How the Scam Actually Works: From Gift Card to Lockout

Let’s break down the playbook, because understanding the “how” is your best defense. This isn’t a simple phishing email; it’s a multi-stage social engineering attack that preys on your desire for a good deal and your trust in common payment methods.

First, you’ll see the offer. It’s never on an official app store. It’s in a Discord server, a Telegram channel, a comment on a YouTube video, or a post in a Facebook gaming group. The seller seems legit, often with fake reviews or testimonials. They claim they have access to cheap regional gift cards—say, Turkish App Store or Brazilian App Store cards—because of “regional pricing” or “bulk discounts.” They’ll ask you what game you play and how much currency you want. This feels normal, like any other transaction. I’ve seen screenshots where the conversation starts friendly, with the scammer asking about your main character or your rank, building a false sense of camaraderie.

Here’s where the critical twist happens. They won’t just sell you the gift card code. They’ll say something like, “For me to apply the gift card to your account and get you the currency, I need to log into your Apple ID on an iPhone in my country to make the purchase.” They might give a technical-sounding reason: “The App Store region must match the gift card’s country.” This is the moment. You should never, ever give anyone your Apple ID credentials, especially not your two-factor authentication (2FA) codes. But they’re persuasive. They’ll say it’s the “only way,” or they’ll show you (fake) successful transaction screenshots from other “clients.” If you hesitate, they might offer a “test” with a smaller amount first. My friend almost fell for this—the scammer offered to top up $5 worth for free to “prove legitimacy.” Thankfully, he got a bad feeling and stopped.

If you provide your login, the takeover begins immediately. They log into your Apple ID, often on a stolen or burner device. Now, they have access. The first thing they often do is change the trusted phone number and email associated with your account, locking you out of the recovery process. Then, they go on a spending spree. But they’re not using the mythical cheap gift cards. They’re using your saved payment methods—your credit card, your PayPal—to buy genuine, expensive App Store gift cards. They then instantly redeem these gift cards into their own accounts or sell the codes on the gray market. You’re left with massive charges on your card and an Apple ID you can’t access. The table below outlines the typical scam progression:

Protecting Yourself: It’s About Habits, Not Just Passwords

So, how do you armor up against this? It’s less about having a super-complex password (though that helps) and more about building the right habits. Let’s talk about what you can do proactively. First, the golden rule: Never share your Apple ID password or verification codes with anyone. Apple will never ask for them. No legitimate seller will ever need them. If someone asks, it’s a scam—full stop. Treat that information with the same secrecy you treat your bank PIN.

Second, let’s talk about payment methods. I’ve adjusted my own settings based on this. Go into your Apple ID settings, tap Payment & Shipping. Consider removing stored credit cards and using a more controlled method. What I do, and what many security forums recommend, is to only add funds using a physical, store-bought App Store & iTunes gift card that you purchase yourself from a reputable retailer. You redeem it directly into your account, and that becomes your balance. This creates a hard spending limit. Even if a scammer somehow got in (which is much harder if you follow the first rule), they could only spend the balance you’ve pre-loaded, not run up your credit card. It’s a simple buffer that adds a huge layer of financial protection.

Third, fortify your account with Two-Factor Authentication (2FA). This is non-negotiable. But 2FA is only as strong as your recovery methods. Go to your Apple ID account page online and check your Trusted Phone Numbers and Trusted Devices. Make sure they are only devices and numbers you own and control. If you see something you don’t recognize, remove it immediately. This is the checkpoint that prevents a scammer from changing your password and locking you out. Think of your trusted phone number as the spare key to your house; you wouldn’t give it to a stranger.

Finally, cultivate a healthy dose of skepticism towards online deals. The old saying holds true: if it seems too good to be true, it almost certainly is. Official game currency prices are set by companies like miHoYo or Moonton; they don’t have secret 70%-off channels on Telegram. When you see these offers, report them to the platform moderators. By reporting, you’re not just protecting yourself; you’re helping protect the wider community of gamers who might be more vulnerable. What habits have you found most useful for keeping your online accounts secure? Have you ever encountered one of these offers and wondered if it was real?

What exactly is an “overseas game top-up scam” and how does it start?

It’s a scam where someone offers you cheap in-game currency for popular games like Genshin Impact or Mobile Legends, claiming they can get a discount by using gift cards from another country. It never starts on the official App Store or Google Play. You’ll first see the offer in unofficial places like a Discord server, a Telegram group, or a comment on a gaming YouTube video. The seller sounds friendly and knowledgeable, often talking about “regional pricing” or “bulk gift cards” to make the deal seem legit.

They’ll ask what game you play and how much currency you want, making it feel like a normal transaction. The hook is always the price—it’s usually 50-70% off the normal rate, which is a huge red flag because game companies don’t sell their currency at such steep, secret discounts through random individuals online.

Why do the scammers ask for my Apple ID and password? Can’t they just send me a gift card code?

They ask for your Apple ID credentials because their goal isn’t to sell you a cheap gift card; it’s to steal and take over your entire Apple account. If they just sent you a code, they’d only make a small, risky profit. By getting your login, they unlock everything tied to your Apple ID.

They’ll give you a technical-sounding reason, like needing to log in on a device in the “correct country” to redeem the overseas gift card for you. This is a complete lie. Once they have your login and the two-factor authentication (2FA) code you provide, they immediately change your account’s trusted phone number and email. This locks you out and gives them full control to use your saved payment methods to buy real, expensive gift cards for themselves.

I only have a small amount of money in my Apple account balance. Am I still at risk?

Yes, absolutely. While a limited balance might reduce immediate financial loss, the risk is much bigger. The scammer isn’t just after your current balance. Once they control your Apple ID, they have the key to a lot more. They can see your saved credit cards or PayPal account and use them to make purchases.

Furthermore, your Apple ID is the center of your digital ecosystem for many people—it can include your iCloud photos, notes, backups, and even device location. The hassle and potential privacy violation of recovering a compromised account, which can take days or weeks with Apple Support, is a massive risk on its own, regardless of your account balance.

What’s the safest way to buy game currency or make App Store purchases to avoid this?

The absolute safest method is to only make purchases directly within the game or app using the official payment system, or by using gift cards you buy yourself from authorized retailers. Here’s a concrete habit you can build: go to a physical store like a supermarket or electronics shop, or a major online retailer, and buy a physical App Store & iTunes gift card.

Scratch off the code and redeem it directly into your own Apple ID account. This adds funds to your personal balance. Then, use that balance to make your in-game purchases. This way, even in a highly unlikely breach, there’s a hard spending limit (your gift card balance), and your personal credit card or PayPal details are not stored on the account. It adds a crucial buffer between your primary finances and your gaming spending.

If I already gave someone my details, what should I do right now?

Time is critical. You need to act within minutes, not hours. First, immediately try to log into your Apple ID account page on a trusted device or at appleid.apple.com. If you’re still able to get in, go straight to the “Security” section and change your password to a strong, unique one you’ve never used before. Then, review and remove any unfamiliar “Trusted Phone Numbers” or “Trusted Devices.”

If you are already locked out, use Apple’s account recovery process immediately at iforgot.apple.com. You should also contact your bank or credit card company right away to report the fraud and dispute any unauthorized charges you see from the App Store. Be prepared to contact Apple Support as well; the recovery process for a hijacked account can be lengthy, so starting it and securing your financial lines are the two most urgent steps.