Swindle royale: Fortnite scammers get busy

The online battle royale shooter attracts not only virtuoso gamers, but also crooks of every stripe. How can you avoid becoming a victim?

The online battle royale shooter attracts not only virtuoso gamers, but also crooks of every stripe. How can you avoid becoming a victim?

Fortnite is still one of the most played games in the world, with more than 350 million fans as of May 2020. Such a gathering cannot fail to attract parasites, however, so gamers need to beware.

If you encounter one of these typical scamming tricks, run away!


Fortnite is free to play, but players can spend real money on V-Bucks, its virtual currency, which users trade for skins and stickers. Most Fortnite scams are built around V-Bucks.

Players looking to save some money are easy marks for cybercriminals offering virtual currency either free or at least from sites other than the official store. The tactics differ from scheme to scheme, but the outcome is the same.

V-Bucks generators

One of the most common scams involves V-Buck generators, which promise to pay users in-game currency in exchange for spending some time clicking on ads. To entice users, some websites offering V-Bucks for clicks copy Fortnite‘s style — right down to the fonts — and display “Secure” and “Epic Games Approved” stamps. Not all is as it seems, of course.

In general, the cash-per-click model, although workable, does not lead to tangible rewards and is associated with some risk. For example, instead of getting paid, participants might be slipped malware that appears to be a partner app supposedly needed to register the clicks. The same goes for V-Bucks-for-clicks schemes. What’s more, among the fake pages are some that request the user’s Epic Games account credentials.

As a result, those looking to earn V-Bucks will at best waste time watching endless ads, and at worst supply their data to cybercriminals (which is likely to lead to account hacking).

You don’t have to test V-Buck generators for authenticity; enthusiasts are already there. A YouTuber named spllitz, for example, researched some of the most popular V-Bucks freebie sites and put together a guided tour. Spoiler: They’re all fake.

The first generator directed the vlogger to a survey. The second, with an alluring “Pro” in the name, displayed banner ads offering items for instant sale. The third served up more surveys, like the first. Ultimately, spllitz got no V-Bucks. Run away.

Fake V-Bucks stores

Likewise, the Web is full of sites claiming to sell V-Bucks. At first glance, such pages might look legitimate; like generators, they often resemble the Epic Games portal, and their URLs frequently contain the word Fortnite.

Some of them even have security certificates, but all that means is that they use an encrypted HTTPS connection, so outside parties cannot intercept user data. It does not, however, protect the data from the website owners, or mean that the owners are bona fide.

If you decide to buy virtual currency on such a resource and enter payment card details, they will fall into the hands of cybercriminals.

The story’s ending is nothing if not predictable: Your money will likely vanish, and the V-Bucks will fail to materialize. The scheme is fairly common. In 2018 alone, for example, ZeroFOX identified more than 4,700 fraudulent domains related to V-Bucks and used to harvest personal information, including payment details.

Fortnite scams on YouTube

In an effort to pass off their scams as legitimate commerce, cybercriminals distribute links to their websites through social media posts and YouTube videos. In them, fake reviewers gush about how they picked up free in-game currency.

Experian credit bureau analyst Matt Tatham found more than 4.6 million (!) YouTube videos with instructions for getting V-Bucks. Having studied a few, he concluded that none can be trusted: Many sent users to websites that wanted login credentials or hosted malicious ads.

Some scammers don’t even bother to mask their intentions. One of the videos was posted under the username VIRUSS999, which clearly hints at the true nature of the service.

Recall in any case Epic Games’ official position on V-Bucks: Buy them only at epicgames.com or fortnite.com.

Fake Fortnite mobile apps

At the time of this posting, the Fortnite app was not available in Google Play or the App Store. Initially, Epic Games distributed the mobile version through official stores, but in August 2018, the company moved the installation package from Google Play to its own website.

The Android version of Fortnite temporarily returned to Google Play in April 2020, but it vanished again in August, this time from the App Store as well. Seeing an opportunity, fraudsters spread spyware and adware meant to trick people looking for the game. So, our guide to downloading and installing Fortnite on mobile devices safely is more relevant than ever.

Above all, carefully check where you download the app from. A search for “download Fortnite” will likely lead to Epic Games’ official website, but there may well be links and ads hovering nearby that have nothing to do with the developer. Clicking them, let alone downloading something from there, is not a good idea.

Remember as well that even installing the mobile app downloaded from the official Epic Games website is potentially risky, because to use it, you have to enable the Install unknown apps setting on your phone — and if you forget to disable it afterwards, your risk of picking up malware later rises.

What to do

To protect yourself against scammers, follow these tips at all times:

  • Be wary of anything — and especially anything “free” — posted on social networks or YouTube.
  • Buy V-Bucks only through Epic Games, the Microsoft Store, the PlayStation Store, or major online retailers such as Amazon.com.
  • Download Fortnite only from the Epic Games Store or directly from the developer’s website.
  • Immediately after installing the game on your phone, toggle Install unknown apps back to off.
  • Protect all of your devices with a reliable security solution that always warns you about fraudulent websites and keeps you safe from malware.