Legitimate product keys are obtained through two primary channels:
Here is the kicker:
When a user inputs a product key: