Security · Account safety

Don't take the bait.

Phishing works by looking almost right. This page shows the signals we use to spot fake ChessUrge messages, how to check a link before you click, and where to report one.

ChessUrge will never ask for your password or a two-factor code by email, chat or phone. We also will not ask you to pay outside the official checkout, send cryptocurrency or gift cards, or “verify” your account through a link in an unexpected message.

Red flags

Six reasons to stop.

Any one is enough to pause

Urgency or threats

“Your account will be deleted in 24 hours”, “payment failed”, “legal action”. Real account notices are in your notifications and do not demand instant action by email.

A slightly wrong domain

Look at the part immediately before the first slash: chessurge.org. Watch for chessurge-login.com, chessurge.org.verify.example, or a letter swapped for a lookalike.

It asks for a code

A one-time code is for you to type into ChessUrge. Anyone who asks you to read it back, forward it or enter it on another page is trying to take your account.

Unexpected attachment

We do not send game files, invoices or account exports as email attachments unless you requested one through the product. An unexpected ZIP, HTML file or PDF is suspicious.

Payment outside checkout

Credits and subscriptions are sold through the ChessUrge checkout. We do not take bank transfers, UPI requests, gift cards or crypto from a support email.

A different reply address

Check both the display name and the actual address. A message can say “ChessUrge Support” while replying to a random mailbox. Hover or long-press the sender to inspect it.

Verify before clicking

Check the link, not the logo.

1
Hover or long-press. Read the destination URL. The real host must be chessurge.org or a known subdomain such as play.chessurge.org.
2
Ignore the visible text. A link can display https://chessurge.org while pointing somewhere else. Inspect the actual target.
3
Type the address yourself. Open a new tab and go to https://chessurge.org, then sign in from there. If the email was real, the same action will be waiting in your account.
4
Check your notifications. Account, security and billing notices appear in your ChessUrge notifications and settings.

HTTPS alone is not proof. Anyone can buy a certificate for a lookalike domain.

Email we actually send

What a real message looks like.

FromA @chessurge.org address, with no unexpected reply-to mailbox.
LinksPoint to chessurge.org or its subdomains. Sign-in links are single-use and expire.
ContentVerification, password reset, one-time sign-in codes, receipts you requested and service notices.
NeverYour password, a request to read back a 2FA code, card details, gift cards, crypto or remote-access software.

Password & 2FA

Make a stolen email boring.

Open security settings

Use a unique password

Never reuse your ChessUrge password on another site. A password manager makes unique passwords practical.

Keep email OTP on

Every new device needs a code sent to your inbox. That second step is what stops a stolen password from being enough.

Add an authenticator

In Settings you can add an authenticator app for another factor. Store backup codes offline, not in your inbox.

Review sessions

Sign out devices you do not recognise in Settings. Changing your password revokes the other sessions automatically.

If you already clicked

Act in this order.

1
Change your password now. Use Settings → Password. Do it from a new tab, not from the suspicious link.
2
Sign out other sessions. On the same settings page, revoke sessions and trusted devices you do not recognise.
3
Check your email and billing. Look for unexpected password resets, receipts or payment messages. Contact your bank if card details were entered.
4
Report it. Send us the message, headers and URL. We can block the domain and warn other players.

Report phishing

Send it to us.

Forward the message or paste the full content, including the sender address and any link. Do not click the link again.

Email a phishing report Security contact

You can also use the machine-readable security.txt. We aim to acknowledge reports within 48 hours.

Guidance reviewed 2 November 2026. If you are unsure about a message, report it — a false alarm costs far less than a compromised account.