A rapid chargeback after a transaction for digital goods is the #1 sign of fraud in ecommerce. It's particularly obvious in a game that allows RMT for items that can be traded in-game or for in-game currency--you use $ to buy in-game currency and items, quickly transfer them to another account (a collaborator, an alt, anything), then demand a chargeback. If you're a scammer running an unauthorized RMT site, you can set up bots to do this and make the purchases, transfer items to an alt account, then demand chargebacks, and rapidly accrue large amounts of valuable items before the inevitable banhammer. If the game has a player item exchange, as most do, it's also scarily easy to bot the exchange as a transfer mechanism which might be harder to track.
The banhammer falls on the scammer's main account, but they don't care because it's a throwaway and they have a thousand more waiting in the wings to activate, and they got what they wanted on their alt or collaborator's account so they can sell that item at cut-rate prices on their shady website (and maybe get a new set of card details to abuse on the bargain, but that's icing on the cake, the money here is selling to greedy players, not stealing credit cards). They got the digital good, they get the money back (and the game company's only viable response is to drop the banhammer), and they make a profit selling to some fool who goes on a shady website to buy a valuable in-game item.
These guys don't need to hack accounts because their method relies on spamming transactions and quickly shuffling items off into an untraceable sea of in-game transfers and transactions before their initial account gets banned, and they have an endless sea of gibberish-named accounts both to spam this fraud and to advertise their shady sites.
This is why it's industry standard to ban for chargebacks and to take claims of "my account was hacked" with a gigantic chunk of salt, because it's far easier to just use a throwaway card and a throwaway account you made with a bot to do this than it is to go to the effort of compromising someone's account and getting their CVC to perform fraudulent transactions.
So, please forgive me if I am extremely suspicious of this "my friend was hacked" anecdote. It reeks of ragebait, sympathy-bait, and sussy behavior.
