About three months ago now, my Xbox Live account was compromised. Someone gained access to my account, logged in under my tag, spent a couple thousand Microsoft Points I had saved up for a rainy day (which were from a Christmas gift from Christmas 2010). They enjoyed the use of my account and already purchased Live Arcade titles for a couple of weeks before I discovered what had happened.
At that point, I contacted Microsoft's Xbox Support, informed them of what happened. I had retrieved my account and changed my password right before I called, so my account was once again under my control and aside from the missing points, all seemed well. I was informed that Microsoft's investigation would take about 20-25 days to complete, which I was fine with at the time. I figured it shouldn't take too long to look into this, remove the items that were purchased without my consent or knowledge, and refund my points back to me.
It's now rapidly approaching two full months of waiting without a peep from Microsoft. Sure, a call was made to check up on the status roughly 25 days after the initial call. They informed me that no change has been made and that the investigation was still on going. I was informed at the time of the follow-up call that I should be notified via email "any day now" about the results of the investigation and whether or not my points would be refunded.
The problem is, I typically value the security on my accounts but was still curious as to if I had maybe inadvertently been the victim of a phishing attempt. I didn't believe I was but now and days you can never be 100% sure. However, I began to see a trend of others reporting similar account hijacks. These reports came from users at Shacknews, Neowin, neoGAF, and Ars Technica.
In fact, the former owner of CS-Nation, rizzuh, recently had his account compromised much in the same way as others have been experiencing. What typically happens is that the victim will have their account hijacked, if a credit card is associated with the account then large amounts of points are added to the account. The hijacker will then spend those points on any number of Marketplace items, typically in-game items or unlocks, avatar items, or sometimes full games. A huge connection between all of these hijacked accounts seems to be that the players spent points on items or services for FIFA 11 or FIFA 12. Recently played titles include both of the aforementioned FIFA titles, but a growing number are starting to show Battlefield 3 under the recently played games for users who do not even own the titles in question.
The bonus kicker is the fact that the hijacker will often use those ill-gotten points to change the ownership of the affected account to the hijacker themselves, leaving a random or worthless account in their place for the victim to return to. I was fortunate in this respect as my account is still mine with only my MS Points being stolen as an issue. But as it stands, nearing two months, 60 days or so, for a resolution of a simple refund just feels incredibly unacceptable in this day and age.
I would understand the situation a bit better if I didn't have control back over my account. Others that this has happened to have apparently been fully locked out of their accounts for periods of 20 days or more (one person on Shacknews has been without his account for over 60 days and counting). Here is what the official response has been from Microsoft on the matter, as issued to Ars Technica about a month ago.
Neowin has other first hand accounts of the growing concern of Xbox Live Account security and was the inspiration for me to actually share my story in a more public forum. I will be making my third call to Xbox Support tomorrow to see if there is any status update yet. I'm curious if escalating to a senior tech would result in my refund getting done any quicker, but I'm not going to be holding my breath. In all fairness to Microsoft's phone support, the two persons I talked to were extremely courteous and helped as much as they could given their limited authority over situations such as this. Their Twitter support was also as helpful as can be given their limited authority and abilities in situations dealing with account hijackings.
At that point, I contacted Microsoft's Xbox Support, informed them of what happened. I had retrieved my account and changed my password right before I called, so my account was once again under my control and aside from the missing points, all seemed well. I was informed that Microsoft's investigation would take about 20-25 days to complete, which I was fine with at the time. I figured it shouldn't take too long to look into this, remove the items that were purchased without my consent or knowledge, and refund my points back to me.
It's now rapidly approaching two full months of waiting without a peep from Microsoft. Sure, a call was made to check up on the status roughly 25 days after the initial call. They informed me that no change has been made and that the investigation was still on going. I was informed at the time of the follow-up call that I should be notified via email "any day now" about the results of the investigation and whether or not my points would be refunded.
The problem is, I typically value the security on my accounts but was still curious as to if I had maybe inadvertently been the victim of a phishing attempt. I didn't believe I was but now and days you can never be 100% sure. However, I began to see a trend of others reporting similar account hijacks. These reports came from users at Shacknews, Neowin, neoGAF, and Ars Technica.
In fact, the former owner of CS-Nation, rizzuh, recently had his account compromised much in the same way as others have been experiencing. What typically happens is that the victim will have their account hijacked, if a credit card is associated with the account then large amounts of points are added to the account. The hijacker will then spend those points on any number of Marketplace items, typically in-game items or unlocks, avatar items, or sometimes full games. A huge connection between all of these hijacked accounts seems to be that the players spent points on items or services for FIFA 11 or FIFA 12. Recently played titles include both of the aforementioned FIFA titles, but a growing number are starting to show Battlefield 3 under the recently played games for users who do not even own the titles in question.
The bonus kicker is the fact that the hijacker will often use those ill-gotten points to change the ownership of the affected account to the hijacker themselves, leaving a random or worthless account in their place for the victim to return to. I was fortunate in this respect as my account is still mine with only my MS Points being stolen as an issue. But as it stands, nearing two months, 60 days or so, for a resolution of a simple refund just feels incredibly unacceptable in this day and age.
I would understand the situation a bit better if I didn't have control back over my account. Others that this has happened to have apparently been fully locked out of their accounts for periods of 20 days or more (one person on Shacknews has been without his account for over 60 days and counting). Here is what the official response has been from Microsoft on the matter, as issued to Ars Technica about a month ago.
“We do not have any evidence the Xbox LIVE service has been compromised. We take the security of our service seriously and work on an ongoing basis to improve it against evolving threats. However, a limited number of members have contacted us regarding unauthorized access to their accounts by outside individuals. We are working with our impacted members directly to resolve any unauthorized changes to their accounts. As always, we highly recommend our members follow the Xbox LIVE Account Security guidance provided at www.xbox.com/security to protect your account.”
Neowin has other first hand accounts of the growing concern of Xbox Live Account security and was the inspiration for me to actually share my story in a more public forum. I will be making my third call to Xbox Support tomorrow to see if there is any status update yet. I'm curious if escalating to a senior tech would result in my refund getting done any quicker, but I'm not going to be holding my breath. In all fairness to Microsoft's phone support, the two persons I talked to were extremely courteous and helped as much as they could given their limited authority over situations such as this. Their Twitter support was also as helpful as can be given their limited authority and abilities in situations dealing with account hijackings.
Comment