We all know that once word gets around the scammers will start looking for new ways to trick you. AO3 is a great spot because it's 1) full of casual users who 2) probably reuse their logins and 3) have a high risk of being embarrassed if it gets out which site they were tricked on, meaning they're less likely to report, which makes the scam go on for longer.
Here's a non-comprehensive overview of some of the red flags in this particular scam, so you can hopefully spot them next time and be a little safer.
Uncommon method of contact.
As already started: AO3 volunteers will never formally contact you through the comments. They already know your email address.
Uncommon reason for contact.
You posted a fic. That's what AO3 literally does, with very few restraints, and absolutely no automation. Other websites (Youtube, TikTok, etc) might ding you because you sneezed and it sounded a little too much like a banned word, but AO3 doesn't do that. If an AO3 volunteer contacts you, they'll tell you exactly what's going on.
Taking you to a secondary location.
This link is clearly hiding something (which, again, AO3 will not do), which is a bright red flag, but even if it looks like AO3, don't click. It's easy to hide a link inside a link, especially when mirror sites like https://archiveofourown.gay is legit.
Threat of action not in evidence.
Any time something says your account is or will be in danger/broken/locked/suspicious/etc and you see zero evidence, did absolutely nothing, that's a sign that something fishy is going on.
I mean this with all my heart: absolutely no website will give you only two hours to take action on anything. If the tone of the thing makes you panic, that's because they want you to panic. Panicky people make bad choices in a hurry.
Okay Faerii, but now that I know what to look out for, I'm safe, right?
We're all human. We all click on things we shouldn't, even if approximately zero-point-one seconds later we regret it.
These types of scams probably don't want your AO3 account. They want things like your Amazon/Walmart/Target account. Basically: anywhere they can get money or goods fast and scram before the shop catches on. Some ways ways to protect yourself in case of an oops is
Use a unique password for absolutely. every. fucking. thing. Learn to love passphrases. Get a password locker. Google and Firefox both offer free ones. We're not hiding the smut from the FBI, so literally anything that will keep you from making ItWasHisSled1234 your password across fifty different sites is good enough.
Update your passwords regularly, especially after anything suspicious happens. Password lockers will also help with this.
Keep a separate fandom email address and use it for AO3. I mean it. This will protect you not just from people who hope your AO3 email & password are the same as your bank account's, but it also provides an extra level of freedom from loved ones. We've all heard tragic stories of people whose loved ones found their AO3 account and used access to their phone to get it deleted.
(In case you need a nudge on #3, yes your school and/or employer can see every email you send or receive, and all it'll take is one overly explicit comment to drag you in for A Conversation.)
Related to 3, I strongly encourage learning how to be anonymous on the internet. Please. Please. Stop using your full name, mentioning your specific home town or identifying landmarks, and if you're under 18 shut up no you're not you're a 23 year old Fine Arts major from Kentuckleburg, Portlegon.
Multifactor authentication is your frenemy. Use it wherever you can and (I cannot stress this enough) do not get in the habit of unquestioningly accepting the login requests. That unexpected text message may save your bank account.
Lie your ass off on your security questions. Favorite color? Bald. Mother's Maiden Name? Chocolate. Street You Grew Up On? Lagrange Point 4. It doesn't matter if you're honest, just that you remember. Some higher tier password lockers will give you space for notes in case you need a reminder.
Get friendly with AO3's support methods. If something is really urgent, really weird, or you just want to be certain before ignoring it, ask. There's no shame in asking questions, and it's better to be sure than to take a risk.
And now ladies, gentlemen, honored guests, and Chat, hopefully you can go forth and be a little safer on the internet.
