From POL: Warning Regarding PlayOnline ID and Password Fraud

[Mistress Stowastiq]

Mods please be gentle, XD this is my first thread and I wanted this info from the other thread in standard : http://www.bluegartr.com/forum/76542...ml#post2808247

Just wanted this to reach everyone since SE considers it urgent.
Feel free to merge this with the other, post the image of the page or delete or fix.


Warning Regarding PlayOnline ID and Password Fraud


Jun. 12, 2009 19:15 [PDT] From: PlayOnline http://www.playonline.com/ff11us/imgs/spacer.gif
Warning Regarding PlayOnline ID and Password Fraud
http://www.playonline.com/ff11us/imgs/spacer.gif http://www.playonline.com/ff11us/imgs/info/infhr.gif
It has come to our attention that certain individuals are contacting FINAL FANTASY XI players in-game, and referring them to fake websites resembling the log-in page of the official Linkshell Community site. The fraudulent site directs players to enter their PlayOnline ID and password, with the intent of using the collected information to compromise the account. We are currently investigating and working to take the appropriate actions against these malicious websites.

Be careful with your information so as not to become a victim of "phishing." Do not disclose your PlayOnline ID or password to anyone or attempt to log-in anywhere other than the official FINAL FANTASY XI Linkshell Community and PlayOnline website.

*The only exception is when dealing directly with a PlayOnline Information Center representative via the PlayOnline Service & Support Web Chat system. You may be asked for your PlayOnline ID or registration code in such cases.

Also, please note that no Square Enix representative (Game Master (GM) staff included) will ever ask you to provide your PlayOnline ID or password from within the game or via e-mail. If you experience such a request while in-game, please contact a GM to report it.

Keep your data safe! Keep your PlayOnline ID and Password secure!

[Silenka]

It has come to our attention that certain individuals are contacting FINAL FANTASY XI players in-game, and referring them to fake websites resembling the log-in page of the official Linkshell Community site. The fraudulent site directs players to enter their PlayOnline ID and password, with the intent of using the collected information to compromise the account.

So...wait. Someone would have to (1) pose as a GM or a staff member of SE and (2) actually get you to log onto that POS Community site so that they can (3) control your POL account which, unless you're even more MONUMENTALLY stupid than you've proven yourself to be already, is protected with a token anyway so what the hell is the point?

Last time I checked people can't fake being [GM] so idk man, I find it hard to believe anyone with a brain in their skull would fall for that. What do people do with token-encrypted accounts anyway? Hope someone is retarded enough to buy it on ebay? That's relying on a lot of stupid...

[Conrad]

Looks like SE is taking their normal amount of time to respond to all of the brogames tells.

[Skjie]

So...wait. Someone would have to (1) pose as a GM or a staff member of SE and (2) actually get you to log onto that POS Community site so that they can (3) control your POL account which, unless you're even more MONUMENTALLY stupid than you've proven yourself to be already, is protected with a token anyway so what the hell is the point?

Last time I checked people can't fake being [GM] so idk man, I find it hard to believe anyone with a brain in their skull would fall for that. What do people do with token-encrypted accounts anyway? Hope someone is retarded enough to buy it on ebay? That's relying on a lot of stupid...

Except that someone in standard already did, and there are a lot more people who would.

[TummieGaruda]

So...wait. Someone would have to (1) pose as a GM or a staff member of SE and (2) actually get you to log onto that POS Community site so that they can (3) control your POL account which, unless you're even more MONUMENTALLY stupid than you've proven yourself to be already, is protected with a token anyway so what the hell is the point?

Last time I checked people can't fake being [GM] so idk man, I find it hard to believe anyone with a brain in their skull would fall for that. What do people do with token-encrypted accounts anyway? Hope someone is retarded enough to buy it on ebay? That's relying on a lot of stupid...

That's the thing, they are getting sent tells without the [GM] tag in the name. Yes, I know it's sad but some people do fall for it as quickly as the Nigerian who will offer you 1 million dollars if you provide bank information for the money transfer.

[bungiefan]

So...wait. Someone would have to (3) control your POL account which, unless you're even more MONUMENTALLY stupid than you've proven yourself to be already, is protected with a token anyway so what the hell is the point?

Not everyone has a token yet or can get one. Many of us that want them can't order them or haven't received them yet.

[Izzy]

Looks like SE is taking their normal amount of time to respond to all of the brogames tells.

They're not talking about the brogame tells. They're talking about something that started 1-2 days ago. I'm rather impressed with their response time actually.

[The Stig]

They're not talking about the brogame tells. They're talking about something that started 1-2 days ago. I'm rather impressed with their response time actually.

Hah, clearly buying gil is actually an ok thing to do while posing as a GM is not.

[Mistress Stowastiq]

So...wait. Someone would have to (1) pose as a GM or a staff member of SE and (2) actually get you to log onto that POS Community site so that they can (3) control your POL account which, unless you're even more MONUMENTALLY stupid than you've proven yourself to be already, is protected with a token anyway so what the hell is the point?

Last time I checked people can't fake being [GM] so idk man, I find it hard to believe anyone with a brain in their skull would fall for that. What do people do with token-encrypted accounts anyway? Hope someone is retarded enough to buy it on ebay? That's relying on a lot of stupid...

I think the other thread describes how the token basically saved his ass but he wrangled with the hacker a few times to regain control of his account. Also the other thread shows a snapshot and it doesn't even look like they go as far as trying to add "GM" to their names. Like the person above me said, it is different than bro-sale/bro-game, it is an actual fake site that supposedly looks like the LS community site.

Still, when you are in a GM call and you CNTRL+R it shows the GM's name in the reply without the "[GM]" part, meaning [GM]Genericgmname will show as Genericgmname when you reply in /tell.

Not that that makes it totally easy for scammers to trick some one but it is just another confusing thing if you are busy, tired, or especially if you are new to the game. Scammers do not necessarily plan to keep the account. They also sell everything they can in the account or DB the stuff to another account that can quickly turn the items into cash in a bazaar. By selling expensive items at an extremely low cost they add legitimate players into the money trail and obscure the path.

The token is not something every account has so I imagine the phishing targets -all- of them hoping to get some who are not secured. SE announced the tokens are sold out in some places.

If you time the first report here with how quick SE posted up a warning, I at least think it was a pretty quick response.

Instead of calling people stupid, we can at least try to understand that not everyone is totally prepped on what is official and not official in this game when it comes to /tells.

[Gunitsoldier]

Guess that retard that made that one thread feels pretty fucking stupid now.

[Despain]

Looks like SE is taking their normal amount of time to respond to all of the brogames tells.

BR74 COME ON!!!!!

[Fallyn]

That's the thing, they are getting sent tells without the [GM] tag in the name. Yes, I know it's sad but some people do fall for it as quickly as the Nigerian who will offer you 1 million dollars if you provide bank information for the money transfer.

http://i257.photobucket.com/albums/h...fonejacker.jpg

[Blabj]

I just need your pin number sir, then we can wire you the monies directly.

[Corrderio]

BR74 COME ON!!!!!

I swear to god if I hear that one more time....

Seriously, hasn't SE implied that autojailer program yet? If so why don't they have it set to jail tell spammers?

[Tomiko]

They're not talking about the brogame tells. They're talking about something that started 1-2 days ago. I'm rather impressed with their response time actually.

Pretty sure he whooshed you.

We've been complaining about the RMT tells for months now and SE hasn't said anything about it (their usual response time: next to never). This has been known for less than a week (that I know of) and we're getting an announcement.

[Izzy]

Pretty sure he whooshed you.

I doubt it lol.

[Destinye]

Considering everyone is in mass "ugh" mode with the "Come On!" tells, a new type of tell can indeed throw some people off especially if you're only half paying attention like the person who fell for it was.

I really haven't seen many if at all any company release a press statement every time something is amiss.

Tell SE to get on twitter or something shit >.>

[Despain]

Considering everyone is in mass "ugh" mode with the "Come On!" tells, a new type of tell can indeed throw some people off especially if you're only half paying attention like the person who fell for it was.

I really haven't seen many if at all any company release a press statement every time something is amiss.

Tell SE to get on twitter or something shit >.>

Status Update last updated June of 2005.

[Hoshiku]

Is there any way your account could be stolen via phishing with the security token enabled? I am currently unable to login because one of my three passwords is incorrect. I haven't changed either of the static passwords ever so I'm confident I'm typing those correctly. It puzzles me because wouldn't I have been kicked offline if someone had stolen the one time password I logged on with? I was online for two hours and was never kicked off.

edit: apparently rebooting fixed my problem. seems my one time password was out of synch? pretty bizarre...

[Silenka]

Not everyone has a token yet or can get one. Many of us that want them can't order them or haven't received them yet.

So SE can warn people about a potential threat but still fails to provide them with the security they need in a timely fashion.

Good for them for actually posting about it though. I'm just still baffled that anyone who isn't new to the internet would fall for a phishing scam no matter how cleverly it's disguised. The fact that this one isn't disguised well at all just adds more disbelief. Guess it's time for people to be forcibly educated then