Recognizing phishing attempts

What phishing actually is

Phishing (from "fishing") is a scam technique that consists of impersonating a trusted service (bank, platform, carrier) to steal your credentials, your money, or your identity.

How it works in practice:

1. You receive an email, an SMS, a WhatsApp or Telegram message that claims to come from Ktkarena.
2. The message pushes you to click an urgent link ("Your account is about to be blocked, act now!").
3. The link takes you to a fake site that looks like Ktkarena but belongs to the attacker.
4. You enter your number and your password on the fake site. The attacker captures them.
5. The attacker immediately logs in to the real Ktkarena with your credentials.
6. If you don't have 2FA, it's over: they take control of your account and try to withdraw your money.

Phishing is the number one cause of account takeovers worldwide, ahead of brute force, malware, or password leaks.

The 5 warning signs of a fraudulent message

1. An abnormal sense of urgency.

The message tries to make you panic:

• "Your account will be deleted in 24h if you don't act!"
• "Suspicious activity detected - click here now!"
• "You've won 500,000 KTK, claim them before tonight!"

Reality: Ktkarena never creates false urgency. If we have a message for you, we give you time to react calmly.

2. Spelling mistakes or clumsy wording.

Scammers are often non-native speakers using machine translators. You'll notice things like:

• "You must confirmed your account" (instead of "confirm").
• "Dear costumer" (misspelled "customer").
• "Click here for reset of your password."

Reality: our communications are written and proofread by humans, with no mistakes.

3. A suspicious sender address.

Look at the sender's full address, not just the display name.

• ✅ Legitimate: support@ktkarena.com, notifications@ktkarena.com.
• ❌ Suspicious: support@ktk-arena.com, ktkarena.support@gmail.com, notification@ktkarena-cm.net.

Scammers create domains that look like the real one (with a hyphen, a different extension, a weird subdomain). Read very carefully.

4. A suspicious link.

Before clicking, hover over the link (on desktop) or long-press it (on mobile) to see the real URL.

• ✅ Legitimate: https://ktkarena.com/..., https://app.ktkarena.com/....
• ❌ Suspicious: https://ktk-arena-cm.com/..., https://bit.ly/3xyZ, https://ktkarena.com.fake-domain.ru/....

Tip: never click a link in an unsolicited message. Go directly to your Ktkarena app (or type ktkarena.com in your browser) to check.

5. A request for sensitive information.

The message explicitly asks for:

• Your password.
• Your 2FA code.
• Your recovery codes.
• Your bank card number.
• Your mobile money PIN.

Reality: no serious service (bank, carrier, Ktkarena) asks for this kind of info by email/SMS/WhatsApp. Ever.

What Ktkarena never does

Here's a clear list of what we will never do, so you can easily identify phishing attempts:

• We will never ask for your password, not by email, not by phone, not by WhatsApp. Our support doesn't have access to your password, so they have no reason to ask for it.
• We will never ask for your 2FA code, or your recovery codes.
• We will never ask for your Mobile Money PIN or your bank card details outside the app's secure screens.
• We will never tell you "Click fast or your account will be deleted". Any urgent communication goes through a push notification in the app, not email/SMS.
• We will never send you a link to "claim a gift" or "free KTK". We don't run promotions like that. If someone promises you free KTK in Ktkarena's name, it's a scam.
• We will never call you on the phone. Our support communicates only by email and through the app. If someone calls you claiming to be from Ktkarena, it's a scam.

What to do if you clicked or replied

If you clicked a suspicious link but didn't enter anything:

• Don't panic. A click alone isn't enough to compromise your account (except in very rare malware cases).
• Close the page immediately.
• Run an antivirus scan on your phone as a precaution.

If you entered your password on a fake site:

• Change your password immediately on the real Ktkarena (through the app).
• Enable 2FA if you haven't already.
• Check your login history in Profile → Security → History.
• Check your balance and your in-progress bets. If you see bets you didn't place or an abnormal balance, contact support immediately.

If you entered your 2FA code on a fake site:

• Log in immediately to the real Ktkarena and disable your 2FA, then re-enable it (this generates new secrets).
• Change your password.
• Contact support to report the attempt and have your account checked.

How to report a phishing attempt:

• Forward the fraudulent message to phishing@ktkarena.com.
• Mention the context (via WhatsApp, via email, etc.).
• Our security team investigates and gets fraudulent domains taken down whenever possible.