Phishing, Spoofing and Other Account Security Terms to Know

Support pages and breach reports throw around words like smishing, spoofing and credential stuffing like everyone already knows them. Here is what each one actually means and how the attack works.

Short version

• Phishing is the umbrella term for scams where someone impersonates a trusted person or company to steal your passwords or payment details, and it arrives by email, text, call and direct message.
• Smishing is phishing by text message and vishing is phishing by phone call; both follow the same pattern of impersonation, urgency and a request for credentials or codes.
• Legitimate companies will not email or text you a link to update payment information, and they will not ask for your password, so any message that does is a scam.
• Two-factor authentication protects you even when a password leaks, because a stolen password alone is not enough to log in.
• If you think you see a scam, the FTC asks you to report it, and reports help investigators build cases against the people running the scams.

Every breach report and game support page comes with its own dialect. Phishing, spoofing, credential stuffing, smishing, vishing: the words pile up, and support agents use them as if everyone already knows them. You do not need a security dictionary. You need to know what each attack looks like when it lands in your inbox, your texts or a friend request, so this glossary groups the terms players run into most often by how the attacks work.

Phishing and Its Texting and Calling Cousins

Phishing is a scam where someone pretends to be a person or company you already trust, hoping you will click a link, open a file, or hand over details like passwords or card numbers. The FTC says scammers launch thousands of these attacks every day, and that many of them succeed. It is the most common form of social engineering, defined below.

Smishing is phishing delivered by text message or messaging app. The FTC warns that fake texts often claim there is suspicious activity on your account or dangle a prize, then ask for personal details or push you toward a link. Some links lead to a spoofed website, covered below, and others install malware on your phone without you noticing anything happened.

Vishing is phishing by phone call. A caller uses live social pressure, often posing as a bank or a support agent, to extract passwords, one-time codes or payments on the spot. AI voice cloning has made these calls harder to spot by ear alone.

Spear phishing is phishing aimed at one specific person rather than sent out in bulk. Instead of a generic greeting, the message references your actual game handle, your clan, a trade you had open or a purchase you made, which makes it feel legitimate. AI tools can write polished, personalized text, so a message that reads like it was written for you is not proof of anything either.

Spoofing and Impersonation

Spoofing is faking the source of a message or website so it looks like it came from someone you trust. A spoofed store or login page can look exactly like the real thing, logo included, and logging in hands the scammer your username and password.

Impersonation is the broader act of pretending to be a person, company or agency you trust. It covers fake support agents in Discord, scammers claiming to work for the FTC, and accounts that copy a friend’s profile picture and name to ask for a favor or a code. The FTC is blunt about one example: the agency will never threaten you or tell you to transfer money to “protect it,” so anyone who does is a scammer.

Fake padlock icon is a classic piece of spoofed-site decoration. The padlock in a browser bar is meant to show an encrypted connection, but banking regulators warn that phishers can fake the icon itself, so a padlock is not proof a site is honest.

Credential Stuffing and Password Reuse

Credential stuffing is an automated attack where someone takes email and password combinations from a leaked database and tries them across other sites, betting that you reused the password. A breach at one service can put your game accounts at risk if the same password guards both.

Password reuse is the habit that makes credential stuffing possible. If the password on a free forum is the same one on your console account, a leak at the small site becomes a key to the big one. Using a different password for every account, generated and stored for you by a password manager, is the standard fix.

Data breach is an incident where a company’s stored information gets exposed, whether through a hack or a mistake. If your email shows up in one, the immediate concern is not the breached site itself but everywhere you repeated that password.

Keyloggers and Account-Stealing Malware

Malware is any software designed to harm you or your devices, including programs that quietly steal personal or financial information. The FTC warns that some links in scam texts install malware on your phone without you realizing it.

Keylogger is malware that records the keys you press, which means it captures passwords as you type them. If a “game client” or “cheat tool” from an unofficial source wants deep system access, a keylogger is one thing it might be hiding.

Malicious attachment is a file that installs malware when opened. The FTC’s advice is simple: never download attachments you were not expecting, even from someone you know, since their account may be compromised.

Two-Factor, Backup Codes and Recovery Phrases

Multi-factor authentication, often shortened to MFA or called two-factor authentication, means logging in with two or more credentials instead of just a password. The FTC recommends it across your accounts: a passcode from an app, a one-time code, or a security key in addition to the password. It matters most on the accounts that store a payment method, which covers anything with in-game spending attached.

One-time passcode is a code valid for a single login, sent by text, email or an authenticator app. Attackers want these as much as passwords, which is why vishing callers pose as support agents and ask you to “read back the code we just sent.” A real support agent will never ask for one.

Backup codes are one-time codes an account service gives you to print or store, meant for getting in when your usual second factor is unavailable. They are as sensitive as passwords, so they belong somewhere safe and offline, not in a screenshot folder.

Recovery phrase is a list of words that restores access to certain kinds of accounts or wallets. No legitimate game company, store or support agent will ever ask you for it; anyone who does is attempting theft.

Out-of-band verification means confirming a request through a different channel than the one it arrived on. If a message claims to be from a store’s support team, do not reply; contact the company through its official website or a phone number you found yourself. The FTC stresses this repeatedly, and it defeats most impersonation attempts on its own.

Social Engineering: The Catch-All Term

Social engineering is the umbrella over all of the above: attacks that rely on deception rather than breaking through technical defenses. Phishing is its most common form. The attack targets your willingness to help, your fear of losing access or your excitement about a prize, not your software.

Urgency is the tell that shows up in nearly every social engineering attack. “Your account will be locked.” “Immediate attention required.” The FTC notes that scammers push you to hurry because they do not want you to have time to think or verify the story. Legitimate companies do not operate this way. The flip side works too: unexpected offers of free skins, prizes or exclusive deals deserve the same suspicion, and the FTC advises deleting and reporting messages that seem too generous.

None of these terms exist to scare you off playing online. They exist because the same handful of tricks keeps working, and knowing their names makes the tricks easier to see coming. If one gets past you anyway, our guide to recovering a hacked game account walks through the first steps, and our public Wi-Fi guide covers the network-side risks these attacks love. If you spot a scam, report it to the FTC, since reports help investigators build cases against the people running it.

You may also want to read If Your Game Account Gets Hacked, Do This First and Gaming on Public Wi-Fi: What’s Safe and What to Skip.

Quick questions

What is the difference between phishing, smishing and vishing?
Phishing is the general term for scams that impersonate a trusted source to steal information. Smishing is the same scam delivered by text message, and vishing is delivered by phone call. The playbook is the same: impersonate someone, create urgency, then harvest your information.

How can I tell if a message from a game store is real?
Be suspicious of any unexpected message that creates urgency or asks you to log in through a link. Instead of using the contact details in the message, reach the company through its official website or a phone number you looked up yourself.

Does two-factor authentication actually stop account takeovers?
It helps a lot, because a stolen password is no longer enough on its own to get into your account. Attackers know this, which is why some scams try to trick you into handing over the one-time code itself, so never share a code with anyone.

I clicked a phishing link and entered my password. What now?
Change that password immediately, then change it anywhere you reused it. The FTC also recommends turning on multi-factor authentication and checking your account for changes you did not make.