shows a different domain than the brand on the page.
✓Shut it down
- Passkeys and security keys can't be phished, because they only work on the real domain.
- Never log in through a link. Open the app yourself or type the address.
- If you entered something: change the password right away, log out all sessions and check recovery e-mail and 2FA.
QR codes & "link a device"
One scan is enough
Discord, WhatsApp, Telegram, Steam and others let you log in by scanning a QR code with your phone. If you scan someone else's code, you log them into your account.
1How it works
- "Scan this to verify / get a role / join the giveaway." The code is really a login request from the attacker's device.
- "Send me the code you just got." That's your login or pairing code.
✓Shut it down
- Only scan login QR codes you opened yourself on your own computer.
- Never pass on codes, whether by SMS, e-mail or in an app.
- Check "Linked devices" in WhatsApp, Telegram and Signal and remove anything you don't know.
SIM swap
Takes your number
The attacker convinces your mobile carrier to move your number to their SIM card, using leaked data and a good story. From then on they receive your SMS codes and can reset accounts.
1Warning signs
- Your phone suddenly shows "No service" or "SOS only" even though your area has coverage.
- An e-mail from your carrier about a new SIM or eSIM.
✓Shut it down
- Ask your carrier for a customer password / port-out PIN.
- Move 2FA away from SMS and onto an app or passkey, and remove the number as a recovery option where you can.
- If it happens: call the carrier from another phone immediately and get the number blocked.
Account recovery tricks
The back door
Instead of the front door (the password), attackers use the back door: password reset. Whoever controls your e-mail or answers your security questions gets in.
1How it works
- Security questions like "first pet" or "mother's maiden name" can often be answered from Instagram.
- Your e-mail gets taken over, and then every "forgot password" link lands with them.
- Forwarding rules in your e-mail quietly send copies of everything to the attacker.
✓Shut it down
- Answer security questions with random answers stored in your password manager.
- Check your e-mail's forwarding rules, filters and connected apps.
- Keep recovery e-mail and recovery phone up to date, and remove old ones.
Fake support calls
Remote access
"Microsoft", "your bank" or "Discord Trust & Safety" calls or writes to you. You're told to install a remote access tool so they can "fix" or "check" something. Then they're on your PC.
1Warning signs
- Unexpected contact, time pressure, an alleged virus or an alleged report against you.
- Requests to install AnyDesk, TeamViewer or similar tools, or to give them a code.
- Payment with gift cards or crypto.
✓Shut it down
- Real companies never ask you to install remote access tools when they contacted you.
- Hang up and call back on the official number yourself.
- If they were connected: cut the internet connection, uninstall the tool, scan the PC and change passwords from another device.
Doxers almost never "hack" anything. They piece together data that's already public. Each piece is small, and together they add up to your address. Here's where the pieces come from, so you can remove them.
1Usernames & images
- The same username on Discord, Steam, TikTok and GitHub. Tools check hundreds of sites in seconds.
- The same profile picture: a reverse image search finds every other account that uses it.
- Old accounts from years ago with your real name.
2Permanent IDs
- Discord IDs, SteamID64 and FiveM licenses never change. Lookup services keep their history.
- Game server logs and leaked databases link those IDs to IPs.
3Breaches & registers
- Shop breaches contain real names, addresses and phone numbers.
- Phone books, address registries, the legal imprint (Impressum) on websites and channels, and domain records.
- People-search sites and data brokers.
4Photos & context
- Location data in photos, the view from your window, school uniforms and sports clubs.
- Friends and family with public profiles who tag you.
- Stream background, voice, time zone and when you're online.
✓Break the chain
- Search yourself regularly: name, all usernames, e-mail, phone, profile pictures (reverse image search).
- Use a new username and avatar for each area of your life, and delete or rename old accounts.
- Keep your gaming identity strictly separate from your real-life identity, with a separate e-mail and a separate Discord.
Someone gets intimate pictures, or claims to have them, and demands money or more pictures. It's often organised gangs with fake profiles, and they target teenagers especially. It feels like the end of the world. It isn't, and there is help.
1How it works
- An attractive profile starts flirting quickly and moves the chat to Snapchat, Instagram or Discord.
- After a picture or video call, the threat comes: "Pay or I'll send this to your friends and family." Often with screenshots of your follower list.
- Variant: an e-mail claims your webcam was hacked and quotes an old password from a leak. That's a bluff.
✓What to do right now
- Don't pay. Paying almost never ends it. It shows them you can be pressured.
- Stop contact, but take screenshots (profile, chat, payment details) first.
- Report and block the account. Set your profile and follower list to private.
- Tell an adult or someone you trust, and report it to the police.
2Get images removed
- Take It Down (if you were under 18) and StopNCII (adults) create a fingerprint of the image on your own device. Participating platforms then block it, without anyone having to see the image.
- In Germany, HateAid and the police help; for young people also the "Nummer gegen Kummer" helpline.
Giveaway & trade scams
Too good to be true
Free skins, Nitro, Robux or V-Bucks. Cheap accounts, crypto "doubled". These scams are built around greed and time pressure, and they target gamers especially.
1Typical patterns
- Fake giveaways: "You won! Log in with Steam to claim it." That's a fake login page.
- Fake trade sites and middlemen: "my friend from staff will handle it".
- Account and item sales outside the official marketplace: they take the money, or recover the account afterwards.
✓Protect yourself
- Only trade on official marketplaces (Steam Community Market, in-game trading).
- Log in only by typing the address yourself, never through a link from a giveaway.
- Never "verify" an account on someone else's site, and never share codes.