How To Stay Safe Online While Playing Rise of Kingdoms
Made by: The Roknut Academy

Estimated reading time: about 30 minutes depending on reading Comprehension and speed. (jump to the parts you need) · Last reviewed: October 2026 · Covers: account security, scams, resource sellers, payments, VPNs, antivirus, ad blockers, Discord safety and what to do if something goes wrong

Disclaimer

This guide is for general information and education. It is not legal, financial or professional security advice. Game rules, store features, menu names, VPN features and prices change, so always check the game's current Terms of Service, official support pages and the providers' own websites before making decisions. The Roknut Academy is not affiliated with Lilith Games. Rise of Kingdoms is a trademark of its respective owner.

Read this first: the short version

Rise of Kingdoms is a game where years of effort, and often real money, are stored inside one account. That makes your account valuable to other people, and valuable things attract scammers. The good news is that almost every RoK security disaster follows the same handful of patterns, and almost all of them can be avoided with habits that take minutes to set up.

If you only remember 8 things

Never give anyone your password, login code or verification code. Not an R5, not a "moderator", not a "Lilith agent", not your best friend in the alliance.
Secure the email or Google/Apple/Facebook account that your game is linked to. That login is the real key to your account.
Turn on two-factor authentication (2FA) everywhere you can, preferably with an authenticator app instead of SMS.
Buy only through official channels. If a price is far below the in-game price, it is a trap.
Never buy or sell accounts, resources or gems from strangers. It breaks the rules and it is the number one way people lose money.
Do not install "mods", "hacks", "gem generators", bots or random APK/EXE files.
Keep Discord/Telegram/WhatsApp locked down. Most scams start with a private message.
Use layers. A VPN, an antivirus and an ad blocker will not stop you from being tricked, but they reduce the number of ways you can be tricked or tracked.

What is inside this guide:

Why RoK accounts are targeted, and what the real threats are
The golden rules of RoK safety
Account security fundamentals (passwords, 2FA, binding, devices)
The complete RoK scam encyclopedia (gem generators, top-up sites, account sellers, resource sellers, fake giveaways, phishing, malware and more)
How to pay safely and avoid refund and chargeback disasters
VPNs explained honestly, plus how to set up Surfshark and a free alternative (Proton VPN)
Antivirus and ad blocking for gamers
Wi-Fi, router and device safety
Discord, Telegram, alliance and kingdom safety
Farm accounts and multi-account safety
What to do if you have been scammed or hacked
Checklists, a security routine and a long FAQ

Part 1: Why RoK accounts get targeted

Your account is worth more than you think

Rise of Kingdoms is developed and published by Lilith Games, and like most big strategy games it runs on a premium economy. Gems, VIP levels, Legendary Sculptures, equipment blueprints, speedups, resources and expertised commanders can all be bought with real money, which means they all have a real-world value.

Think about what a mid-game account contains:

Months or years of speedups, resource tokens and Action Point bottles that took you a long time to hoard.
Expertised commanders and iconic equipment that cost either a lot of time or a lot of money.
VIP levels, city skins and event rewards that cannot be rebuilt quickly.
A position in an alliance or kingdom, sometimes with leadership permissions that give access to other people's stuff.
Possibly a payment history, a linked email and linked social accounts.

To a scammer, that account is either something to steal and sell, something to strip and abandon, or a way to reach other people (your alliance, your friends, your kingdom). Understanding that mindset is the first step to defending against it.

The real threat model (what actually happens to players)

Many players picture a hacker in a hoodie breaking into their account. In reality, almost nobody "hacks" a RoK account by cracking game servers. The overwhelming majority of losses happen because the player was tricked into handing over access. That is called social engineering, and it is why a VPN alone will never make you safe.

Here is how the main threats compare:

Threat	How it usually happens	What actually protects you
Phishing and fake login pages	A link in a DM, email, comment or ad takes you to a copy of a login page and you type your details in.	Never log in through links. Use a password manager (it will not auto-fill on fake domains) and 2FA.
Social engineering	Someone pretending to be support, an R5, a content creator or a friend asks for a code or login.	Rules: never share codes or passwords, verify through a second channel, slow down.
Malware and infostealers	You install a fake tool, mod, bot, calculator or cracked file. It steals saved passwords and login sessions.	Official downloads only, antivirus, no sideloading, no pirated software.
Payment fraud	You buy gems or resources from an unofficial seller, or sell to someone who then reverses the payment.	Official stores only. Never trade outside the game's rules.
Account sale scams	Buyer pays for an account that the seller later recovers, or seller hands over an account that gets banned.	Do not buy or sell accounts at all.
Credential reuse	A password you used on some other website leaks, and attackers try it on your email or game login.	Unique passwords for every account, plus breach alerts.
Network snooping	On public Wi-Fi, someone intercepts traffic or sets up a fake hotspot.	HTTPS, a VPN on untrusted networks, and avoiding sensitive logins on shared Wi-Fi.
IP exposure	You click an IP-logger link or join a voice call with a hostile person, and they learn your home IP.	Do not click unknown links. A VPN hides your home IP from the other side.

Why this matters for how you spend your effort

Notice that the first four rows are about behaviour, and the tools only help in the last few. A good security setup is roughly 80% habits and 20% software. We will cover both, but if you take only one thing from this guide, make it the habits.

Who gets targeted most?

New players who are excited, do not know the rules yet, and believe that "free gems" or "resource boosts" might be real.
Players with a lot of spending, because their accounts have the most to steal.
Alliance leaders and officers (R4/R5), because compromising one gives access to a whole group and its trust.
Content creators and kingdom organisers, because they receive many messages from strangers and are expected to open links.
Younger players, who may be less experienced with fraud and may not realise a payment is irreversible.
Players about to migrate or about to start a new kingdom, because they are actively looking for help and accept advice from strangers.

If you are in any of those groups, treat this guide as essential reading rather than optional.

Part 2: The golden rules of RoK safety

These are the rules we share with every new member of our community. They are simple on purpose, because simple rules are the ones you remember when someone is pressuring you in a chat window.

Rule 1: Nobody needs your login. Ever.

There is no legitimate reason for a person or a service to ask for your password, your email code, your verification code, or your login session. That includes people offering to "do your events", "boost your power", "recover your banned account", "fix a bug" or "help you migrate". Genuine official support works through the in-game support channel and does not need your password.

Rule 2: If it sounds too good, it is a trap.

1 billion resources for ten dollars, 100,000 gems for the price of a coffee, a maxed account for the price of a pizza. Prices that are dramatically lower than official prices exist for a reason: the payment is stolen, the product does not exist, or you are the product.

Rule 3: Urgency is the scammer's best friend.

"Your account will be banned in 24 hours." "Only 3 spots left." "Offer ends in 10 minutes." Pressure is designed to stop you from thinking. If a message tries to rush you, that alone is a red flag.

Rule 4: Official channels only.

Buy through the in-game store or the official Lilith web store that the game itself links to. Redeem codes only inside the game or on the official page the game links to. Get support through the in-game support menu. If a link did not come from inside the game or from a verified official account, do not trust it.

Rule 5: Move conversations back to where you can verify them.

If "an officer" DMs you on Discord asking for something unusual, message that officer through a different channel (alliance chat in the game, or in person if you know them) and ask whether it was really them. Scammers copy profile pictures and nicknames in seconds.

Rule 6: Trades outside the game rules are not protected.

If you buy or sell accounts, resources or gems outside the official system, you are on your own. There is no refund desk, no escrow and no protection, and the action itself can get your account restricted or banned.

Rule 7: Keep your accounts separated.

Use a different password for every account and, ideally, a different email for your main account and for each farm account. If one account is compromised, the others should not fall like dominoes.

Rule 8: Assume every link and every file could be hostile.

Do not open files from strangers. Do not run macros in spreadsheets from Discord. Do not scan QR codes that you did not generate yourself. Do not "verify" yourself on unknown websites.

Rule 9: Report, do not argue.

If someone sends you a scam, do not waste energy arguing. Block, report, warn your alliance, and move on. Arguing gives them information about how to improve the next attempt.

Rule 10: One bad day should not cost you everything.

Assume that at some point you will make a mistake. Build your setup so that one mistake does not become a disaster: 2FA on, a recovery method ready, no reused passwords, important screenshots saved, and a plan for what to do next. We cover that plan in Part 11.

Part 3: Account security fundamentals

Before we get into scams, let us lock down the foundation. If your accounts are properly secured, many scams simply cannot succeed even if you are tricked into clicking something.

Understand what actually protects your game account

In RoK, your account is tied to a login method. Depending on your platform and when you started, that might be a Google account, an Apple account, a Facebook account, a Lilith account (email-based) or a guest account. The key point is this:

Your game is only as safe as the login behind it

If someone takes over the email, Google, Apple or Facebook account that your game is linked to, they can usually take over the game too. That is why we start with those accounts and not with the game itself.

Bind your account

Open the in-game settings and find the account or bind account section. Menu names and layouts change between versions, so look for anything mentioning account binding or linked accounts.
Make sure your account is bound to a login method that you control and can recover. A "guest" account that is not bound can be lost if you lose your device.
If you are bound to several methods, secure all of them. Attackers go for the weakest link.
Do not bind your main account to a throwaway or shared email address. Anyone who can read that inbox can reset access.

Choose the right login for each account

Login type	Strengths	Weak points to watch
Google or Apple account	Mature security features: 2FA, passkeys, device prompts, recovery tools and breach monitoring.	If your Google/Apple account is taken over, everything linked to it is exposed. Lock it down first.
Facebook account	Convenient and widely used.	Facebook accounts are heavily targeted by phishing and hijacking. Use 2FA and review linked apps regularly.
Lilith account (email)	Independent of big social platforms.	Only as strong as the password and the email inbox behind it. Use a unique password and secure the inbox.
Guest or unbound	None worth relying on.	Easy to lose and hard to recover. Bind it as soon as possible.

Passwords: the boring thing that saves accounts

Password reuse is the single most common reason that accounts get taken over without the owner doing anything "wrong" in the game. A website you used years ago gets breached, your email and password leak, and attackers try that same pair everywhere. If your game or email uses that password, it is over.

What a good password setup looks like

Unique for every account. No exceptions for email, Google, Apple, Facebook, Discord or Lilith.
Long rather than clever. A random passphrase of four or more unrelated words, or a long random string from a password manager, beats "P@ssw0rd2024!" every time.
Stored in a password manager. Free and reputable options include Bitwarden and Proton Pass. Paid managers exist too. A password manager also helps against phishing, because it will not offer to fill your password on a look-alike website.
Changed after any suspicion. If something feels off, change the password immediately, starting with your email.
Never saved in a notes app, a screenshot or a chat. Those get synced, shared and stolen.

Check whether you have already been exposed

The free service Have I Been Pwned (haveibeenpwned.com) lets you enter an email address and see whether it has appeared in known data breaches. If it has, change the passwords for every account that used it. Some security suites, including the one we cover later in this guide, also offer ongoing breach alerts so you hear about new leaks automatically.

Two-factor authentication (2FA)

2FA means that a stolen password alone is not enough to get in. It is the best single upgrade you can make to your security, and it is free.

2FA method	Security level	Notes
Hardware security key or passkey	Highest	Resistant to phishing. Ideal for your main email and Google/Apple account.
Authenticator app (time-based codes)	High	A strong everyday choice. Back up your recovery codes.
Push approval from the provider's app	Good	Convenient, but never approve a prompt you did not trigger yourself.
SMS codes	Basic	Better than nothing, but vulnerable to SIM-swap attacks and message interception.
No 2FA	None	One leaked password and the account is gone.

2FA best practices

Turn on 2FA first for your email, because email resets everything else.
Then turn it on for Google, Apple and Facebook accounts linked to games.
Save your backup or recovery codes somewhere offline, such as printed and stored safely, or inside your password manager.
Add a second recovery option that you control, such as a second authenticator device or a recovery email you can access.
If your provider supports passkeys, consider enabling them. They are very resistant to phishing.
Never share a code with anyone, even if they say they are from support. A verification code is a key, and nobody legitimate asks for it.

What is a SIM-swap?

A SIM-swap is when a criminal convinces your phone carrier to move your number to a SIM card they control. They then receive your SMS codes and use them to reset accounts. If you have a high-value account, prefer an authenticator app or a hardware key over SMS, and ask your carrier whether they offer a port-out PIN or number lock.

Device hygiene

Your phone or PC is the door to your accounts. A compromised device makes everything else pointless, because malware can capture passwords, read screens and steal logged-in sessions that bypass 2FA.

Keep your operating system and apps updated. Updates fix security holes that attackers actively use.
Install the game only from official stores (Apple App Store, Google Play) or from the official Lilith source. Never from a random website offering a "modded" or "unlocked" version.
Do not jailbreak or root the device you use for your main accounts unless you truly know what you are doing. It removes protections that are there for a reason.
Use a screen lock (PIN, fingerprint or face) and make sure it is not trivial. A lost, unlocked phone is a lost account.
Enable "find my device" features so you can lock or wipe a lost phone.
Be careful with shared devices. Do not stay logged in on a family PC, a school computer or an internet cafe machine.
Review installed apps every few months and remove anything you do not recognise or no longer use.
If you play on PC, use the official PC client or a well-known emulator downloaded directly from its official website. Fake emulator and "RoK PC" download pages are a common way to spread malware.

What you can and cannot safely share

New players often panic and refuse to share anything, while others share far too much. Here is the practical split.

Usually fine to share	Never share
Governor name and in-game ID (needed for alliance invites, gifts and kingdom lists)	Passwords, in any form
Kingdom number and alliance tag	Email or login verification codes and 2FA codes
Power, kill points and general stats	Screenshots of your account/binding settings screen
Commander setups and talent trees	Your email address, phone number or real address in public chats
Questions about the game, strategy and events	Payment card details, receipts with full numbers, or order confirmations with personal details
Public screenshots of battle reports	Discord tokens, session files, browser cookies or "login files"

Is my governor ID dangerous to share?

No. Your governor ID is more like a username that other players use to find you. On its own it does not give anyone access to your account. It does, however, allow scammers to look you up and address you by name, which makes a fake message feel more personal, so stay alert when someone you do not know already knows your ID.

Screenshot and streaming hygiene

Before you post a screenshot, check the edges. Make sure it does not show an email address, an account menu, a notification with a code, or a browser tab with private information.
If you stream or record, hide notifications and close your email and Discord. Several players have leaked login codes or private messages live on stream.
Do not post your receipts or order confirmations publicly when asking for help. Black out personal details and order numbers that identify you.
Be aware that screenshots of your settings page can show linked accounts. Scammers use that to pick the right account to attack.

Part 4: The complete RoK scam encyclopedia

This is the longest section of the guide, and it is the one most likely to save you money. For every scam we cover how it works, the red flags, and what to do instead. Scammers change their wording constantly, but the underlying tricks do not change, so learn the patterns rather than memorising scripts.

Important note about rules and risk

Buying or selling accounts, gems, resources or other in-game items for real money outside the game's official store is generally against the game's Terms of Service, and publishers can restrict or ban accounts involved. Check the current Terms of Service and Lilith's support pages for the exact wording. We do not recommend, endorse or help with unofficial trading. We describe these scams so you can recognise them and stay away.

Scam 1: "Free gems", generators, hacks and cheats

How it works

You see an ad, a YouTube comment, a TikTok, a Facebook post or a website promising free gems, unlimited resources, a "RoK hack" or a "gem generator". The page asks for your governor ID or username, shows a fake progress bar and a message like "Generating 50,000 gems...", and then asks you to "verify you are human". Verification means one of the following:

Completing surveys that pay the scammer for each lead.
Downloading an app or file that is actually malware.
Entering your email and password, or logging in with Google, Apple or Facebook, so your account can be taken.
Entering payment details for a "small verification fee".

Why it cannot work

Your gem balance lives on the game's servers. The server decides what your account owns. A website cannot add gems to your account because it has no access to that database. Anything claiming otherwise is either lying or abusing an exploit, and in the second case the account that benefits typically gets caught and punished.

Red flags

The word "generator", "hack", "unlimited", "free gems no verification" or "mod apk".
A fake counter, fake live chat or fake "recent winners" list.
Comment sections full of identical praise, or comments turned off.
A request to log in with your game or social account.

What to do instead

Get free gems the legitimate way: events, daily tasks, exploration, the official redeem codes that Lilith posts on its official channels, and our free-to-play guides. If you did enter your details on one of these sites, jump straight to Part 11 and change your passwords now.

Scam 2: Discounted gems from third-party top-up sellers

How it works

You find a website, a Discord server, a Telegram channel or a social media page selling gems far cheaper than the official store. They ask for your governor ID (sometimes only your ID, sometimes more) and your payment. The gems may or may not arrive. Where they do arrive, there is often a hidden cost.

The hidden danger: stolen payments and chargebacks

Many discount sellers fund their stock using stolen credit cards. They buy official gem packs with a stolen card, deliver the gems to your account, and keep your money. Later the real card owner disputes the charge. The payment is reversed and the publisher may remove the gems or items from the receiving account, and can restrict or ban the account that received them. You lose the gems, you lose the money you paid to the seller, and you might lose the account.

Other ways it goes wrong

Outright non-delivery: you pay and never hear from them again.
Login requests: a "top-up agent" asks for your password "to log in and add the gems". A genuine top-up by ID never needs a password. This is account theft.
Bait and switch: you receive a small portion and are told to pay more for "taxes", "fees" or "unlocking".
Data harvesting: checkout pages that collect your card, email and address for later fraud.

Red flags

A price dramatically below the official price. The bigger the discount, the bigger the risk.
Payment methods that cannot be reversed: crypto, gift cards, bank transfer, friends-and-family payments.
No real support, no clear refund policy and no business information.
Reviews that look copied, or review sections with comments disabled.
Any request for your password, email login or verification code.

What to do instead

Buy through the in-game store or the official Lilith web store that the game links to. It is the only channel that gives you proper protection and a way to dispute a problem. Your own gem and bundle strategy from our spending guides will give you far more value than any unofficial discount ever could.

Even "ID-only" sellers are risky

Some sellers say they are safe because they only need your ID, not your password. That removes one risk (credential theft), but not the others: stolen payment methods, chargebacks and Terms of Service problems remain. "Safer than handing over a password" is not the same as "safe".

Scam 3: Account sales (buying or selling an account)

This one costs people the most money. There are scams against buyers and scams against sellers.

Scams against buyers

Recovery scam: the seller hands over an account, you pay, and a few days later the seller uses recovery options they still control (the original email, a linked social login, a phone number) to take it back. Now they have your money and the account.
Double selling: the same account is sold to several buyers at once. Only one can hold it, usually the last one the seller chooses.
Fake account: the screenshots are edited, borrowed from someone else's account, or taken from an account the seller does not own.
Banned or flagged account: the account has a history of refund abuse, cheating or chargebacks and gets restricted soon after you take it over.
Stolen account: the account was hacked from its real owner, who then contacts support. The account gets locked and returned to them, and you lose your payment.
Fake middleman: the seller insists on using a "trusted middleman" that is actually the seller's friend or alternate account. The middleman "confirms" the account exists and takes the payment.

Scams against sellers

Payment reversal: the buyer pays through a method they can later dispute, takes the account, and then reverses the payment. You lose the account and the money.
Fake payment proof: a doctored screenshot of a payment that never happened.
Overpayment trick: the buyer "accidentally" sends too much and asks you to refund the difference. The original payment later bounces and you are out the refund.
Information theft: the buyer asks for "verification" details and uses them to attack your other accounts.

Why this is dangerous even if nobody scams you

It is against the rules, so the account can be restricted or banned and support will not help you recover it.
You may be handing over, or receiving, an account linked to personal data (an email, a phone number, a social profile) that creates privacy and fraud risks.
There is no official protection at all. If something goes wrong, there is nobody to complain to.

What to do instead

Do not buy or sell accounts. If you want a stronger account, use the free-to-play and spending guides on this site to build one properly. If you want to leave the game, let it go or transfer progress only through official game systems.

Scam 4: Resource sellers and "resource trading"

Resource sellers are a major source of scams in RoK, especially in kingdoms and alliance chats where players are always short of food, wood, stone and gold. The offer sounds simple: send money, receive resources.

How resources can move between accounts

Resources can be moved between accounts inside the game, for example from farm accounts to a main account in the same alliance by using the Trading Post and the alliance transport system, which includes a tax and capacity limits. This is a normal game feature and it is how many players use farm accounts. The scam risk comes when a stranger offers to send you resources in return for real-world money.

Common resource scams

Pay-first disappearance: you are asked to pay first "because I have been scammed before". Once you pay, you are blocked.
Partial delivery: you receive a small amount to build trust, then are asked to pay more for the "main batch".
Reversible payment trick (against sellers): a buyer pays, receives your resources and then disputes the payment so you lose both.
Fake alliance requirement: the seller says you must join a specific alliance or give them access to your account so they can "transfer" resources.
Stolen resources: the resources came from hacked accounts. When the original owners complain, the game may investigate and take action against accounts that received the stolen resources.
Bulk bundle bait: "1 billion resources for $20". Numbers that large for prices that small are almost never real.

Why the numbers never add up

Farming resources at scale takes time, accounts and effort. Anyone genuinely able to farm huge amounts for pennies would not be selling them in public chats. The cheaper and bigger the offer, the more likely that the "seller" has no resources at all.

What to do instead

Use legitimate sources: farm accounts you run yourself, events such as Strategic Reserves and Lucky Stall, alliance territory resources, daily quests and the courier station.
Our resources and farming guides explain exactly how to build strong resource income without risking your account.
If you ever receive a resource transfer you did not expect, do not rush to pay anyone, and ask your leadership how to handle it.

Scam 5: "Boosting", power-leveling and account-sharing services

How it works

Someone offers to level your account, finish events, win AoO, complete Karuak Ceremony or push your power while you sleep. The catch is that you must give them your login so they can play as you.

What goes wrong

They empty your inventory, speedups, gems and resources, then abandon the account.
They change the email, bind their own login, and lock you out.
They sell your account to someone else.
They use your account for activity that triggers a ban, such as botting or abusive trading.
They hold the account for ransom: "pay more or I will wipe it".

Red flags

Any service that requires your password or login session.
Payment upfront and a promise that results will arrive "within 24 hours".
Testimonials with no way to verify them.

What to do instead

Ask your alliance or kingdom for advice on event strategy, and use our event guides. Playing your own account is the only safe way to progress it. If someone from your own trusted circle offers help, give advice, not access.

Scam 6: Fake giveaways, fake creators and fake staff

How it works

You receive a comment, DM or post saying that you won a giveaway, that a famous player or creator is giving away gems, or that Lilith is rewarding active players. You are told to click a link, claim a prize, send your ID and often to "verify" on a website. The page is a phishing page, a survey trap or a malware download.

Common variants

Fake YouTube comments: a profile picture copied from the creator, a name that looks identical with a subtle difference, and a comment such as "Congratulations, you were selected, message me on Telegram". Genuine creators do not run giveaways through private messages in comment sections.
Fake Discord moderators: a DM from "Admin" or "Support" saying your account is under review.
Fake Lilith staff: messages that claim to be from Lilith Games and ask for account details "for security reasons".
Fake sponsorship or collaboration offers: aimed at creators, asking you to download a file, install software or open a "contract" that is actually malware.
Fake lotteries: "You won a RoK lottery, pay a small fee to claim".

How to verify

Check the account name character by character, and look at when it was created and how many followers it really has.
Check whether the same giveaway is announced on the creator's own channel or on official pages.
Remember that real giveaways never ask for your password, a payment or a verification code.
If there is any doubt, do not click. Ask in your alliance chat or in our community whether anyone has seen it.

Scam 7: Phishing emails, texts and fake login pages

How it works

You receive a message that looks official: a warning that your account will be suspended, a notice about a suspicious purchase, a refund you did not request, or a security alert asking you to confirm your identity. The link leads to a fake website that looks like a real login page. When you type your details, they are captured.

How to spot a fake page

Check the domain carefully. Fake pages use look-alike names with extra words, swapped letters, or odd endings. Read the part just before the first single slash. If it is not exactly the official domain, leave.
Do not trust the padlock. HTTPS only means the connection is encrypted, not that the site is honest. Scam sites use it too.
Be wary of shortened links and of QR codes you did not create yourself.
Look for urgency, spelling mistakes, generic greetings and demands to act now.
Let your password manager help. If it refuses to autofill on a page that claims to be your login, that is a warning sign.

What to do

Never log in through a link in a message. Open the game or type the official address yourself, then check the message by logging in directly. If you are worried about your account, use the in-game support option, not the contact details given in a suspicious message.

Scam 8: Malware, mods, bots, cheats and fake tools

How it works

You look for an advantage and find a downloadable tool: a "mod APK", an auto-farming bot, a macro, an overlay, a "RoK calculator.exe", a spreadsheet with macros, or a cracked emulator. The file does something useful on the surface, but quietly installs software that steals your saved passwords, browser sessions, Discord tokens and wallet data.

Why this is the scariest scam

Infostealer malware does not just take your game account. It can take your email, social accounts, saved cards, cookies and logged-in sessions. Stolen sessions can bypass 2FA because the attacker does not need to log in. They just reuse your session. One bad download can compromise everything.

Red flags

Any download that promises to make the game easier, give free resources or auto-play.
Any file from a stranger, even one you trust, such as a friend whose account may have been hijacked.
Installers that ask for administrator rights, disabling antivirus, or turning off protection "temporarily".
Spreadsheets that ask you to "enable macros" or "enable editing".
Private servers or modified clients.

What to do instead

Use only the official game from an official store and, if you play on PC, an emulator from its official site.
For calculators and trackers, prefer web-based tools that never ask you to log in and never ask you to download anything.
Run a reputable antivirus (we cover this in Part 7) and keep your system updated.
If you think you installed something bad, disconnect from the internet, run a full scan, and then follow the cleanup steps in Part 11 from a different, clean device.

Scam 9: Discord, Telegram and WhatsApp DM scams

Chat platforms are where many scams are delivered. Common versions:

The helpful stranger: a friendly person joins your alliance or messages you after a fight and offers to "help" you. After days or weeks of friendly chat, they ask for something: a login, a file download, a link click.
The "verify yourself" bot: a fake bot or website asks you to verify and gives you a link or QR code. Scanning a QR code to "verify" can log an attacker into your Discord account.
The compromised friend: a friend's hacked account messages you with a link or file. It looks safe because it comes from someone you know.
The fake recruiter: an "R5 from a top alliance" invites you with a special offer and sends a link to a sign-up form.
The IP logger: a link that looks like an image or a screenshot but records your IP address when you open it.
The fake support server: a lookalike server claiming to be Lilith support, offering to fix account issues for a fee or a login.

We cover how to lock these platforms down in Part 9.

Scam 10: Migration, MGE spots and kingdom-level scams

Large events and big decisions create opportunities for scammers:

Migration helpers: someone offers to arrange your migration, sell you "passport pages" or secure a place in a kingdom for a fee. Passport requirements are set by the game, and scammers cannot shortcut them. Passports and migrations should only go through official systems. Our migration and passport guide explains the costs and options.
MGE seat sales: in some kingdoms, players pay others for reserved positions in Mightiest Governor events, or for protection from being attacked. These deals have no guarantee, and the person you pay may disappear or break the arrangement.
"Protection" fees: someone claims they can protect you from being attacked or can stop an enemy from targeting you for money. This is extortion, not protection.
Fake kingdom deals: promises of guaranteed spots in top alliances or KvK rewards in exchange for payment.

The safe rule: never send real money to anyone for in-game advantages. Genuine kingdom leaders do not charge for spots.

Scam 11: Refund and chargeback abuse

Some players buy bundles, let alliance members open the gift chests, then request a refund from the platform. This is called refund abuse or chargeback abuse. When a purchase is refunded or charged back, the publisher can remove the items from the account that made the purchase, restrict or ban that account, and in some cases the items that were already opened by other people remain in the alliance.

This is harmful because:

It damages alliance gift progress that other members rely on.
It risks your account if you ever receive items bought this way.
It makes legitimate purchases look suspicious and increases anti-fraud pressure on everyone.

Do not request a refund on a purchase you used. If you accidentally bought something by mistake, ask for a refund right away, before using it, through the official channel. If an alliance leader encourages members to buy and refund, leave that alliance.

Scam 12: The long con (relationship and trust scams)

Some of the most damaging scams involve patience rather than tricks. A scammer joins your alliance, becomes useful, becomes a friend, shares personal details, and builds trust over weeks or months. Then they:

Ask you to "lend" them resources or gems and then disappear.
Suggest swapping accounts "to help each other with events".
Introduce a trading partner who is part of the same scheme.
Collect your personal information over time to attack your accounts later.

Protect yourself by keeping a firm boundary: friendship does not change the rules. A real friend will understand when you say "I never share logins or move money, with anyone".

Scam 13: Ban-appeal and recovery scams

If your account is banned, hacked or locked, you are vulnerable. Scammers watch for this. They offer to recover your account, appeal your ban or get your items back for a fee, claiming to be "insiders", "former Lilith employees" or "special support agents".

No outside person can get an account unbanned or recover lost items. Only the publisher's support team can make those decisions, through its own channels. Any person asking for payment, a login or a verification code to help is trying to scam you a second time.

Scam 14: Fake redeem codes and code-site traps

Redeem codes are real and they are a great free resource. That is why scammers copy them. Beware of:

Sites that say they have "secret codes" and ask you to log in to claim them.
Videos that promise a "working code" but require a download or survey.
Code lists that include dozens of fake codes mixed with a few real ones, to keep you clicking and viewing ads.

Official redemption only needs your governor ID and the code (and sometimes a verification step shown within the game or the official page). It never needs your password. If a page asks for more, close it.

The Five-Second Scam Test

When in doubt, run any message, offer or file through this quick test. If any answer is "yes", stop.

Does it promise something much better than normal? (huge discount, free gems, giveaway)
Is there pressure? (a deadline, a limited number of spots, a threat)
Does it ask for a password, a code, a login or a download?
Is it taking me outside the game's official channels? (private chat, strange website, unofficial store)
Do they want payment in a way that cannot be reversed? (crypto, gift cards, bank transfer, friends-and-family)

Red flag cheat sheet

Red flag	What it usually means	What to do
"Free gems, no verification"	Survey trap, malware or login theft	Close the page. Do not enter your ID or login.
Price far below the official store	Stolen payment, non-delivery or chargeback later	Use the official store only.
"Send money first"	Pay-first scam	Walk away. Trades with strangers are not protected.
"Give me your login so I can help"	Account theft or ransom	Never. No exceptions.
"Your account will be banned unless you click here"	Phishing	Do not click. Check inside the game instead.
A file or "tool" that gives an advantage	Malware or a ban risk	Do not download it. Scan your device if you did.
A DM from "support" or "an admin"	Impersonation	Official support does not DM you for passwords. Report and block.
A QR code to "verify" yourself	Login hijack	Do not scan it.
A stranger offers to sell or buy an account	Account scam and a rules violation	Decline.
A friend suddenly sends a strange link	Hijacked account	Contact them on another channel before clicking.
"I can recover your banned account"	Second scam	Contact official support only.

Part 5: How to pay safely

Spending money on a game is a personal decision, and our spending guides explain which purchases give the best value. This section is about how to pay without exposing yourself to fraud.

Use official channels only

The in-game store processed by Apple or Google gives you built-in dispute systems and purchase history.
The official Lilith web store, reached through the in-game link (often found through the RoK Club icon), can offer extra rewards such as bonus coins on some purchases. Availability and bonuses vary by region and change over time, so check the current offers in the game.
Do not use any other website that asks for your payment details, even if it uses the game's name or logo.

Choose safer payment methods

Payment method	Protection level	Notes
Apple or Google platform payments	Good	Built-in purchase history, support and refund request systems.
Credit card	Good	Chargeback rights in many countries. Consider using a virtual or single-use card where your bank offers one.
PayPal (goods and services)	Good	Buyer protection exists, but it is not unlimited.
Debit card	Moderate	Money leaves your bank account immediately and disputes are slower.
PayPal "friends and family"	Poor	No buyer protection. Scammers love it.
Cryptocurrency, gift cards, bank transfers, wire services	None	Practically impossible to recover. Never use these with strangers.

Protect your payment details

Never type your card details into a page you reached through a message or ad.
Check bank and card statements regularly for charges you do not recognise.
Turn on transaction alerts in your banking app.
Save receipts and order confirmations in a private folder. They help if you need to prove a purchase to support.
Avoid saving cards in browsers on shared computers.

Protect younger players

If a younger player in your household plays RoK, consider using the purchase controls built into your phone: Apple Family Sharing with "Ask to Buy", or Google Play's family controls and purchase approval. Remove saved cards from the device, talk openly about scams, and make it normal to say "I clicked something weird" without punishment. The faster a mistake is reported, the less damage it does.

Be honest about spending

A safe payment is not the same as a wise payment. Our spending guides explain how to get the most from your money and why you should favour gems, sculptures and equipment over raw resources and speedups. Before you spend, decide your budget, stick to official channels, and avoid impulse buys triggered by pop-ups and countdown timers.

Part 6: VPNs explained honestly (and how to set one up)

VPNs are heavily advertised, and a lot of that advertising is exaggerated. In this section we explain what a VPN really does for a Rise of Kingdoms player, what it does not do, and how to set up two options: Surfshark (our paid partner pick) and Proton VPN (a free option that is not an affiliate).

What is a VPN?

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a server run by the VPN provider. Your traffic travels through that tunnel before it reaches the internet. This has three main effects:

Your internet provider and anyone on your local network (public Wi-Fi owners, other users of the same hotspot) cannot see which sites or services you connect to, only that you are connected to a VPN.
Websites and services see the VPN server's IP address instead of your home IP address.
Your traffic is encrypted between your device and the VPN server, which protects you from snooping on untrusted networks.

What a VPN does NOT do

This is the part most ads skip. A VPN protects the connection. It does not protect you from your own decisions or from malicious software.

A VPN helps with	A VPN does NOT help with
Encrypting your traffic on public or shared Wi-Fi	Phishing: if you type your password into a fake page, the VPN does nothing
Hiding your home IP from people you interact with online	Scams: a fake seller is still a fake seller
Stopping your ISP or network owner from seeing which sites you visit	Malware: a bad file is still a bad file (an antivirus is what helps here)
Reducing the risk of IP-based attacks such as hostile voice calls or IP-logger links	Account takeover through a reused or weak password
Keeping a consistent, private connection while travelling	Bans or rule violations: a VPN does not make rule-breaking safe
Adding a layer of privacy on streaming and browsing	Making you anonymous. Your accounts, payments and behaviour still identify you

Do you actually need a VPN to play RoK?

Honest answer: not strictly. The game itself uses encrypted connections, and other players cannot see your IP address inside the game. If you only play on a secure home network and you practise good habits, you can be perfectly safe without a VPN.

A VPN is a helpful extra layer in these situations:

You play or check your account on public or shared Wi-Fi: school, university, work, cafes, hotels, airports, trains.
You live in a shared house or building where you do not control the network.
You stream, record or join voice calls with people you do not know, where your IP could be exposed.
You are a content creator, alliance leader or kingdom organiser who may become a target for harassment.
You travel and want a consistent, protected connection.
You want privacy from your ISP about which sites, forums and communities you visit.
You use multiple devices (phone, PC, tablet, laptop) and want to cover them all with one subscription.

Will a VPN get my account banned?

Using a VPN is common and, in itself, is not the kind of behaviour that game publishers normally aim to punish. However, there are some practical points worth knowing:

Keep your location consistent. If your account logs in from your home country every day and then suddenly appears to be logging in from another continent, automated security systems may flag it or ask for extra verification. Pick one server location (ideally one near you) and stay with it for your main account.
Do not use a VPN to dodge rules. Using a VPN to evade a ban, bypass regional restrictions, hide multi-account abuse or take part in unofficial trading can make things worse.
Turn the VPN off if support asks. If you ever need to verify your identity, you may be asked to connect from your normal location.
Read the current Terms of Service. Rules can change, and the game's own terms are the final word.

What about speed and ping?

A VPN adds an extra hop, which usually means slightly higher latency. For a strategy game like RoK this is rarely a problem, but it can matter during timing-sensitive moments such as rallies, fights and teleports. To minimise any impact:

Connect to a server close to you or close to the game servers for your region.
Use the WireGuard protocol if your VPN offers it. It is generally faster than older protocols.
Try different servers in the same country if one is slow.
Use split tunnelling (when available on your device) to exclude the game from the VPN while still protecting your browsing, Discord and downloads.
On very important fight days, you can always disconnect temporarily. Just remember to reconnect afterwards.

Our paid partner pick: Surfshark

Surfshark is a popular VPN provider and the partner for this guide. We chose to work with them because their pricing is friendly for gamers on a budget, they allow you to protect an unlimited number of devices with one subscription, and their apps cover the devices that RoK players actually use: Windows, Mac, Android, iPhone and iPad, and more.

Features that matter for RoK players

Unlimited simultaneous device connections. One subscription can cover your phone, your PC, your tablet, your family's devices and your farm account device setup.
Modern encryption and the WireGuard protocol for fast, secure connections.
Kill Switch, which cuts your internet if the VPN drops, so your real IP is not accidentally exposed.
Split tunnelling (called Bypasser) on supported platforms, which lets you choose which apps use the VPN and which do not.
CleanWeb, an ad, tracker and malicious-site blocker built into the app.
Camouflage Mode and MultiHop for extra privacy when you want it.
Apps for Windows, macOS, Linux, Android, iOS, Apple TV and more, plus browser extensions and manual router setup.
A 30-day money-back guarantee, so you can test it on your own network and your own devices before committing.

Surfshark has also published independent audits of its no-logs claims in the past. As with any VPN provider, we encourage you to read the latest audit reports and privacy policy on their official website, because that is what you are really trusting when you route your traffic through someone else's servers.

Which plan do you need?

Surfshark currently sells its products in tiers. Names and contents can change, so treat this as a guide and confirm the details on their site.

Plan	What it adds	Best for
Surfshark Starter	The core VPN with unlimited devices, plus the CleanWeb ad and malicious-site blocker.	Players who mainly want a VPN and an ad blocker.
Surfshark One	Everything in Starter, plus Antivirus, breach alerts (Alert) and a private search tool.	Players who download tools, use PC or emulators, or want an all-in-one security bundle.
Surfshark One+	Everything in One, plus a personal data removal service.	Players who want to reduce how much of their personal information is sold or listed by data brokers.

Long-term plans usually cost less per month than monthly plans, but they lock in your money for longer. Because Surfshark offers a refund window, a reasonable approach is to test the VPN for the first couple of weeks on all your devices, then decide.

Protect your connection with Surfshark VPN

One subscription, unlimited devices, a kill switch, WireGuard speed and a money-back guarantee window. Start with the VPN and decide later if you want the extras.

Get Surfshark VPN

Affiliate link. We may earn a commission at no extra cost to you.

How to set up Surfshark VPN (step by step)

The apps are similar on all devices. Below are the key steps for the devices that matter most.

On a PC (Windows or Mac)

Surfshark VPN app on a PC

Surfshark VPN on desktop: pick a server, switch on protection and manage features from the sidebar.

Sign up through the Surfshark website, then download the app from Surfshark's official site or your system's official app store. Do not download VPN apps from random websites, because fake installers are common.
Install the app and log in with your Surfshark account.
Open the settings and choose the WireGuard protocol if you want maximum speed (or leave the setting on automatic).
Turn on the Kill Switch so your connection is cut if the VPN drops.
Choose a server near your real location, which keeps your ping low and your login location consistent.
Press Connect. Check that the app shows you as connected and then start the game or your emulator as usual.
Optional: enable CleanWeb to block ads, trackers and known malicious sites.
Optional: open the split-tunnelling feature (Bypasser) and add the game or emulator if you want it to bypass the VPN, while the rest of your computer stays protected.

On a phone or tablet (Android or iOS)

Surfshark VPN app on a mobile phone

Surfshark VPN on mobile: a single tap connects you, and the same account protects every device you own.

Install the Surfshark app only from the App Store or Google Play.
Open it, log in and allow the VPN configuration when your phone asks for permission. This is a normal system prompt that lets the app create the secure tunnel.
Pick a server near you and tap Connect.
Enable the Kill Switch or always-on VPN setting, where your device offers it.
If you want the VPN to turn on automatically on untrusted networks, look for the option that connects when you join unknown Wi-Fi networks.
Turn on CleanWeb to block ads, trackers and malicious sites in the apps that use it.

On Apple TV and other devices

Surfshark VPN on Apple TV

Surfshark VPN on Apple TV. One account, unlimited devices.

Rise of Kingdoms itself does not run on Apple TV, but this screenshot shows an important benefit: because Surfshark allows unlimited devices, one subscription can also protect the rest of your household, including the TV you use to watch RoK streams and guides, family laptops and tablets, and your other gaming devices.

Install the Surfshark app on the Apple TV from its App Store.
Sign in using the on-screen instructions.
Choose a server and connect.
For consoles or smart devices that cannot run a VPN app, you can protect them by setting up the VPN on a compatible router, although that is an advanced step and may reduce speed.

Recommended Surfshark settings for RoK players

Protocol: WireGuard or automatic
Kill Switch: on
Server: a stable location near you, the same one every day for your main account
CleanWeb: on, for ad, tracker and malicious-site blocking
Auto-connect on untrusted Wi-Fi: on
Split tunnelling: only if you notice game lag and your device supports it
Breach alerts or Alert (on plans that include it): on, with your main email added

A free option: Proton VPN

Proton VPN is a well-known provider from the Swiss company behind Proton Mail. It has a free plan, which is why we include it in this guide for players who cannot or do not want to pay for a VPN yet.

Not an affiliate (yet)

We are currently not an affiliate partner for Proton VPN, so there is no commission link here. We are waiting on a possible partnership for its paid plans. If that happens, we will clearly mark those links and update this disclosure. You can find the official website at protonvpn.com.

What the free plan offers

No ads and no data cap on the free plan, which is unusual for free VPNs.
A strict no-logs policy, open-source apps and a history of independent audits.
Modern encryption and a kill switch on supported platforms.

The trade-offs of the free plan

One device at a time, so it will not cover your whole household.
A limited set of server countries, and the app may choose the server for you. The list changes, so check the current details on their page.
Medium speed, because paying users get higher priority on the network.
Free users do not get the paid extras: streaming-focused servers, P2P support on some plans, the ad and malware blocker NetShield, or multi-hop routing.

Who should choose Proton VPN Free?

It is a good fit for players who mainly want to protect their phone or one PC on public Wi-Fi, who want something reputable at zero cost, and who do not need to cover several devices at once. If you want multiple devices, more locations, higher speed and extras such as ad blocking, a paid plan from any reputable provider is the better choice.

Quick setup for Proton VPN Free

Create a free Proton account on the official website.
Download the Proton VPN app from the official website or your device's official app store.
Sign in, then press Quick Connect to join a free server.
Enable the kill switch or always-on VPN setting where available.
Remember that on the free plan, you may get a server in a different country from your own. For your main RoK account, consider disconnecting while you play and using the VPN only on untrusted networks, so your login location stays consistent.

Warning: most random free VPNs are not safe

Typing "free VPN" into an app store brings up a lot of results, and many of them are risky. Running a VPN costs real money, so if the product is free and the company is not clearly funded some other way, you may be the product. Over the years, researchers have found free VPN apps that:

Log and sell browsing data.
Inject ads or trackers.
Contain weak or broken encryption.
Include malware or excessive permissions.
Run unclear ownership structures and have no meaningful privacy policy.

Because a VPN can see all your traffic, choosing a bad one is worse than not using one at all.

How to judge any VPN (quick checklist)

A clear, readable no-logs policy and a history of independent audits
A known company with a real address, a real support team and a clear business model
Modern protocols (WireGuard or similar) and a kill switch
Apps from official stores with a long history and plenty of genuine reviews
A money-back guarantee or a free tier so you can test it
No unusual permission requests on your phone
Transparent pricing, with no hidden auto-renew traps (read the renewal price)

Part 7: Antivirus and ad blocking for gamers

Do you need antivirus?

Modern systems already include decent built-in protection: Microsoft Defender on Windows, Google Play Protect on Android, and strong app review on iOS. If you only install apps from official stores, update your devices and avoid unknown files, those built-in tools do a solid job.

A dedicated antivirus becomes a smart extra layer when:

You play on PC through the official client or an emulator and download a lot of files.
You often visit guide sites, forums, download pages and Discord servers, where malicious links and files are common.
You share a computer with family members who may click things they should not.
You are a creator, alliance leader or organiser who receives attachments from strangers.
You want real-time protection, web protection and scheduled scans in one place alongside your VPN.

An antivirus protects against malicious files and websites. It does not protect against being talked into giving away a password. Think of it as a seatbelt: it helps when something goes wrong, but it does not drive the car for you.

Surfshark Antivirus

Surfshark offers an antivirus product, included in its higher-tier bundle (Surfshark One) and available through the partner link below. It is designed to catch malware and risky downloads, which makes it particularly relevant for the fake-tool and mod scams described in Part 4.

What it is designed to do

Real-time protection that scans files as you open or download them.
Scans on demand (quick and full) to check your device for threats.
Web protection that warns you about known dangerous sites.
On desktop, extra protection such as webcam protection, where supported.
Integration with the same account and app you use for the VPN, so your security tools live in one place.

Platform support and exact features differ between desktop and mobile, so check Surfshark's site for what is included on your device.

On a PC

Surfshark Antivirus on a PC

Surfshark Antivirus on desktop: run a scan, check protection status and manage settings in one place.

Download the Surfshark app from the official website and log in with your account (the antivirus requires a plan that includes it).
Open the Antivirus section and run a full scan once to get a baseline.
Turn on real-time protection.
Schedule regular scans, such as weekly, for a time when you are not playing.
If you use an emulator, make sure the emulator's folders are scanned, and never disable your protection "to make something install".

On a phone

Surfshark Antivirus on a mobile phone

Surfshark Antivirus on mobile: scan your apps and files and review any warnings.

Install the app from the official app store and sign in.
Open the antivirus feature and run a scan of your installed apps and files.
Review anything it flags. If it flags an app you did not intentionally install, uninstall it and change your passwords.
Keep your operating system and the app updated so the protection stays current.

Add real-time protection with Surfshark Antivirus

Catch malicious downloads before they run. A good extra layer against fake RoK tools, mods and infected files.

Get Surfshark Antivirus

Affiliate link. We may earn a commission at no extra cost to you.

Ad blocking: the underrated security tool

Ad blockers are usually seen as a comfort feature, but they are also a security feature. Many scams in this guide are delivered through ads: "free gems" banners, fake download buttons, fake giveaway pop-ups and look-alike pages shown in search results or on shady sites. This is called malvertising, and it can reach you even on websites you normally trust.

What an ad blocker does for you

Removes many ads and pop-ups, including the "your device is infected" style banners.
Blocks trackers that follow you across websites and build a profile of you.
Can block known malicious or phishing domains, depending on the product.
Makes pages load faster and keeps guide sites readable.
Reduces the number of bad links you can accidentally click on.

What it cannot do

It does not catch every malicious ad or page.
It does not protect you from scams delivered by private message.
Some sites rely on ads to survive, so consider allowing ads on creators and guide sites you want to support, while keeping the blocker on for unknown sites.

Block ads, trackers and risky pages with Surfshark's ad blocker

A cleaner, safer browsing experience for guides, forums and event pages, with fewer fake "free gems" banners in your way.

Get Surfshark Ad Blocker

Affiliate link. We may earn a commission at no extra cost to you.

Free alternatives

If you do not want to pay, there are reputable free options. uBlock Origin is a widely used open-source ad blocker for desktop browsers (on some browsers a lighter version may be what is available, because of browser rule changes). Many browsers also have built-in tracker and pop-up protection. Only install extensions from the official browser store, and check the developer name, because fake ad blockers exist.

How the tools fit together

Layer	What it protects	Where it falls short
Good habits	Almost everything	Humans make mistakes when tired or rushed
2FA and password manager	Account logins	Does not stop you from approving a prompt you were tricked into
VPN	Your connection and home IP	Does not stop scams, phishing or malware
Antivirus	Your device from malicious files	Does not stop social engineering
Ad blocker	Malicious ads and trackers	Does not catch everything and does not cover private messages
Official-channels-only rule	Payments, accounts and trades	Needs discipline when someone offers a "deal"

No single tool does it all. The real power comes from combining them, and from using the habits in this guide to cover the gaps.

Part 8: Wi-Fi, router and network safety

Public Wi-Fi rules

Prefer your mobile data over unknown Wi-Fi when you need to log in to anything important.
Verify the network name with staff. Attackers create fake hotspots with names like "Free Airport WiFi" to catch traffic.
Avoid sensitive actions such as password changes, payments and email logins on shared networks, unless you are on a VPN.
Turn off auto-join for open networks, so your phone does not connect to hotspots on its own.
Forget the network after you leave.
Do not click through certificate warnings. If your browser warns you that a connection is not private, stop.

Home router basics

Your home router is the gatekeeper for every device on your network. A few small changes make a big difference:

Change the default admin password on the router itself. Default passwords are well known.
Change the Wi-Fi name and password to something unique and long. Use WPA2 or WPA3 security, never WEP or open.
Update the router firmware regularly, or turn on automatic updates if available.
Turn off WPS (the push-button setup feature), which has known weaknesses.
Use a guest network for visitors and for smart devices, so they cannot reach your main devices.
Turn off remote administration unless you truly need it.
If you are not sure how to do these, search for your router model in its official support pages or ask your internet provider.

School, work and shared networks

Networks run by schools or employers may monitor or block traffic, and VPN use may be against their rules. Respect those policies. If you are unsure whether you can play or use a VPN there, ask the network administrator. Do not log in to your main accounts on managed computers that you do not own.

Avoid IP exposure

Do not click unknown links, even in messages that look like screenshots, images or videos.
Be careful about joining voice calls with unknown people.
If you stream, consider using a VPN so your home address is not shown to everyone watching, and keep your location settings private.
If you ever suspect someone is trying to attack your connection, restart your router (your internet provider may give you a new IP address) and report the harassment.

Part 9: Discord, Telegram, alliance and kingdom safety

RoK is a social game. Alliances, kingdoms and creator communities organise themselves on chat platforms, and that is where many scams begin. This section helps you enjoy the community without becoming a target.

Lock down your Discord account

Turn on two-factor authentication for your Discord account.
In privacy settings, limit who can send you direct messages. Disable DMs from server members by default and allow them only where you need them.
Restrict who can send you friend requests, for example to friends of friends or to nobody.
Never scan a QR code to "verify" yourself or to log in somewhere unless you generated it yourself on your own device.
Do not click links or open files from strangers, and be careful with files from friends too, because their accounts can be hijacked.
Review which apps and bots have access to your account and remove those you do not use.
Right-click a user and check their account creation date and the servers you share before trusting a new "admin" or "support" account.
If your account sends strange messages, change your password immediately, log out of all devices and tell your friends.

Telegram and WhatsApp

Keep your phone number private in profile settings.
Limit who can add you to groups, because scam groups are common.
Turn on two-step verification, which asks for an extra password when logging in.
Never forward verification codes. Scammers often say they sent a code "by mistake" and ask you to send it back. That code is for logging into your account.
Mute and leave groups that promise gems, accounts, resources or "investment" opportunities.

Safety for alliance leaders (R4 and R5)

Leaders carry extra risk because attackers want access to trust and to shared assets. If you are an officer or a leader:

Use 2FA and a password manager on your email, Discord and game login
Give titles and permissions only to people you know well, and review them regularly
Never give a recruit or a "helper" control of your alliance or its Discord
Require new Discord members to pass a verification step and keep link and file posting restricted for new accounts
Give bots the minimum permissions they need, and do not add unknown bots
Require 2FA for moderators (Discord has a server setting for this)
Pin a message that says: "Staff will never ask for your password or code and will never DM you for payment"
Have a plan for what happens if a leader's account is compromised, including a second trusted officer who can take action
Do not run or promote "resource sales", "account sales" or paid services in your alliance

Safety at the kingdom level

Check that announcements from kingdom leaders come from verified accounts or official channels.
Be suspicious of last-minute changes of rules, links or payment instructions, especially around KvK, MGE or migration.
Do not pay anyone for protection, spots or promises of safety. Real leaders do not charge for those.
Keep a list of trusted people who can confirm whether someone really is who they claim to be.

Harassment, threats and blackmail

Competitive games can get heated. Occasionally, drama crosses a line into threats: "I will get you banned", "I will leak your details", "pay me or I will report your farm accounts".

Do not pay. Payment almost never ends the problem. It tells the person that pressure works.
Do not reveal personal information in anger or to make a point.
Save evidence. Take screenshots with names, IDs, dates and links.
Block and report the person on the platform where it happened.
Tell a trusted friend, family member or alliance leader. Isolation is what harassers rely on.
If you are ever threatened with real-world harm, or if personal information such as your address has been shared, contact your local authorities.

Protect your identity

Use a nickname that is not your real name.
Use a separate email for games and communities, not the one tied to your bank or your job.
Avoid posting your real location, school, workplace or photos that show identifying details.
If you are a younger player, never share personal information, photos or your location with people you only know from the game, and talk to a parent, guardian or trusted adult if anyone makes you uncomfortable or asks for secrets.

Part 10: Farm accounts and multiple accounts

Many players run farm accounts to generate resources, and our farming guides recommend that for good reason. Multiple accounts are normal. They simply need a bit more security discipline.

Separate everything

One email per account, where practical. Using a different email for each farm account stops a single compromised inbox from exposing everything.
A unique password for every account, saved in a password manager.
2FA on every email that is linked to a game account.
Clear labels in your password manager so you always know which account is which.

Never hand over farm accounts

Do not give a farm account login to an alliance mate "to help with an event".
Do not sell farm accounts, even to people you know. It breaks the rules and creates recovery-scam risk.
Do not let someone "hold" your farm account for a while.
If a farm account is no longer useful, let it go or retire it, rather than selling it.

Move resources the safe way

Use the game's own systems, such as the Trading Post and alliance transport, to move resources from farm accounts to your main account, and remember the transport tax and capacity limits. Never replace this with off-game trades or payments.

Keep your pattern clean

Avoid logging into many accounts from public Wi-Fi.
Use a consistent connection and, if you use a VPN, a consistent server location for each account.
Do not use farm accounts to receive or pass along purchased items or resources from outside sources.
Remember our rule from the farming guide: farm accounts should not drain the fun out of the game. If maintaining security for several accounts becomes a chore, simplify.

Part 11: What to do if you have been scammed or hacked

It happens to careful people, including experienced players and even security professionals. What matters is how fast you act. Work through these steps calmly, and do them from a clean device if you think malware might be involved.

The first hour

Stop talking to the scammer. Do not argue, threaten or send more money.
Secure your email first. Change its password and make sure 2FA is on. Email is the key to every other reset.
Change the passwords of the accounts your game is linked to (Google, Apple, Facebook, Lilith account) and any account that used the same password.
Sign out of all devices and sessions on those accounts, and revoke access for any apps or integrations you do not recognise.
Turn on 2FA wherever it was missing.
Scan your device with a reputable antivirus if you installed or opened anything suspicious.
Take screenshots of the chats, profiles, links, payment confirmations and anything else that shows what happened. Do this before the scammer deletes messages.

If you entered your password on a fake page

Change that password immediately on the real site and everywhere you reused it.
Sign out of all sessions and enable 2FA.
Check recent activity and linked devices on the affected account.
Watch for password-reset emails you did not request.

If you installed a file or a "tool"

Disconnect from the internet.
Run a full antivirus scan.
From a different, clean device, change your passwords and sign out of all sessions, because stolen sessions can bypass 2FA.
If the scan finds nothing but you are still worried, back up your important files and consider resetting the device.

If your game account has been taken over

Contact the game's official support as soon as possible through the in-game support menu or the official support site.
Provide everything that helps prove you are the owner: your governor ID, kingdom, alliance, the email or login method linked to the account, approximate creation date, last login date, recent purchases and receipts, and screenshots of the account before the incident if you have them.
Explain clearly what happened, with a timeline.
Be patient, honest and polite. Support teams handle many cases, and being clear helps them.
Do not pay anyone who claims they can recover the account faster.

Be aware that if you voluntarily handed over your login, shared codes or traded outside the rules, support may be limited in what it can do. That does not mean you should not ask, but it is another reason prevention matters.

If you paid a scammer

Contact your bank, card issuer or payment provider immediately and ask about a dispute or chargeback. Time limits apply.
If you paid through Apple or Google, use their purchase problem and refund request options.
If you paid by crypto or gift card, report it anyway to the platform and to the authorities, but understand that recovery is unlikely.
Watch your statements for further charges, and consider replacing the card if you shared its details.

Report it

Report the account on the platform where it happened (Discord, Telegram, YouTube, Facebook and so on).
Report fraud to the authorities. In the United States, you can use reportfraud.ftc.gov or ic3.gov. Other countries have their own fraud reporting services, so search for yours.
Warn your alliance and kingdom without exposing private information, so others do not fall for the same trick.

Do not fall for the second scam

After a first scam, victims often receive messages from "recovery experts" who promise to get everything back for a fee. Treat them as a second wave of the same fraud. Genuine help comes from the platform, your bank and the authorities, and it does not ask for upfront payment or your login.

There is no shame in being scammed

Scammers are professionals who run these tricks daily. If you were fooled, you are in very large company. Report it quickly, learn from it and move on. The players who recover best are the ones who tell people early.

Part 12: Checklists, routines and FAQ

The 30-minute security setup

If you do nothing else after reading this guide, do this. It takes about half an hour and covers the most important things.

Minutes 1-5: Install a password manager and add your email account to it.
Minutes 5-10: Change your email password to a new, unique, long one, and turn on 2FA with an authenticator app.
Minutes 10-15: Secure the Google, Apple or Facebook account linked to your game the same way.
Minutes 15-18: In the game, check that your account is bound to a login that you control.
Minutes 18-22: Check your email at haveibeenpwned.com and change any reused passwords it flags.
Minutes 22-26: Lock down Discord (2FA, DM settings, friend request settings).
Minutes 26-30: Update your phone or PC, remove apps you do not use and install a VPN, antivirus and ad blocker if you want those extra layers.

Weekly and monthly routine

How often	What to do
Every time	Run the Five-Second Scam Test on any offer, link, file or request for information.
Weekly	Update your devices and apps. Review bank and card statements. Run an antivirus scan if you use one.
Monthly	Review linked apps, active sessions and installed apps. Check your email at haveibeenpwned.com. Review Discord and alliance permissions if you are a leader.
Every 3 to 6 months	Check that your recovery options (backup codes, secondary email, authenticator device) are still working and up to date.
After any suspicious event	Change passwords, sign out of all sessions and scan your device immediately.

Before you click or pay

Did this come from inside the game or from a verified official source?
Is the price normal compared to the official store?
Am I being rushed?
Does it ask for a password, a code, a login or a download?
Can I pay in a way that offers protection?
If I am wrong, could I lose my account? If so, stop.

Do and don't summary

Do	Don't
Use unique passwords with a password manager	Reuse the same password across email, Discord and games
Turn on 2FA, preferably with an app or key	Rely on SMS codes alone for high-value accounts
Buy through official stores	Buy discounted gems, resources or accounts from strangers
Report scams and warn your alliance	Argue with scammers or pay "recovery agents"
Download only official apps and tools	Install mods, hacks, bots or unknown files
Use a VPN on public Wi-Fi	Assume a VPN makes you immune to scams
Keep a consistent login location	Hop between countries on your main account
Verify leaders and staff on a second channel	Trust a name or profile picture on its own

Frequently asked questions

Can someone steal my account with just my governor ID?

No. A governor ID is used for finding and inviting players, not for logging in. It is still worth being cautious with people who contact you using it, because it helps scammers sound personal.

Is it safe to buy gems from cheaper websites?

We strongly advise against it. Many such sites rely on stolen payment methods, non-delivery or login theft, and chargebacks can lead to items being removed and accounts being restricted. The in-game store and the official Lilith web store are the safe options.

An R5 or officer asked for my login to "help" with an event. Should I give it?

No. A real leader will not ask for your login. If it really is your leader, they will understand when you say no. If it is not, you just avoided a scam. Verify through another channel either way.

Will Lilith ban me for using a VPN?

Using a VPN on its own is common and is not typically the target of enforcement, but behaviour that looks suspicious, such as constant location changes, evading bans, or unofficial trading, can cause problems. Keep your location consistent, and check the current Terms of Service.

Does a VPN lower my ping?

Usually not. A VPN adds a hop, so latency normally goes up slightly. In some cases a VPN can improve routing, but you should not expect it. Choose a nearby server and try WireGuard to keep the impact small.

Can a VPN protect me from scammers?

No. A VPN protects your connection, not your decisions. Scams, phishing and malware work the same way with or without a VPN.

Can a VPN stop DDoS attacks?

It can hide your home IP address from people who do not have it yet, which makes targeted attacks harder. It is not a guarantee. In RoK, attacks against players' home connections are uncommon, and your biggest risks are still scams and stolen logins.

Is a free VPN safe?

Some are, but many are not. Stick to reputable providers with clear no-logs policies and open audits, such as Proton VPN's free plan, and avoid unknown free VPN apps that run on ads or sell data.

Do I need Surfshark specifically?

No. Any reputable VPN will do the basic job. We partnered with Surfshark because of its unlimited devices, bundled security tools and money-back window, and because it fits budget-conscious gamers. The money-back window lets you test it yourself.

Is antivirus really necessary if I only play on my phone?

Not always. If you install apps only from official stores, keep your phone updated and do not sideload files, built-in protections do a lot. Antivirus becomes more valuable on PC, on Android devices where you install from several sources, and for anyone who downloads files from guides, forums and chats.

Are online RoK calculators and trackers safe?

Web-based tools can be fine, as long as they do not ask for your login and do not ask you to download anything. Be very careful with downloadable apps, spreadsheets with macros and anything that wants permissions it should not need.

Is it safe to use an emulator on PC?

It can be, if you download it from the emulator's official website and keep your system updated. Fake emulator download pages and bundled adware are common, so avoid unofficial mirrors.

What if I already bought gems or resources from a third party?

Stop doing it, do not give them more information, and secure your account. Change your passwords, check that no login details were shared, and monitor your account and payment statements. We cannot say what action a publisher may take, but stopping and securing your account is the best next step.

How do I know if a message from "Lilith" is real?

Do not trust the message on its own. Open the game or the official site yourself and check support messages there. Official support does not need your password or a verification code.

I am under 18. What is the most important thing for me to know?

Never share your login, codes, real name, address or photos with people you only know from the game, and never buy anything without a parent or guardian knowing. If something feels strange, tell a trusted adult. You will not be in trouble for asking.

Final words and your toolkit

Staying safe in Rise of Kingdoms is not about being paranoid. It is about having a few firm rules, a few reliable tools and the habit of slowing down whenever someone asks for something unusual. Scammers need you to rush, to trust a stranger and to hand over something you should keep. Break any one of those three and most scams fall apart.

To recap, the best protection is:

Secure the logins behind your game: a strong unique password, a password manager and 2FA.
Use official channels for everything you buy and redeem.
Never share passwords, codes or logins, and never trade accounts, gems or resources with strangers.
Be careful with downloads, DMs and links, and run the Five-Second Scam Test.
Add layers where they make sense: VPN on public networks, antivirus on PC, an ad blocker for browsing.
Know your plan for the day something goes wrong.

Your RoK security toolkit

If you decide to add extra layers, these are the Surfshark products covered in this guide. You can start with just the VPN and add the others later.

Surfshark VPN Surfshark Antivirus Surfshark Ad Blocker

Affiliate links. We may earn a commission at no extra cost to you. Looking for a free option? Try the free plan of Proton VPN (not an affiliate link).

Disclaimer

This guide is for general information and education. It is not legal, financial or professional security advice. Game rules, store features, menu names, VPN features and prices change, so always check the game's current Terms of Service, official support pages and the providers' own websites before making decisions. The Roknut Academy is not affiliated with Lilith Games. Rise of Kingdoms is a trademark of its respective owner.

Stay safe, stay sharp, and see you on the battlefield.
— The Roknut Academy