Hacked ;(

[LinkNZ]

So one of my accounts seems like its been hacked, thankfully it wasn't either main accounts (have 2 security tokens for them), it was a secondary account that has a couple of level 30 characters on it. My GF was currently using it for her character.

So anyway, she logs in today after an extended break to find like 10 additional character 'mules' on there that we never made, various servers all level 1 and stupid names. I assume they've been used for gil transfer or whatever.

Is this a common thing with being hacked? I feel like they stole the account details, saw there was nothing worth taking for keeps and then created a pile of mules on my dime and didn't even bother changing the password to lock me out.

My GF didn't have a whole lot of gil (100k ish maybe) but they took that, didn't care for the level 30 gear just, the gil.

I feel so violated, its a cliche but up till now being hacked was 'just something that happens to other people', something you read about. Ugh. So I've got 3 possible computers to scan or whatever, to figure out how they got the details.

My questions are, what do I do now? Where do you contact SE to tell them about this crap, I don't want to pay for mules I didn't create!

And what kinda shit should I be looking for on the computers, what will be stealing the details? What scanners will find it and what protection programs do you guys use?

Sorry for being a got hacked nub.

I can't even imagine how gutted I would be if it had happened to a main account, I feel for anyone that had that happen to them if its this bad a feeling over just a secondary account! F**KING HACKERS. >:[

/vent

[Argettio]

Change the damn password asap! (obvious I know, but felt it was worth saying)

There isn't much you can do about the mules, as you didn't report the account as hacked. As far as SE can see you have just been acting like an RMT.

I would report it, explain why you didn't report it sooner, and ask them what to do (I would take screenshots of the mules they created etc in case you need evidence).

SE probably won't do much, as you have access to your account, and I very much doubt they will refund the money for the mules.

[Shenrien]

http://i35.tinypic.com/2ppabra.png

I didn't know BG was a place to blog.

[Tagus]

Hehe... just when I thought the ffxi community had perfected the art of kicking somebody when they're down, the bar gets raised...

I don't think SE would respond appropriately to any inquiry you might make, but I'd be interested to hear if anybody's got some scanner suggestions too.

[LinkNZ]

Yeah I have no idea what SE will say but guess there is only one way to find out, can't imagine they get many reports of I was hacked but I can still log in? Probably wont care. The mule thing is messed up, I hadn't heard of that happening before. Sucks about the bloody fee. >_> They created IDs for all the slots but only made like 10 mules.

[Massimo]

Ugh, I can't remember who, but I think I remember someone getting a refund from something like this.
They can see that another IP logged onto your account and created IDs/chars, so you hopefully should be able to get a refund.

Clean your PCs fast though, change your passwords on a 4th PC if possible, then don't log into FFXI until you're sure the PC you're using is not infected anymore.

PS: Don't mind Inga, half of his posts were worse than this.

[Valkrish]

as much as it is annoying, i'm sure you will get it all back in time.

[dejet]

unless you get the GM i got last week.
"our logs are only a week old anything older can not be seen"

lulz

GL budy

[Hanyoko]

Its still charged for services you didnt authorize. If SE doesnt do anything it would then fall to the CC company. However any chargebacks you do will likely result in any account on that CC getting banned.

[Shamaya]

I've done a lot of server transfers for profit, so if I was unethical enough to take someone else's account, I imagine that it would be an opportunity loss if I didn't use the opportunity to conduct a very profitable transfer as the 2nd bird to the 1 stone. That is, at least, if I had other accounts ready to do transfers as well, because it usually doesn't make sense to do the transfer one way.

So this may have been the line of reasoning that your hacker used. If it was a server transfer at least. Although if you don't have a transfer fee on your account by the end of this month, I guess it was for some other reason. But the person who did it, while unethical enough to take the account from you, may have been ethical enough to change your password back at the end (at least that's what I think, but who knows)?

I'd consider yourself lucky and not worry about the mule/possibletransfer fees, though if you want, you could call SE up about it, if you feel it's worth your time.

[Shin Volcano]

unless you get the GM i got last week.
"our logs are only a week old anything older can not be seen except when we did salvage bans, we could go back as far as a year, but in this case we really don't give a shit about you because you weren't important enough"

lulz

GL budy

Fixed, they can go back if they really wanted to.

[Corrderio]

Speaking of hacking, has anyone noticed people seem to be getting hacked around late night Friday now? Seems like RMT are catching on how to cock block us getting our accounts back due to SE's lack of customer service

[Lahan]

At least the mules are only a dollar a pop.
If they somehow did it where it was 12.95 X 10 then that woulda hurt.
Don't get me wrong, I am so poor I can't pay attention and 10 bucks is still 10 bucks.
I'm just saying it coulda got ugly...

[Lovex]

That sucks. Sorry for your loss><

Seem to be happening more and more these days.

I wonder if they will be as persistant in FF14..

[Corrderio]

That sucks. Sorry for your loss><

Seem to be happening more and more these days.

I wonder if they will be as persistant in FF14..

Probably, hopefully the network security or service for hackings are better than POL

[Gethsemane]

Speaking of hacking, has anyone noticed people seem to be getting hacked around late night Friday now? Seems like RMT are catching on how to cock block us getting our accounts back due to SE's lack of customer service

You're not really cock blocked considering you can have a friend that knows you GM your character and have it frozen until Monday. Sure it is an inconvenience because you have to wait until Monday but at least there is still that option. It's truly sad that this guy had this happen to him and it makes me wonder. RMT typically don't leave an account accessible. It wouldn't make sense that your GF might have made all those characters and did the transfer thing. So does anyone else have access to your account other than you at all? When an account is hacked usually you start from the obvious and work your way to the far-fetched wtf possibilities.

But yeah first things first. Disconnect that computer from the internet. And use a USB thumb drive to download programs like ad-aware, CC Cleaner, and other malware destroying programs. Probably wouldn't be a bad idea to also download Hijack this and see if there's any unrecognizable processes running. And do a virus scan. I'm hoping you have Firefox + Noscript + Ad block plus installed as well.

If all that checks out then it honestly comes down to someone has the account information. Either you have friends that you play with at your house and they saw you type in your password and know your content ID. You might have it wrote down somewhere and they found it. Someone who you told your account information has done it. You cannot really say that someone you know wouldn't do this to you. People do stupid things for stupid reasons.

And if it's not a friend or any way this could have happened. You could then go into the conspiracy theory that's been talked about where SE has been stealing people's inactive player accounts. However, I don't know if I believe this. I'm sure everything that the POL Information Center does is logged by the JP HQs in Japan and the supervisors that work there. Who knows. Good luck though in getting your stuff back. Keep us updated.

[Corrderio]

Oh yeah, keep forgetting about the GM thing, though yeah you'd hope SE would catch on about their tactics and have weekend service now.

[Lonewind]

Oh yeah, keep forgetting about the GM thing, though yeah you'd hope SE would catch on about their tactics and have weekend service now.

SE doing something logical and providing "extra" customer service? maybe you're playing a different game by a different company.

[cdgreg]

Don't ignore your pc obviously, but I'd be more inclined to check the gf's pc that you share accounts with.

[LinkNZ]

Its definitely RMT as the account names are stupid like Emxdia, Emxlev, Emxgil and so on, unless my GF is RMT (lol why am I lending her gil for scrolls then!).

And when I checked the sent box of them at the AH there is 1mil being sent somewhere but of course you can't see anything as it vanishes instantly. So the account has been used and then just left I suppose.

Thanks for all the advice guys, have spent the whole day trying to 'clean' all the computers. Haven't found anything obvious spyware or virus etc wise, so I don't know what to think.

We use Firefox, but she didn't have adblock, noscript etc on her laptop. So maybe somethings got in somewhere along the way. That's all loaded now so at least the future might be safer.

My biggest fear now is that they server hopped on my dime also, there are 4 mules that aren't on Leviathan so I fear for the worst unwanted fee wise.

Even though its not my main account and the GF doesn't play 'seriously' enough to warrant it, I think now I'll try and get a security token all the same. Would have been much better than this crazy situation. Hacked by RMT but not quite stolen account. :\

EDIT: So I've been digging round the Content ID section of the account, some really detailed info there lol, never even looked in it before this. >_<

They were created on the 3rd of October, 12 POL IDs and 1 World Transfer.

So I'm out $37USD (I think), money down the RMT toilet. So yeah, despite it not really having anything worth stealing I still wish I had protected the account better now with a token. Something like this never even crossed my mind. All I thought is meh nothing worth stealing on it in game not what can they charge to my credit card with the account details.

I know it could have been worse (and HAS been for some), but still lame.