Fake “Verify Your Account” Links: The Phishing Scam Targeting Gaming Creators

Why creators are the target

If you make UGC, run a server, sell maps, or take commissions, your accounts are worth real money, payouts, an audience, in-game items, and a reputation people trust. That makes you a prime phishing target. Scammers know creators care about looking legitimate, so they bait you with the one thing you actually want: verification.

How the scam works

It usually starts with a direct message (on Discord, X, Instagram, or in-game chat) from an account dressed up to look official. The hook varies, but the script is the same:

• “Your creator account needs to be re-verified to keep your badge. Verify here within 24 hours.”
• “You’ve been selected for the VerifyUGC creator program. Complete verification to claim your spot.”
• “Someone reported your account. Verify now to avoid being blacklisted.”

The link points to a page that looks like VerifyUGC (or the platform’s own login) but lives on a domain the scammer controls. The moment you type your password, or click “Login with Discord/Roblox/Epic” and approve it, they capture your credentials or session token. Then the account, its items, and its payouts are gone.

What a fake verification link looks like

Fakes lean on three tricks to look real:

• Look-alike domains. verify-ugc.com, verifyugc.app, verifyugc-login.net, verifyugc.dev.account-check.com, all designed to read as “VerifyUGC” at a glance.
• Urgency and fear. A countdown, a threat of losing your badge, or a “you’ve been reported” warning to make you act before you think.
• A password or login prompt on the wrong site. Any page that asks for your platform password somewhere other than the platform itself is the scam.

How to spot the fakes

• VerifyUGC only ever uses verifyugc.dev. Our pages live on verifyugc.dev and its vertical subdomains: roblox.verifyugc.dev, uefn.verifyugc.dev, and minecraft.verifyugc.dev. Any other domain is not us, no matter how the link is labelled.
• We never DM you a login link out of the blue. Real verification is something you start by going to verifyugc.dev yourself. We’ll never message you first asking you to “re-verify.”
• We never ask for your platform password. Account linking happens through the real provider’s official OAuth login, never a form on our site or anyone else’s.
• Read the full domain, right to left. The real site is whatever comes immediately before .dev. In verifyugc.dev.account-check.com, the real domain is account-check.com, a fake.
• When in doubt, don’t click. Check. Paste any suspicious link into our Scam Link Checker first. It flags known phishing and fake-verification domains before you ever open them.

If you already clicked

Move quickly, the damage window is small:

• Change your password on the real platform immediately.
• Enable two-step verification if it isn’t already on.
• Sign out of all active sessions and revoke any connected or authorised apps.
• Warn your community so nobody else clicks the same link.
• Report the scammer so the account is flagged across every community at once.

How VerifyUGC defends you against this

VerifyUGC exists to make “is this real?” a question you can answer in seconds. We only ever verify through official OAuth on our own domain, we never ask for your password, and we never cold-DM creators. On top of that, our Scam Link Checker lets anyone test a link against known phishing domains, and our shared blacklist means a scammer caught impersonating us in one community gets flagged for all of them.