Move over piracy. Code scamming is the season’s hottest trend in video game fraud.
In a recent blog post for Gamasutra, Leszek Lisowski of Wastelands Interactive (Worlds of Magic) talked about his encounters with people posing as prominent YouTubers and requesting Steam codes for media coverage. In turn, Lisowski dove into the underbelly of code scamming to discover how easily unsuspecting game developers could be duped into handing out free codes.
The scam isn’t new, but it has swelled to mammoth proportions with the continuing rise of indie developers and YouTube/Twitch personalities. Many have little or no experience in PR and as they continue to learn the ropes, opportunists have heartily exploited the situation, collecting, trading and even selling game codes.
A few years ago, when self-publishing was a rarity and mailing out boxed copies of games was the norm, the same trick required a bit more audacity. Nowadays, it’s as simple as picking a popular video channel, writing straight to the developer using a plausible email address, and hoping that the recipient is too thrilled to suspect anything unscrupulous. At Evolve, we have to deal with these attempted scams every day; we send out hundreds of game codes every week, and in addition to leveraging our relationships with content creators — i.e. over time, we do get to know the people we work with regularly — we have a number of safeguards in place to ensure our clients aren’t getting scammed.
The good news for developers is that protecting yourself is actually quite easy, so long as you’re willing to put in the work.
How can a Developer Avoid Scams?
Check for an email – The first thing to do when you receive an email from an unfamiliar video creator is to verify authenticity. You can often do this by looking for an email address in that person’s channel profile (the About page on YouTube, or elsewhere on their Twitch profile). If an address is listed and they match exactly, you’re good to go. If not, it’s still possible that you have been contacted by an assistant (e.g. community manager) or via private email address.
Send a message through YouTube – If the email address from the channel profile does not match or none is provided, the next step is usually to send a message directly through YouTube. Read a person’s profile first though, because it may specify another mode of contact, such as Twitter or even another YouTube channel.
Keep your message short and simple. For example: “This is [your name], developer of [game name]. We received a request for a game code from [email address]. Since we haven’t been in contact previously, can you reply directly to this message to let me know if this is a legitimate request from you?”
Finally, it’s a good idea to respond to the original email to let the person know that you sent a direct message. On one hand, assuming everything is legit, this helps ensure that your direct message is less likely to get lost amid fan mail and spam. On the other hand, if the original email is from a scammer, it tells that person that you won’t be an easy target.
Check with an editor – We also have to deal with a fair number of requests from people purporting to write for media outlets — often from places like Russia or Greece or Croatia — and these can also be quite difficult to navigate, but are usually relatively easy to spot. Most media outlets should have their own domain, so the easiest way to verify these requests is to ask the individual to have an editor vouch for them, i.e. send an email from the applicable domain and verify that the request is legitimate.
Distributing codes for reviews and previews properly takes time; pitching, responding to emails, and logging information. Do-it-yourself PR — something you might assume will take an hour per day at most — can quickly become a second full-time job. Unfortunately, this is when it becomes all too easy to start letting verifications slide and just start sending out codes to everyone.
The problem with skipping due diligence is that it enables scammers and encourages them to continue. They enlist their friends, they move on to flood more developers’ inboxes, and use the spoils to trade for other games. This is not just your problem. This is everyone’s problem.
Why Video Creators Should Join the Fight
As a video creator, code scamming has real potential to impact you. If an imposter is left unchecked and continues stealing codes under an assumed identity, it could be your reputation that ends up being unduly tarnished.
Developers, PR reps and community managers don’t live in isolation. Due to the nature of work in the game industry, which is often contractual, employees might be competitors one month and teammates the next. This means that the reputation you cultivate with one company can and probably will spread to others.
Imagine for a moment that an imposter uses your identity to contact an inexperienced community manager and arrange a giveaway, only to disappear with numerous codes. Unfortunately, it’s possible that the community manager will never realize his/her mistake, instead carrying that impression of you into the next project.
Make your email visible – The best way to protect yourself as a video creator is to have your email address prominently displayed in your profile – not buried in the middle of a paragraph. Likewise, you should make it very clear if you ‘only’ use the internal messaging system. This way, it only takes developers and PR agencies a few seconds to verify authenticity.
Get a domain – If having your email address publicly available is not an option, you should consider having a website with an appropriate and recognizable domain name. This is inexpensive and will give you access to a personalized email account. Then, let it be known in your profile that any emails not from that domain are fakes.
Actually use the code – Finally, if you request a game code, do something with it. Even if you decide that a game isn’t right for your audience, or something comes up and you no longer have time, take one minute to send an email. Maintaining good, friendly communication is the best way to build a positive reputation, and that makes an imposter all the easier to spot.
At Evolve, we’re working on tools and resources to help make it easier for developers to avoid scams. Our YouTube database allows us to verify our own contacts before providing them with code, but that’s not a perfect solution for everyone. Like it or not, theft will always exist. But, by communicating and working together to consistently implement best-practices in this ever-changing business, we can minimize the risks and convince many would-be scammers that it simply isn’t worth the effort.