On Sale: GamesAssetsToolsTabletopComics
Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
Tags

How can I distinguish phishing emails from these types of emails?

A topic by interestick created Jul 04, 2023 Views: 318 Replies: 11
Viewing posts 1 to 6

I recently released a game on Early Access and have since received many emails from Steam curators, Twitch streamers, or YouTubers. They let me know their subscriber count and requested game keys. I sent them keys, but over 90% of them never responded and I discovered my game being sold on an unknown site. Obviously, as a solo developer with no marketing skills, their emails are hard to resist. How can I distinguish legitimate emails from phishing ones among these emails?

(+4)

In general, you only want to spend your time with emails where genuine interest is reflected. They may talk about themselves and what they offer, but do they talk about you and what you offer. I'll give a little example of both:

GENERIC EMAIL (Don't waste your time responding):

Hi there, 

I am a Twitch streamer with 10,000 subscribers. Can you send me a Steam key so I can try your game?


GENUINE EMAIL 

Hi interestick,

I saw your game on Steam and I really like the concept of a survival card game. I think your game would be a good fit for my Twitch channel where I play similar games. I have 5,000 subscribers. Can you send me a Steam key so I can try your game? 


The key takeaway here is this: If someone is genuinely interested in something about your game (playing it, promoting it, etc), then they will be usually  be specific about it.

It's very easy in today's world for people and companies to get massive lists of email addresses and just write and send generic form letters to see who takes the bait.  

Just recently, a company asked me if I would be interested in their Instagram marketing service. It sounded good at first, but I noticed a few red flags:

-- They never mentioned my name or my game specifically

-- When I went to the website, they had "Instagram testimonials" -- but when I actually went to Instagram, only 1 of those 7 accounts actually existed.

-- All of the testimonials on their website had strangely similar Instagram naming conventions: Usually a word with a number, like snowflak3 or catl0ver 

Needless to say, I didn't bother responding to them.


And it sounds like you might already be doing this, but I would also recommend setting up a Google alert for the name you use to publish your games and the names of the games themselves. 

Hope these tips help!

(+1)

Thank you so much. I totaly agree with your explanation.
 However, some of the emails, just like the example you provided, mentioned my game, showed interest, asked for my key, and even provided a broadcast schedule. The key was used immediately, but there was no broadcast. :) It seems like this case was for personal use. I am currently not responding to all emails as I am unable to distinguish them.

Moderator (1 edit) (+2)

I follow a simple rule, if they approach me, that’s a red flag.

My suggestion is to give a few keys using the Steam curator service, not to people that approach you first. Spammers will send those e-mails to every new game released on Steam, if half of the developers give them a key, they suddenly earn lots of money.

I’ve gotten such e-mails for every single paid game I’ve released on Steam, very often by the same people. It’s unfortunate that people take advantage of devs like that, but it’s a lesson learnt :)

At least that’s my view and experience, up to you how you deal with it.

if they approach me, that’s a red flag

Especially if there is a free demo they could already have produced content with and failed to do so :-)

They are content makers. In theory. So why not play the demo and have follow up. Even more content.

That’s a good point. I sent keys to several curators, but the usage rate was low, and I couldn’t receive any response from the curators who did use the keys. They might not have found the game satisfying, but it’s frustrating not to hear any feedback. I need the feedback :)

(+1)
I discovered my game being sold on an unknown site

:-o

Would be interesting if and how they managed to actually sell it.

I just do not see the gain in asking for free stuff this way. Especially if they immedatly activate the game, they probably did not resell it. And let's be honest, you game is a few bucks, so how much work would it cost them to resell the steam key.

Unless I see the gain, I am more inclined to believe that they are building up their potential library and might still stream your game or decided against it, for whatever reason.  It is early access after all.  If your game has not gone viral and they have more prominent games yet to showcase, why do it now. If they reach out to you, they are probably struggling as well. A streamer that no one knows streams a game that no one knows.  Somehow I doubt that this generates much followers.

But to topic, it is hard. There are some telltale signs that might indicate that the message is not individual as already pointed out. But even if, how could you verify that the streamer is, who he claims to be? There might be non streamers that just ask for free stuff.

Since you have a demo version, if that is presentable and has more than two minutes of streamable content, just ask your would be promoters to do some content with that. Not only will you know if they are who they claim they are, you would also know, that they are willing to actually stream your game. 

Oh, and of course, if they are indeed a successful influencer, they would either just not ask you and just do it, or ask for permission. Not ask for free stuff.

I agree, if they really planned to stream the game, they would have started with the demo or more likely purchased it themselves.

I think they may have sent emails pretending to be multiple dead Twitch or YouTube accounts. There is a possibility that emails, which seem to have been sent from several different accounts, were actually sent from one phishing site, and if they receive one key for each email, they could secure multiple keys.

(+1)

Yeah, I've been there myself when I released my first game on Steam. I was kinda excited at first when they reached out to me, but I quickly began to see a pattern. Everytime I visited their channel, I noticed that in some cases, they hadn't been online for months. They also usually copycat the original email address of the creator. 

I told them, they could record one of my free games here on itch, then I would convincingly grant them a free key, but they never responded to that.

And FYI, you can actually block Steam keys on Steam. Just be careful you don't accidently block keys from though.

I have had the same experience. There were accounts that had their last streaming 8 years ago. I blocked all the keys that were sent. However, there were accounts that occasionally sent a reply, which made me confused if they were genuine or not. Of course, I didn’t do any streaming.

(+2)

It's a lot safer to go through vetted platforms, like keymailer or Woovit, some of these platforms actually limit their requests until they post coverage of your game, too. Unfortunately there's still a ton of bad actors, even on these sites, so vet them well

I applied for Keymailer membership, but it has been a week and I haven’t received any response. It seems that joining as an indie developer is quite challenging