A stranger who says “I found your hacked Steam, Roblox, Epic, or Discord account” is not a safe recovery helper. Treat the message as a second-stage scam, stop private chats, secure your email first, recover the account only through the official platform, and scan the Windows PC before logging back into gaming services.
This scam appears after a real account theft. The attacker, or someone working from the same stolen data, contacts the victim on Discord, Telegram, Reddit, Steam communities, or another channel and claims they can return the account. Sometimes they know the new email address, old username, purchase history, or even temporary credentials. That does not make them legitimate. It means they may already control the account, the linked email, or stolen browser/session data.
What the scam looks like
The message usually arrives after you have already lost access to a gaming account or after you asked publicly for help. Common lines include:
- “I found your account and can help recover it.”
- “I know the person who has your account.”
- “Pay a small fee and I will return it.”
- “Log into this mailbox first, then change the email.”
- “Send screenshots, receipts, ID, or a code so I can prove ownership.”
Bitdefender documented a recent version where hijacked gaming accounts were moved to Rambler.ru mailboxes and then used as bait for recovery offers. The important lesson is broader than one mail provider: a “helpful” stranger may be using true stolen details to earn trust, extract money, or take over more accounts.
Why attackers offer to “help”
Recovery scammers do not need to start from zero. They contact someone who is already stressed, already locked out, and often willing to try anything. That gives them several ways to profit:
- Advance-fee fraud: they demand payment for a recovery that never happens or only works temporarily.
- Credential theft: they ask you to log into a mailbox, fake recovery portal, or remote support session.
- Evidence theft: they collect purchase receipts, account IDs, old emails, and identity documents that can be reused in platform support appeals.
- Session persistence: they return partial access but keep linked emails, OAuth apps, recovery codes, or active sessions under their control.
- Malware follow-up: they push “recovery tools” or screen-sharing software that can expose passwords and payment data.
Do this first if your gaming account was stolen
- Stop talking to the recovery offer. Do not pay, do not share codes, and do not move the conversation to Telegram, Discord DMs, WhatsApp, or remote desktop.
- Use a clean device for recovery. If the original PC ran a cracked game, mod menu, “free Robux” tool, cheat, installer, or Discord download, assume it may still contain a stealer.
- Secure the email account first. Change the email password, enable MFA, review forwarding rules, recovery email/phone, blocked addresses, app passwords, and recent sign-ins.
- Recover through the official platform only. Use Steam Support, Roblox Support, Epic Games Help, Discord Support, or the matching official help center for the account you lost.
- Collect evidence before it disappears. Save purchase receipts, original email addresses, account IDs, usernames, dates, platform notifications, and screenshots of unauthorized changes. Do not send them to a stranger.
- Revoke sessions after you regain access. Sign out other devices, remove unknown linked accounts, rotate passwords, replace recovery codes, and enable an authenticator app or passkey where supported.
- Warn friends and groups. If the account sent scam links, marketplace offers, or crypto/gift-card messages, tell contacts not to click recent links from you.
Platform recovery checklist
| Platform | Safe first step | Watch for |
|---|---|---|
| Steam | Secure the PC and email, then use Steam’s stolen-account recovery flow. | Fake “Steam admin” messages on Discord, trade-redirection scams, and third-party recovery helpers. |
| Roblox | Use password recovery if email/phone is still attached, or contact Roblox Support with ownership details. | Free Robux tools, fake generators, malicious extensions, and people asking for receipts or security codes. |
| Epic Games / Fortnite | Reset the email and Epic password, try linked console/social accounts, then follow Epic account recovery. | Linked account removal, changed email, blocked Epic emails, and resale/account-trading scams. |
| Discord | Check the “email changed” notification, reset password, remove unknown authorized apps, and submit a compromised-account ticket. | Fake staff, “I reported you by mistake” flows, Nitro/giveaway links, and recovery messages sent by hijacked friends. |
When to scan the PC
Scan the Windows device before logging back into any recovered account if the theft followed a download, game crack, cheat, mod, fake launcher, Discord attachment, “account checker,” browser extension, or archive from an unknown source. Password changes made on an infected computer can be stolen again.
Gridinsoft Anti-Malware is useful here because it focuses on the local cause: stealers, loaders, suspicious startup entries, browser changes, and unwanted apps that may have captured the original session. Remove detections, reboot, scan again, and only then reset passwords from a clean browser session.
After uninstalling the suspicious app or deleting the visible threat, use Gridinsoft Anti-Malware to check hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and other persistence points that can restore malware.
Download Anti-MalwareWhat not to send to a recovery scammer
Never send a private recovery helper your:
- one-time codes, backup codes, Steam Guard or authenticator approvals;
- purchase receipts, full card details, billing address, or identity documents;
- browser cookies, exported passwords, QR codes, or session tokens;
- remote access to your PC or phone;
- password reset links or screenshots that show full URLs.
Official support may ask for ownership evidence through their own ticket system. That is different from sending the same evidence to a random Discord or Telegram contact.
How to tell whether you are still exposed
After recovering the account, check for signs that the attacker still has a path back in:
- the email address, phone number, or recovery email changed again;
- new devices or locations remain signed in;
- unknown OAuth or authorized apps are connected;
- friends receive links or marketplace messages from your account;
- password reset emails do not arrive because mail forwarding or blocking rules were added;
- new purchases, trades, or gift-card activity appear after you changed the password.
If any of these happen, repeat recovery from a clean device, secure the email account again, and update the platform ticket with fresh evidence.
Related Gridinsoft guides
If the compromise started after a suspicious game or mod, read Infostealer After Downloading a Game or Mod. If Discord sent spam from your account, use the Discord crypto spam malware guide. Roblox players should also review Roblox Robux Generator Scams, and Fortnite players should avoid fake V-Bucks generator sites. If the same malware reached your Microsoft login, follow Microsoft Account Hacked After Malware.
If the account problem started after installing an unofficial Fortnite launcher or private-server tool, also check our Project Era safety and malware cleanup guide before logging back in on the same PC.
FAQ
Can someone on Discord really recover my stolen Steam or Roblox account?
Assume no. A stranger may know real details because they stole the account or bought stolen data. Use only the official platform recovery flow.
Is Rambler.ru always malicious?
No. Rambler is a legitimate email provider, but attackers sometimes use Rambler, Mail.ru, Yandex, and other mailboxes when replacing a victim’s recovery email.
Should I pay if the person proves they have my account?
No. Payment does not remove their recovery access and can mark you as a victim worth targeting again.
Do I need to reinstall Windows?
Not always. First scan from a clean state, remove detections, reboot, and rescan. Consider a clean install only when malware keeps returning, system tools are disabled, or you cannot trust the device.
What evidence should I save for official support?
Save original email addresses, usernames, account IDs, purchase receipts, platform emails about unauthorized changes, dates, and screenshots of suspicious messages. Keep them for the official ticket, not private helpers.
If the account issue started after malware on a gaming PC, also check whether Steam Cloud saves or modded game files should sync to a new device; the Steam Cloud new-PC checklist covers that decision.
For a newer gaming-specific variant, see our note on fake FACEIT verification pages that steal Steam accounts; it covers Browser-in-the-Browser login windows, Steam Guard codes, and CS2 item trade pressure.
References
- Silviu Stahie. “‘I found your hacked account’: inside the Rambler.ru recovery scam.” Bitdefender HotforSecurity, May 26, 2026, accessed May 29, 2026. https://www.bitdefender.com/en-us/blog/hotforsecurity/i-found-your-hacked-account-rambler-scam
- Valve Corporation. “Steam Support – Account Stolen.” Steam Support, accessed May 29, 2026. https://help.steampowered.com/en/wizard/HelpWithAccountStolen
- Discord. “My Discord Account was Hacked or Compromised.” Discord Support, updated May 27, 2025, accessed May 29, 2026. https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised
- Roblox Corporation. “I Forgot My Password.” Roblox Support, accessed May 29, 2026. https://en.help.roblox.com/hc/en-us/articles/203313070-I-Forgot-My-Password
- Epic Games. “My Epic account was compromised and I cannot access it.” Epic Games Help, accessed May 29, 2026. https://www.epicgames.com/help/en-US/c-Category_EpicAccount/c-AccountSecurity/a000085846
