Fake Fortnite Rewards Lure Epic Login Theft

How the attack worked

Scammers built fake websites that mimic Fortnite promotions, promising free V-Bucks, cash rewards, or tools to calculate the value of a player's item locker. Every version of the site funnels visitors to the same endpoint: a fake Epic Games login page designed to steal usernames and passwords. One version of the lure promises money tied to a fake superhero collaboration, while another plays on curiosity by claiming to estimate what a player's locker is worth. A more advanced variant borrows credibility from a real FTC settlement, presenting a fake claim page that pushes in-game V-Bucks through a fabricated "Epic Games Locker" rather than the real cash payout process, and includes legal references and case numbers that do not match any genuine action.

Why it succeeded

The lures work because they tap into things players already care about: free in-game currency, curiosity about the value of their collection, and awareness of real news events like the FTC settlement. By dressing up a credential harvesting page as a reward, valuation tool, or refund claim, the scam sites lower suspicion long enough for a player to type in their Epic login. Because Fortnite accounts can hold rare skins and saved payment methods, the payoff for attackers is meaningful, and stolen accounts can also be used to scam a victim's friends or attempt credential reuse elsewhere.

What to watch for

• Any third-party site asking for an Epic Games login to claim a reward, calculate locker value, or process a settlement
• Offers that sound too good to be true, such as free V-Bucks or unexpected cash
• Settlement or refund pages with legal references, case numbers, or claim processes that don't match official regulator information
• Login pages that are not hosted on epicgames.com

Building resistance

The most reliable defense is a simple habit: only sign in to an Epic account at epicgames.com, and treat any other site requesting Epic credentials as suspicious. Players and parents should be skeptical of offers combining a reward with a login request, since Epic does not run official locker valuation tools. Settlement or refund claims should always be verified directly on the regulator's own website rather than through links on the claim page itself. If Epic credentials have already been entered on one of these sites, the account should be treated as compromised: change the password immediately and enable two-factor authentication to reduce the risk of takeover. These habits are especially relevant for customer support and fraud teams handling reports from affected players, as well as parents supporting younger gamers.

How do fake Fortnite reward sites steal Epic accounts?

They lure players with promises of free V-Bucks, cash, or a locker value calculation, then redirect them to a fake Epic Games login page that captures their username and password.

What is the fake FTC settlement variant of this scam?

A version of the scam uses real news about the FTC settlement to build a fake claim page, using mismatched legal references and pushing in-game V-Bucks through a fake Epic Games Locker instead of the real cash payout process.

What should I do if I entered my Epic credentials on one of these sites?

Assume the account has been compromised, change the Epic password immediately, and turn on two-factor authentication.

How can I verify if a Fortnite settlement or reward offer is real?

Only sign in to your Epic account at epicgames.com, and verify any settlement or refund claim on the regulator's official site, such as ftc.gov for the Epic settlement.