Hacked Account Banned After $1,400 in Fraudulent Charges — Looking for Advice

[mikarddo]

Please consider that the company really has no other viable option.

If they do not ban accounts in such cases they will see a huge rise in people purchasing stuff, disputing the claim to their bank and keeping or selling the stuff without having paid for it.

So, while it seems very unfair to your friend you cannot really blame the company for handling it the way they do.

Now, we can debate if there should be better security measures - but we can also debate that some people shares their login and thus could be a fault themselves

 

[f1b041b3]

So if your hacked in the future, can we still say that username / password is still a reasonable amount of security? Or does things suddenly change because now it's your account?

Edit: All that players are asking for is MFA / 2FA, that's been the standard for more than a decade now.

You asked me this in the last thread, if I recall correctly. Remember when I asked what it means if I don't get hacked? Will you accept that as proof that simply not sharing account credentials is all the security one needs?

 

[Nebless]

I've noticed in various threads and elsewhere in RL that's it's never the individuals fault something happens, it's always the companies: they should have better security, they shouldn't have let me buy it, they should have had a warning on the cup that the coffee was hot etc... etc.... etc.....

I get it, the current world slant is no personal responsibility love the nanny state, but Data monitoring companies are a dime a dozen, there's various anti-virus programs etc... etc..... How about people look to their own responsibility FIRST before screaming it's the other guys fault.

 

[Smokewolf]

Please consider that the company really has no other viable option.

If they do not ban accounts in such cases they will see a huge rise in people purchasing stuff, disputing the claim to their bank and keeping or selling the stuff without having paid for it.

So, while it seems very unfair to your friend you cannot really blame the company for handling it the way they do.

Now, we can debate if there should be better security measures - but we can also debate that some people shares their login and thus could be a fault themselves

This whole situation (if it's legitimate) could of been avoided by SSG implementing MFA. Which has been asked for repeatedly for the last Decade or more. SSG continuing to drag its feet over this issue, creates doubt in legitimate claims of fraud, while undermining trust in the DDO store as a safe vendor.

 

[Smokewolf]

I've noticed in various threads and elsewhere in RL that's it's never the individuals fault something happens, it's always the companies: they should have better security, they shouldn't have let me buy it, they should have had a warning on the cup that the coffee was hot etc... etc.... etc.....

I get it, the current world slant is no personal responsibility love the nanny state, but Data monitoring companies are a dime a dozen, there's various anti-virus programs etc... etc..... How about people look to their own responsibility FIRST before screaming it's the other guys fault.

Q: So would you shop online without MFA ?

 

[f1b041b3]

Q: So would you shop online without MFA ?

I get it... Your superior and your accounts are untouchable. Can't wait for you to be proven wrong.

I prefer not having the bother of M-FA and no, I'm not going to get hacked. Like I said, it's just a placebo for honest customers in the consumer space. People seeing unauthorized credit card charges aren't getting "hacked" by mysterious tech geniuses wearing hoodies and Guy Fawkes masks while techno music blares in the background. They're having their card numbers stolen from skimmers physically attached to point of sale terminals. The waitress they handed their cards to when it came time to settle their checks snapped photos of them when she went back to the register. Somebody that works in billing at the local utility was offered a thousand bucks for a dump of its payment data. I could go on - the point is that M-FA isn't even a factor in most realistic fraud scenarios.

 

[Jhenissa]

I don't for my Amazon purchases

I dont know where you reside but in the USA, Amazon has MFA. You just have to enable it.

And before you say otherwise, yes that is associated with logins not purchases. But then again, I log in and out to sites where I make purchases.

 

[Smokewolf]

I prefer not having the bother of M-FA and no, I'm not going to get hacked. Like I said, it's just a placebo for honest customers in the consumer space. People seeing unauthorized credit card charges aren't getting "hacked" by mysterious tech geniuses wearing hoodies and Guy Fawkes masks while techno music blares in the background. They're having their card numbers stolen from skimmers physically attached to point of sale terminals. The waitress they handed their cards to when it came time to settle their checks snapped photos of them when she went back to the register. Somebody that works in billing at the local utility was offered a thousand bucks for a dump of its payment data. I could go on - the point is that M-FA isn't even a factor in most realistic fraud scenarios.

So whatever really... If it works for you and your happy in your little world, what can go wrong right?

Meanwhile the vast majority of people making purchases online will stick with MFA. To do otherwise is both arrogant and just asking for your credentials to be breached.

 

[Guntango]

For that amount of loss most players would walk away from DDO, as should your friend.

Don't be a sillywolf. That's less than .01% of monies spent in 20 years.

 

[Solarpower]

Meanwhile the vast majority of people making purchases online will stick with MFA.

Did you survey the entire Earth to make such statements ?
Honestly. The only on-line services with 2FA I know are my bank and Steam.

 

[Smokewolf]

Did you survey the entire Earth to make such statements ?
Honestly. The only on-line services with 2FA I know are my bank and Steam.

Yes, everyone but your house apparently, as I try to avoid bad neighborhoods.

FYI: https://worldmetrics.org/multi-factor-authentication-statistics/

 

[Guntango]

Yes, everyone but your house apparently.

Yeah, I definitely didn't answer the door.

 

[Sylvado]

I dont know where you reside but in the USA, Amazon has MFA. You just have to enable it.

And before you say otherwise, yes that is associated with logins not purchases. But then again, I log in and out to sites where I make purchases.

I didn't say they didn't have it and I have expressed my opinion in the past that SSG should have it. I don't use it for Amazon because I have strong passwords and don't use the same password for multiple accounts.
To add to that, yes it would be a useful tool for SSG to offer but it does not replace personal responsibility. That does not place fault on the player, it just means it is their responsibility, that distinction is important.

 

[Nebless]

Q: So would you shop online without MFA ?

Quite a lot actually; can't think of a single miniatures company that uses it, don't have it on Amazon, Etsy or eBay. So yeah.

 

[Solarpower]

Yes, everyone but your house apparently, as I try to avoid bad neighborhoods.

FYI: https://worldmetrics.org/multi-factor-authentication-statistics/

So ? Where are the statistics by country, for example ?

All that is there are "references" to 80 web-sites.
Of these 80, only 4 are recognisable : Google, Apple, Microsoft and Twitter. The remaining 76, what are they anyway ? Web-sites that no one knows about outside the USA ? Well, yes, an "excellent" example of global MFA implementation...

 

[Kimbere]

A username and a password is a reasonable level of security, so yeah, they need to start locking these threads.

The only thing that "needs" to happen here is you need to stop pulling ideas out of your behind and arguing based on "feels".

NIST and virtually an entire industry of IT security professionals who focus on ecommerce retail security disagree with you.
https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication.

Note that this is listed as even being recommended for "small businesses". SSG/Daybreak is quite a bit larger than "small business".

So if you think you're smarter and know more than all the professionals people who write the NIST guidelines, by all means, apply for a job there and go be the cybersecurity rockstar you think you are.

 

[Solarpower]

Cherry-pick much to support your narrative? Sounds a lot like a Straw Man argument you're attempting to make here.

Well, that is, you can’t answer the question, right ?

Okay, let's put it differently.
You claim that MFA is a standard. Can you name the standard number and the year it was adopted ? For at least one of the countries where this standard was supposedly adopted ?

 

[Kimbere]

I didn't say they didn't have it and I have expressed my opinion in the past that SSG should have it. I don't use it for Amazon because I have strong passwords and don't use the same password for multiple accounts.

Amazon doesn't require it, but they do offer it as an option for those that want it. In fact, they even recommend it. Giving us the *option* is all we're asking SSG for.

 

[Marshal_Lannes]

Both you and your friend can do some research here at the forums and see that is not the 1st, 2nd or 3rd case. This is happening with some players too, and SSG does not care if people are getting hacked or w/e. Basically he wont recover the account if he doenst pay, might aswell just start a lawsuit.

Good luck.

It is so obvious that many people here have never in their lives dealt with a lawyer. "Just start a lawsuit" is laughably naive advice. You can go talk to a lawyer, sure, many/most offer free consultations, but when they tell you that you'll need to pay them a $ 2,500- $ 5,000 retainer fee to get started, that should dispel all your notions about "just starting a lawsuit". Yes, personal injury lawyers will take your case for "free" in exchange for 25-50% of the settlement. But they aren't going to do that here because it's not an open-and-shut case against an insurance company that most personal injury claims are. Don't listen to me though, talk to that lawyer, then make sure to post on here how much it will actually cost you to recover your account (you already got the charges invalidated, so you are out no money) and how you aren't going to be "just starting a lawsuit".

 

[investigator]

It is so obvious that many people here have never in their lives dealt with a lawyer. "Just start a lawsuit" is laughably naive advice. You can go talk to a lawyer, sure, many/most offer free consultations, but when they tell you that you'll need to pay them a $ 2,500- $ 5,000 retainer fee to get started, that should dispel all your notions about "just starting a lawsuit". Yes, personal injury lawyers will take your case for "free" in exchange for 25-50% of the settlement. But they aren't going to do that here because it's not an open-and-shut case against an insurance company that most personal injury claims are. Don't listen to me though, talk to that lawyer, then make sure to post on here how much it will actually cost you to recover your account (you already got the charges invalidated, so you are out no money) and how you aren't going to be "just starting a lawsuit".

And?