Scamming, Phishing, and hacking, Oh My!

[Brian]

This morning, on my routine spam-check, I found another e-mail from Blizzard.  Looks like they caught me trying to sell my Diablo III account, according to the subject line.  The body informs me it's actually my World of Warcraft account(s).

This is probably about the 50th time I've been caught trying to sell something I don't own.

Now, we all know these are phishing schemes, and evidently since e-mailing it out is pretty much free, the cost of investment vs. the return that the scheme generates has to be worthwhile.  I mean, getting a single 'hit' is probably worth spamming everyone e-mail address you can find.  There is the question of how they know to target me for WoW-related scams, so I can only guess some WoW-based forum I joined years ago sold my e-mail address ... but then again, they're wrong about me owning DIII, and my WoW account has been inactive for about 2 years (one month where I couldn't get back into the game notwithstanding).  Maybe they're just grabbing every e-mail they can find.

I can't speak for other games, but I know it took a little while for the scams to start showing up in WoW.  I'd say a month or two, at least.  And once the gold-sellers and scammers (frequently the same people) set to work, it just became a constant background thing.  Once an account was compromised, the hacker/scammer would typically sell everything a player owned and send the money over to another mule, to sell all of that wealth to another player, and the cycle repeats.  From what I recall 'power-leveling services' were another good way to scam people.  Take someone's money, _and_ they give you a username/password to log into their account with.

I bought Guild Wars 2 recently, and saw they were selling gold during the three-day headstart event for pre-purchasing.  I've not played DIII, but I understand that gold farming is a huge thing there, too, and let's not even get into how easy the RMAH makes it for scammers to extract money from the game.

For example: http://www.justd3.com/diablo-3-botters-and-gold-farmers-are-not-what-you-think.html

So ... how on earth have we let this happen?  How has our digital playground gotten so filled with shady dealers looking to entice us into dark alleys?  I suppose that as long as there's money to be made, someone's going to be willing to do it.  Maybe the better question is ... how can we get rid of them?  Or so long as there are players willing to gamble their account security to buy something they haven't earned in game ... can we?


Edit: One approach that occurred to me after posting.  What's probably best is to have the game provider themselves sell the same things that a scammer would offer -- there's a safer, legitimate way to get X, and they'd be more motivated to go after scammers/hackers then they already are.  It moves their gray market from an unwanted parasite to direct competition in what should be a completely monopolized market.

This does raise questions of how to deal with that for players that don't want to participate with people able to spend money to skip processes, and could result in providers doing more to monetize things (or otherwise add incentives to cash exchanges), but those are probably issues that could be overcome.

[thepanda]

You can't be rid of it. A market exists; people will find a way to exploit it.

If they ban selling gold people will sell it off site. If they don't people will sell it in game. If they mess with the system to make it harder to farm (cool down times like some tried with exp maybe?) you end up punishing the people who don't farm/whatever by forcing the game to be even more grind-y than it already was. No one wants their MMO any more grind-y than it already is.

[Brian]

I stand by the idea that the producers monetizing the 'product' and undercutting 'alternate' vendors would put the market in a better-controlled sector.

Sure, the same actions are going on, but now they're not coupled with your account being hacked/stolen/banned.

[thepanda]

I stand by the idea that the producers monetizing the 'product' and undercutting 'alternate' vendors would put the market in a better-controlled sector.

Sure, the same actions are going on, but now they're not coupled with your account being hacked/stolen/banned.

Gold farming is bad because it breaks the game's economy. If the producers sell gold in any significant amount the same thing happens. You still lose in the end.

As far as password hacks and whatnot all I can think of is don't buy in the first place. I know people say they buy because they don't have a lot of time to play and don't want to miss out on high level adventuring. I sympathize, but sometimes you have to admit you don't have the time to play the time-sinks that are MMOs.

On a related note, doesn't guild wars 2 bump everyone up to level 80 for pvp? I guess that's one way to let people have their cake and eat it too.

[Brian]

Except, Guild Wars 2 does sell gold in-game.

And yeah, it does technically level everyone to 80 for PvP.  Traits and skills scale, but aren't unlocked by the bonus you get.  Gear doesn't, either, at least for WvWvW, so you'll still get two-shotted by someone in 80 gear if you're wearing gear lower than level 70, and can maybe do 20% of their health in two of your own shots with your not-high-enough-level weapon.

But you can sometimes inflict status ailments, or run into someone with even lower level gear, so there's that.

[Merc]

You can't really get rid of that market, even with the controlled gold buying through the MMO producer. GW2 has it's gemstore, TERA has chronoscrolls, various other games have other means of buying gold in-game.

Doesn't matter.

The gold sellers will almost always sell gold cheaper than the official trade, and people somehow think the trade is worth the risk that comes with it. Hell...Some people might even buy gold simply because they want stuff from the gemstore, and they find that buying the gold seller's cheap gold and trading -that- for gems is cheaper than them outright buying gems to get their extra character slots/bank space/whatever.

And as long as people still buy their gold, they'll keep trying to phish and scam for account information so they can steal someone else's gold.

It's unfortunately something we simply have to live with until there's a better way to catch people than just hitting a report button.

[Brian]

Even if you're willing to secretly spy on your users, there's no guarantee you can crack down on the illicit market, it seems:

http://games.slashdot.org/story/12/09/11/149228/activision-blizzard-secretly-watermarking-world-of-warcraft-users

[Kt3]

Diablo 3 botting was ridiculously profitable.  I mean ridiculously profitable.

First week D3 came out, prices were around $40 (us dollars that is) per 1m gold.  Second week it got slashed to $20, but that's still a lot of money if you have even just one person, one account, selling their gold.  If you multiply that effect, you could easily have earned thousands that second week.

And people did indeed earn thousands.  They also lost thousands constantly to the myriad scammers that also populate the gold selling scene, who claimed they were interested in buying and then just took the gold without following up on a Paypal payment.  It's not like the other guy could complain, as what they were both doing were illegal.

It's actually a very interesting subset of gaming to me.

[Jason_Miao]

It's actually a very interesting subset of gaming to me.

I'm pretty sure I've posted this paper before, and if you've been following this topic, you've likely already read it.  But on the off chance that neither is true: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=294828

Remember that the GNP estimates were back in 2001 - Online gaming had become more popular since then.