[tumblr] will never tell you to contact a discord account to dispute a report.
[tumblr] will never tell you to change your email to someone else’s to clear a report.
[tumblr] will never use a gmail account to dispute false reports.
[tumblr] will never ask you to pay for tech support related to your account being false reported. They also don’t charge for tech support in general.
Anyone commenting asking you to message them for an urgent manner about your account is running this scam and anyone DM’ing you saying they accidentally reported you for anything are also scammers regardless of who the account used to belong to. Do not message the account if they comment asking for a DM. Your mutual/friend is not running that account anymore.
Do not message the Gmail account it is not support.
Do not message the discord account it is not affiliated with tumblr or tumblr staff.
Do not go on Microsoft Teams it is not affiliated with tumblr or tumblr staff.
[tumblr] does not use Discord for any official tech support matters do not even think they do just because the screenshot looks official.
If you got hacked by this scam immediately contact actual tumblr support do not wait. Do it immediately. (Link is to tumblr help center)
Please share this post to your friends, mutuals, or random internet strangers. I can’t stress enough that people are still falling for this scam because they panic and don’t pay attention to the text.
A blog named "confirm-page" tagged my sideblog (and various other blogs) in the comments under its post claiming that a "minor anomaly" was detected with my account, telling me to verify my account within 48 hours by clicking a random link.
I did not click the link, of course; I reported the account for phishing and then blocked it. Just wanted to share what it looked like in case anyone else encounters it and isn't sure whether it's legit or not! :)
-------
Screenshots:
-------
Tumblr would NOT contact you through tagging you on a post like this (never will); they would contact you privately e.g. via email if there was an issue.
If you're unsure of if something is actually from Tumblr, either report it (my preferred method) or look up which email address to contact Tumblr though, and use that to ask them if it's legit or not!
Edit: seems like there are multiple different blogs doing this, so keep an eye out I guess
As I noted in my last message about this, I knew they'd update their script to try and make it so staff and people like me can't easily find their posts.
Well so sad to bad I found them anyway hehe. :)
(text version in the alt text)
Sometimes they also use this stupid AI image too, DISGUSTANG:
Here are past versions of this scam. sorry I don't have alt text. :(
Version 1 (first image) + Version 2 (second image)
Ko-Fi Phishing Scam - Warning, Details, & What to Do if You Clicked the Link
Date of posting: June 3, 2026.
Heads up to my fellow Ko-Fi users!! There's a known phishing scam going around. The scammers are sending messages via commission messages. They're claiming that the account has been suspended and won't be able to receive payments until information is verified. They then provide a link to follow to "fix" the issue.
Do not click that link!! It will steal your information and possibly your money. Block the sender and delete the message. If you're concerned that your account has actually been compromised because you clicked a link sent to you, send a ticket to the real Ko-Fi support team and change the passwords on Ko-Fi and all connected accounts.
(Also, it seems like Ko-Fi is getting a lot of traffic right now, probably because of this latest blast of phishing attempts. Stay calm. Your account is fine. Only send a ticket if you filled out a suspicious form; and if you did click or fill out something suspicious, make sure you change all of the passwords on your Ko-Fi and all attached accounts.)
Since I'm me, let's take a closer look at the message, how this phishing scam is meant to work, and how you can spot these yourself in the future:
The goal of a phishing scam is to convince you that something is wrong and needs your immediate attention. Scammers want you to click a link or call a phone number in order to further convince you to part with critical personal information, such as your banking details, account passwords, home address, and more. Sometimes, they'll even download malicious software onto your machine.
The thing about phishing scams is that they require you, the recipient, to take action in order to work. You've got to click that link or make that phone call for them to access your accounts. If you block, report, and delete their messages, they lose.
Most phishing scams consist of a few key elements:
An urgent, inflammatory first line or email title
An assertion of authority (support, staff, etc.)
A brief description of what allegedly needs fixing, usually having to do with account issues, payment processing, or similar
A reassurance that this can be fixed with simple steps
A link to follow or a phone number to call in order to fix the issue
A deadline
Here's a screenshot of the message I received this afternoon:
We're hitting most of the common traits of a phishing scam, minus the deadline declaration. Still, when I saw the email notification that I'd gotten this message, I felt a little panicked! I know enough about phishing scams to spot them, and I recognized this as bullshit pretty quick, but I still felt that initial jolt of fear. The scam hopes that I'll take action on that fear alone, because oh god that's my money. You know?
So, I took a breath. Told myself I'd done nothing wrong, and if it was real (which it certainly wasn't), then I could contact support and figure it out. I logged into my account to have a closer look, and... Nothing. Everything was fine. No suspension notice, no big red prompt. My payment methods are intact with no warnings attached.
Interesting, no? I took another, closer look at the message. I grabbed a screenshot of it to send to the support team since they're tracking the situation and to talk about it here.
This is a very clever phishing attempt. The message itself is well-crafted. It's a little awkward in places, but the grammar is good. My guess is it's an LLM at work, generating text to send out. The emojis are a deeply unprofessional touch that would absolutely never be included in a message about something as serious as a suspension notice. The intention is to lower your guard and make you feel as though the "support rep" messaging you is on your side. It's meant to instill trust and camaraderie.
The description of what's going on is short, sweet, and to the point. Note the urgent tone and lack of details about why this suspension has supposedly occurred. A real suspension message would typically require at least a brief explanation of the reason for suspension, often including citation of site policies or a mention of reports being filed against the account. Nothing like that here.
It goes on to threaten my money, stating that people can view my page but that any payments they make won't be processed. It raises more questions than it answers -- will people be able to make payments and their money will hang in limbo? Or will those payments not go through? Or will the site not even allow payments to be made? This is by design, meant to cause a further spiral of anxiety that will lead the recipient to following whatever instructions they've been given.
And, oh! How kind! The process to fix this is super short and easy, and they won't even need me to upload any documents. What an odd thing to say. I hadn't even considered that it would require uploading documents... such as ID, perhaps. If the process is simple and purportedly safe, there's no reason to not do it right now! This assurance is aimed to prevent the recipient from putting the task off for later. It's also meant to entice someone who's particularly panicked to not go looking for other information or solutions -- because the best one is right here, no documents upload necessary.
And finally, the link. Click here to fix everything right now, it says. But take a closer look at that link.
It starts with the "ko-fi" website name, apparently on a page called "edit profile"... at a .my address. And then, of course, a bunch of random letters. It's the .my address that should raise the biggest red flag here. Ko-Fi is a .com web address, and all of their associated pages are .com, too. While I haven't clicked this link (and will not be clicking it, thank you), it will certainly not be going to a reliable settings page.
Again, the goal of a phishing scam is to steal your information by convincing you to click suspicious links. This scam in particular seems intent on getting you to "update your information" -- that might include your banking information, PayPal login credentials, Ko-Fi account credentials, and more.
You should never have to leave the website in order to verify or update this information. This isn't just true for Ko-Fi; it's true for pretty much every single website out there.
The other big giveaway that this is a phishing scam is that message at the very bottom, stating that this DM was sent because I have commission messages turned on. Commission messages allow people to contact me by clicking a little message icon on my commission listings. This way, they can chat with me about my services before buying if they have questions or want to negotiate details.
Ko-Fi support would absolutely not need to use commission messages to reach me. Beyond that, clicking the "Support" name should take me to an account page -- but it doesn't. It redirects me to my settings page, which is what happens when someone without an account messages. The company Ko-Fi has an account.
Beyond that, Ko-Fi support operates via ZenDesk. They wouldn't send a direct message about anything, let alone a suspension notice. I would have received an email with official Ko-Fi branding.
Which... in a way, I did. When someone sends a message on Ko-Fi, it generates an email to let the account owner know they've got one waiting for response. That means that I received an email that looked like this:
By sending a direct message through the Ko-Fi system, this phishing scam was able to make it look like the message was official. This is the real reason this phishing scam is so clever. An appropriately frightened and unwary person would see this and maybe not even log into their Ko-Fi account. They might just click the link from the email and follow whatever instructions they're given.
Put all this together, and I knew with absolute certainty that this was a scam -- one that will absolutely fool a lot of people.
Steps You Can Take to be 100% Certain a Message is Phishing
Even with all this knowledge and reassurance, it can be hard to know for sure that a message is a phishing attempt. Because, like, what if? You know? What if it's actually real?
First: Take a breath. Anytime you receive a notice about any account of yours encountering issues, take a second to calm yourself. If it's real, you'll want to follow proper channels to fix it. If it's fake, you don't want to be so panicked that you fall for a scam. Either way, give yourself a moment to breathe and calm down.
Second: Check your account. Close the email or the message. Don't click any links provided. Go to the actual website or app. Log in to your account and check for any prompts, pop-ups, or warnings in your account settings. If you can't log in at all, contact the support team of the site using their preferred channel(s).
Third: Check your payment processor(s) and bank account. Make sure there aren't any prompts, pop-ups, or warnings there, too. Make sure you can still log in okay and that there aren't any suspicious transactions that have gone through or that are pending. If there are, contact support ASAP; they might be able to prevent or reverse the charge, and they might be able to block any more from that source.
Fourth: Do a quick search online. See if anyone else is already talking about it. I found several Reddit threads talking about this scam, and it seems like it's evolved slightly since it first started appearing months ago.
Fifth: Check the website's support/help resources. A lot of websites have FAQs and other resources to help users with issues they might encounter. When any scam becomes widespread, the platform will typically put out official messages talking about it. They might also have blog posts or articles dedicated to the situation. If a problem is active and ongoing, they might even put up an alert banner to both warn users who don't know about it and assure users who have gotten the message(s) to not worry. Here's the one that's splashed across the top of Ko-Fi's support page right now:
Sixth: Message support. If you can't find any information, or if you interacted with the scam and are worried about being compromised in some way, send a message to the website's support team. Use their official channels to submit a ticket, send an email, or chat with a rep. If you're pretty sure you've encountered a phishing scam and you can't find anything about it, include screenshots of the message(s) so that support can properly investigate.
Seventh: Take extra security measures. If you're still worried after all of these steps and especially if you clicked a suspicious link, change your passwords. It's important to do this for every account attached to the one that's been compromised. (In this case on Ko-Fi, if you didn't click the link from the scammer, you shouldn't need to update any passwords or anything else.)
personally i think this should be pretty obvious, but just in case it isn't
@support75549920 made a post about "account verification" and then another blank blog @support33394992 tagged me and a few other blogs for us to "submit information"
dont do this. these are fake blogs trying to scam you out of your information. if @support @staff does go through with the (frankly terrible idea, given that things like this are already happening) identity verification, theyre not gonna tag random people in a tumblr post
what a broken fucking website
***edit with some screenshots of the replies on that post***
Above are screenshots of a DM I received yesterday. I replied hello back, and they sent me the above message.
Their next step in this scam is to direct you to a Discord to "clear it up", wanting you to DM a discord account who begins asking you questions before ultimately asking you to change your email address to theirs so they can ‘fix’ the flag on your account. Then they lock you out of your account (I'm assuming on Discord) then they log in as you, and start sending anyone and everyone the same "I accidentally reported you" message from your account.
I reported this account through the Tumblr support form, it is a phishing scam. If you get a message like the one above from any account, report the account and let Tumblr know you are reporting phishing.
block this account, and if anything like this pops up into your inbox, report the user and block them. don't follow their links, and remember that staff wouldn't directly dm you, they wouldn't ask for your discord, and reports have not in fact actually been filed against you. this is a scare tactic, and while this specific scam isn't impersonating staff, there have been comment scams as well pretending to be staff and following a similar vein to this. again, don't click any links, don't interact. report and block.
