September 12, 2005 4:00 AM PDT

Virtual goods, real scams

Dan Hunter recognized a familiar scam when he got an e-mail stating that his account in the game "Eve Online" had been suspended due to "unusual activity" and that he needed to click on the enclosed link to enter his login data to regain access.

Hunter, an assistant professor of legal studies and business ethics at the Wharton School of Business, knew that this type of hoax, a phishing scam, was usually used to get access to PayPal or online bank accounts. But this was a new one to him: phishers targeting an online game player's login data.

"The mechanics of (this) phishing attempt are no more sophisticated than usual," Hunter wrote on Terra Nova, a blog about the economies of virtual worlds that he co-edits, "but I'm struck by the fact that the scammers are now phishing for login details for virtual worlds."

News.context

What's new:
As awareness grows that virtual goods in online games can be traded for real-world cash, phishers are eyeing the assets.

Bottom line:
If virtual-world phishing becomes a serious problem and enough valuable goods are stolen, game publishers may have to turn to authorities for help.

More stories on this topic

Some online game players say that scammers have for years been trying to get them to give up their login information so they can leapfrog into higher levels of games without putting in the hard work it usually takes. The attacks, in many cases, came more from game laziness than greed. Annoying? Yes. Something the federal government should be looking into? Probably not.

But Hunter worries there's more to it this time around. The biggest reason: There's a growing awareness in the game community that the weapons, characters, currencies and other virtual goods in online games can be traded for real-world cash.

"It's more evidence of the value of these virtual assets," Hunter told CNET News.com. "As soon as you have assets that are valuable, that are electronically tradable, then you have the opportunity for really massive fraud because it's worth the scammers' time to try to extract those assets."

Here's how the virtual-to-real-world exchange works: Players can buy and sell goods such as battle axes and gold coins in exchange for hard cash on secondary market services like eBay or IGE. Once a buyer and seller have struck a deal and transferred the payment, often via a service like PayPal, they have to meet up in-world to actually exchange the item.

Though no one knows exactly how much the trade in virtual goods is worth, estimates range from $200 million to $880 million a year, much of it conducted on sites like eBay and IGE. Those involved in the business of online games expect such figures to grow as games like "World of Warcraft" and "Everquest II" become more and more popular.

"What you have is this strange gray area where these incredibly valuable assets are available," Hunter said, "and the scammers want to get a hold of (them) because they can turn them into money."

While Hunter is concerned that phishing could become a serious problem for online games and could necessitate government regulation, he did not know of any law-enforcement actions thus far.

Magnus Bergsson, chief marketing officer for CCP Games, the publisher of "Eve Online," said he began to notice the increase in phishing attempts about two months ago. He, too, believes scammers are looking for a way to cash in on the virtual markets.

"This is one of the really bad things about in-game items and money trading," he said. "When it echoes outside of the game and turns into real money, bad things happen."

Indeed, many game companies and their players publicly decry trafficking of virtual goods because, they argue, it waters down the games and causes the companies customer service headaches when players complain they've been cheated.

But Sony Online Entertainment recently overcame its longstanding resistance to trading real cash for virtual assets by creating its own marketplace. Sony rationalized the move by saying it could control fraud in its own auction system.

In any case, Hunter predicts that if virtual-world phishing becomes a serious problem and enough valuable goods are stolen, game publishers--normally squeamish about bringing in the feds--will have little choice but to turn to the authorities for help.

"The game developers are really conflicted about what they should do about this," Hunter said. "They can try to track it down. But there's going to be a real disconnect between their desire to have it stopped and their desire not to have it regulated."

Truth is, gamemakers don't enforce the rules beyond their virtual domains. They acknowledge that game communities may have to get past their libertarian attitude toward real-world government and ask for law enforcement help in cracking down on the problem.

"If this becomes serious enough," Bergsson said, "we will probably be forced to do something like that."

4 comments

Join the conversation!
Add your comment
Why are Phishers Stealing Virtual goods, real scams a threat?
Why are Phishers Stealing Virtual goods, real scams a threat?

Today, EDI Secure LLLP under POA and Founder, A.T. Alishtari notices that virtual scams for virtual ID are also taken which may seem harmless however it is also how new and traing cyber criminals practice their trade like Victorian pickpockets training on each other before making their way in the world. Our Company patented single use credit card number also protects from virtual ID theft and therefore is also a deterent to training next years big phisers.
Posted by (66 comments )
Reply Link Flag
Too bad..
your "patented", "innovative" idea has already existed for a good amount of time.
Several years ago Citibank started offering the service to generate credit card number for single use, backed by the credit on your real card.

Of course I shouldn't be expecting too much veracity from a comment spamming company in the first place.
Posted by Jan Modaal (40 comments )
Link Flag
Had to run to bank to stop cyber crooks
The other day my account was blocked. I couldn't get into it and it linked to other accounts. So, I visited my bank and we stopped some fraud right there but I was lucky that is all.

In fact, most people find out about it later and some too late to do anything about it if it is debit and not credit.

It isn't right that we can lose funds and if we are not timely, we have to pay and the crooks get away with our assets, our credit, our good name and lots of virtual or real assets.

It just isn't right. That's what I think. Ciao now.
Posted by Iohagh (54 comments )
Link Flag
you can always report this and other scams at www.scamreporter.com
Posted by zenek711 (1 comment )
Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.