Fake CoD Points Giveaway Steals Accounts

How the attack worked

This scam targets Call of Duty Mobile players with the promise of 10,800 free Call of Duty Points, the game's premium currency. Instead of offering a redemption code, the fake promotion page asks victims to log in with their full email address and password. Once credentials are entered, victims are redirected to a second page that asks for their two-factor authentication code. According to the source, this redirect follows a technique known as a real-time credential relay, where the phishing site immediately submits the stolen password to the real Activision login page and then captures the resulting one-time code as the victim types it in.

The end result is that the victim hands over everything needed to access their real account: the password and the one-time code that is supposed to keep attackers out. The source notes that stolen Activision logins may expose linked platforms such as Xbox, PlayStation, and Battle.net, and potentially stored payment methods and purchase history.

Why it succeeded

The pretext works because it targets a strong incentive, free in-game currency, and frames the request as a normal part of claiming a reward. Asking for a full login instead of a redemption code is unusual for legitimate promotions, but it can look plausible to someone excited about a giveaway. The two-step flow also mimics a real sign-in experience closely enough that victims may not question why a promotional page needs their 2FA code at all.

What to watch for

• Any "free rewards" offer that requires a full account login rather than a simple redemption code
• Being redirected to a second page asking for a 2FA or one-time code right after entering a password
• Grammatical errors, such as the page reading "GET FREE POINT" instead of "GET FREE POINTS"
• Awkwardly worded instructions or unnecessary trust signals like a live chat widget that seems added only to look legitimate
• Landing on an unfamiliar website rather than the official app or known domain

How to build resistance

The most effective defense is to reach known sites directly by typing the address into a browser or using the official app, rather than clicking links from posts, ads, or messages. Users should treat any 2FA code request as something that should only happen during a sign-in they personally initiated on an official site. Awareness training for gaming communities, customer support teams, and general employees should reinforce that legitimate promotions rarely require a full password submission, and that checking the address bar before entering credentials is a simple, effective habit.

How does the fake Call of Duty Points scam work?

Victims are told they can claim 10,800 free Call of Duty Points by logging in with their email and password on a fake site, then are asked to enter a two-factor authentication code, which the attackers relay in real time to the real Activision login page.

What can attackers do with a stolen Activision account?

A stolen Activision login may expose linked platforms like Xbox, PlayStation, and Battle.net, along with potentially stored payment methods and purchase history.

Why is entering a 2FA code on this fake page dangerous?

The site uses a real-time credential relay, meaning it forwards the stolen password to the real login page and captures the resulting 2FA prompt, so the victim ends up handing over both the password and the one-time code needed to access their real account.

What are red flags of this type of scam?

Legitimate promotions typically use redemption codes rather than asking for a full account login, and this fake page also had grammatical errors like GET FREE POINT and a live chat widget seemingly added just to appear legitimate.