The fake 'DEV Support' scam is back, and now it wants your card balance (a living list of every scam hitting dev.to)

This is a living post. Every time a new scam targets dev.to writers, I add it to the tracker with the date, the lure, the link and what it steals. Bookmark it, and if one lands on your post, drop it in the comments and I'll add it.

Last updated: 11 Oct 2026

Two weeks ago I wrote about a fake "DEV Support" account that comments on new posts and tries to steal your login.

It's back. Same trick, same type of link, but it no longer wants your password. It wants your bank card, and your exact card balance.

It landed on my post within minutes of publishing. So I followed it, all the way to the end, with a test card number and a fake name, never real details. Here's every screen, why each one exists, and how to spot the whole thing in five seconds.

Step 1: the comment

Official Platform Update
Security protocols have been updated for all developer accounts.

• tr.ee/dev-to

What's going on here:

• The name is "DEV SUPPORTS", with an S on the end and a DEV-logo avatar. Real staff don't comment on your post from a lookalike account.
• The text is deliberately vague. "Security protocols have been updated" means nothing, so you click to find out what it means.
• There's no deadline this time. The first wave said "12 hours or lose access". This one bets on curiosity instead of panic. It's a small change, but it slips past people who learned the first one.
• The link is a shortener. tr[.]ee is Linktree's link shortener. I checked where it goes without opening it: it redirects straight to offerup-pay[.]top/4K7C5I3P1K8. That's not dev.to. It's not even a dev.to-shaped name.
• One like. Someone liked the scam comment within minutes, which makes it look legitimate. That's almost certainly the scammers' own account.

Step 2: a "human check" that blocks scanners, not bots

The link opens a "Verify you are human" slider. Under it is a big paragraph of legal-sounding text forbidding "AI, large language models, web crawlers, bots" from accessing the page.

That's the tell. A real site puts a human check in front of a signup to stop bots. A scam puts one in front of the scam to stop scanners. Phishing pages die when Google Safe Browsing, security companies' crawlers or an AI assistant you asked "is this safe?" can read them. The slider keeps the automated checkers out, so the page stays alive longer. The anti-AI text is there to scare off the people running those tools, and maybe to make an AI tool refuse to look.

If a "verify you're human" screen shows up right after clicking a link from a stranger, it isn't protecting you. It's protecting them.

Step 3: "Mandatory Verification Of User #17984"

Now it gets specific:

Your account is temporarily restricted. You need to verify your identity to remove all the restrictions. You need to confirm your details within 24 hours.

Here's the deadline the comment didn't have. Next to it, a "Support Chat: Online, Happy to help" window pops up:

Please click on the button to start the verification process… You will need to enter your card details to verify them and subsequently receive your payment.

Read that again: receive your payment. DEV has never paid you for anything, but the script was written for a marketplace, where "verify your card to receive the buyer's payment" makes sense. That's where the domain name comes from: offerup-pay is named after the OfferUp marketplace. This is a ready-made payment-scam kit, built to impersonate marketplaces, with the DEV logo pasted on.

Step 4: pick a card

Visa, Mastercard, Maestro, Diners Club, PayPal, Google Pay, and a big black Verify → button with the status "Waiting for verification".

DEV is a free blogging platform. There is no reason, ever, for it to need a payment method to "verify" you. The moment a "platform" asks for a card to prove who you are, you're done; close the tab.

Step 5: the card form asks for your balance

Card number, expiry, CVV, full name, and then the field that gives the whole game away: Card balance.

The chat explains:

You must enter the actual balance of your bank card… so that your bank and our system can verify and identify the bank card and its owner…

No bank, payment provider or website has ever needed you to type your balance. The scammers want it so they know how much to take, and whether you're worth working on. The small print even pretends you're "connecting your account to Square API", to borrow a real company's name for credibility.

Then comes a spinner:

Don't close the page. The bank is processing your data. This may take some time.

…and a chat message saying "do not leave this page until you receive instructions, otherwise the verification will have to start over." Nothing is being processed. The scammers are keeping you on the page while they use your card. In scams built on this pattern, the next "instruction" is usually to type in the one-time code your bank just texted you, "to confirm the verification". That code is your bank asking you to approve their payment.

The 5-second checklist

One rule covers all of it: DEV will never contact you in a comment, never send you off-site to "verify", and never ask for a card, a balance or a code. If something about your account is real, it'll be inside your account when you type dev.to yourself.

If you entered your card

Do this now, in this order:

1. Call your bank using the number on the back of your card (not any number from the chat). Ask them to block the card and issue a new one.
2. Don't type in any code your bank texts you after this, and never read one out in a chat. Codes approve payments.
3. Check your recent transactions and dispute anything you don't recognise. Banks have chargeback processes for fraud, and speed matters.
4. If you shared PayPal or Google Pay details, change that password and remove unknown devices.
5. Report it to your national cybercrime reporting service (in India, call 1930 or file at cybercrime.gov.in), and keep screenshots of the chat.

If you only clicked

Close the tab. Clicking alone doesn't give them your card. Then:

• Report the comment: ⋯ on the comment → Report abuse. Then delete it from your post so your readers don't fall for it.
• Report the link: to Linktree (they own tr.ee) and to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish/). The site sits behind Cloudflare, which takes phishing reports at abuse.cloudflare.com.
• Turn on two-factor authentication for your DEV account (Settings → Account), if you haven't already.

The tracker

I'll keep adding to this table. Newest first. Links are deliberately broken ([.]) so nobody clicks them by accident.

Spotted a new one? Comment with the date, the exact wording, and the link with dots replaced by [.]. Screenshots help. I'll verify it and add it here.

Update log

• 11 Oct 2026: post created. Added the "Official Platform Update" card-theft wave, plus the 28 Sep login-theft wave.

The scary part isn't that the scam exists. It's how quickly it's evolving: two weeks ago it wanted your password and panicked you with a deadline. Now it wants your card, gets in on curiosity, and hides from the tools built to catch it.

Has a fake "support" comment landed on your posts? What did it say, and how fast did it arrive? Post it below so others can recognise it, and report every one you see.

Follow me here. I write about security and the honest ways things break, and I'll keep this list updated.