Account security · Anti-phishing guide

How to Spot Free-Game Scams and Phishing

Free games are a classic phishing lure. Here are the five signs of a fake giveaway, how to verify official domains, and the steps to take if you have already been caught. This site links to official stores only.

Check the domain first Beware chat links Two-factor recommended

Contents

5 signs of a fake giveaway
Official store domains
Spotting a fake login window
What to do if you were caught
FAQ

1. Five signs of a fake giveaway

The URL is not an official store domain — This is the clearest sign. Lookalikes such as steam-give.com or epicgames-free.net are all fake. Check them against the official domain list below.

A login prompt before you even see the game — If a Steam or Epic login window appears before the game itself, it may be an account-theft attempt. Official stores show you the store page first.

Sharing, surveys or app installs as a condition — Schemes like "share with 3 friends to claim" do not exist in official giveaways. Spreading the link is the whole point of the scam.

An executable download that bypasses the store — If you are asked to download a .exe or .apk directly with no store listing, malware is likely. Install through the official client on PC and the official app store on mobile.

Unnatural time pressure — A countdown like "claim within 10 minutes or it disappears" is designed to short-circuit your judgment. Real giveaways normally run for at least a day.

2. Official store domains

Checking the address bar against the list below filters out most scams. Look at the end of the domain (either side of the final dot) — disguises that put the official domain in front, like steampowered.com.xxx.ru, are common.

Steam store.steampowered.com · steamcommunity.com
Epic Games store.epicgames.com · epicgames.com
GOG gog.com
Google Play play.google.com
App Store apps.apple.com
HoYoverse genshin.hoyoverse.com · hsr.hoyoverse.com · zenless.hoyoverse.com
Other itch.io · gamerpower.com · primegaming (luna.amazon.com)

Every claim link on this site points only to the official domains above. Do not click a suspicious link; find the same game from the home page and go through the official route instead.

3. Spotting a fake login window

The Steam login window a scam site shows is often not a real popup but a picture drawn inside the page. To check whether it is a real browser window, try dragging it outside the browser — a fake window drawn in the page cannot leave. A real window also shows the exact official domain and a padlock in its own address bar. One second spent checking the address before you log in protects the account.

4. What to do if you were caught

Change the password immediately — Start with the affected platform, then change every other site that shares that password.

Turn on two-factor authentication — Enable Steam Guard (mobile authenticator), Epic 2FA and similar. After that the same trick cannot even complete a login.

Sign out every logged-in device — In your Steam or Epic account settings, log out all sessions on other devices.

Scan for malware if you downloaded a file — If you downloaded and ran an executable, run a full scan, and change banking and other critical passwords from a different device to be safe.

Dispute any charges with your card issuer and the store — If an unauthorised charge appears, file a dispute with the card issuer and report it to platform support at the same time.

5. Frequently asked questions

Giveaways on Steam, Epic and GOG can be claimed without any payment method. Some platforms do legitimately require a card for things like mobile subscription trials, so judge by which domain is asking. If it is not an official domain, leaving immediately is the right call.

That is a classic phishing route, sent automatically from a friend whose account was compromised. Do not click until you have confirmed with the sender through another channel.

Only official store and official redemption URLs are stored at collection time, and every claim button links straight to the matching official domain. No suspicious shorteners or intermediate landing pages are used.