How to Spot Fake Game Giveaways and Protect Your Accounts

Gaming accounts are valuable. A Steam or Epic account can hold hundreds of dollars of games and tradeable items, and console accounts often have a saved payment card. That makes 'free game' and 'free skin' offers the perfect bait for phishing. Knowing the patterns takes the risk out of hunting for real giveaways.

Treat any offer with one of these signs as a scam until proven otherwise:

• It asks you to sign in on a page that is not the official store's own domain
• It asks for your password, a 2FA code, or a recovery code in a chat or form
• It requires you to complete surveys, install an app, or 'verify you are human' through a chain of ad pages before showing a code
• It asks for a small payment to 'unlock' or 'ship' a free digital item
• It arrives as an unexpected direct message from a friend, especially one that sounds unlike them
• It promises currency or items that the game itself never gives away, such as unlimited premium currency
• It asks you to install a browser extension or run a file to claim

The most effective scams copy an official login page pixel for pixel and host it on a domain that differs by one letter, adds a word like 'gift' or 'promo', or uses a different ending. Before you type a password, read the domain in the address bar from right to left. The part right before the final ending is the real site.

A safer habit is to never sign in through a link at all. Open the store app or type the store address yourself, then look for the offer there.

DealDie never asks you to sign in and never collects store credentials. Claim buttons send you to the official offer page published by the giveaway source. If a listing ever leads somewhere that asks for a password on a non-official domain, stop and report it to us through the contact page so we can investigate.

Move fast. The order matters:

• Change the password for the affected account from the official site or app
• Revoke active sessions and any API keys or authorized apps you do not recognize
• Turn on two-factor authentication if it was not on already, and generate new recovery codes
• If you reused that password anywhere else, change it there too
• Contact the platform's official support and report the phishing page

Use a unique password for every gaming account, ideally from a password manager, and turn on two-factor authentication everywhere it is offered. A password manager has a useful side effect: it will not auto-fill your password on a lookalike domain, which is an early warning that something is off.

• In-Game Loot Codes Explained: Keys, Drops, and How to Redeem Them
• How DealDie Finds, Sorts, and Updates Giveaways
• Steam Free-to-Keep vs. Free Weekend vs. Free-to-Play: What's the Difference?