I saw that fake website waaay back in January when it was a 500 mil gil giveaway scam. The guy was spamming free 5mil just check the forum link. I already entered my info and was about to hit the login screen till i double checked the website link and saw the .xyz. That's when i realized it was a scam lol. Came this close to losing everything. SE needs to have way more GMs monitoring this.
-
07-06-2020, 02:08 PMRareItems
-
07-06-2020, 04:07 PMVahlnirWith that much gil being given away I would think THAT would be the first and biggest red flag, along with everything else. Wouldn't have bothered checking it myself based on the amount and spam. If something sounds too good to be true, 99.9999999% of the time it is, especially on the internet.Quote:
Originally Posted by RareItems
-
07-06-2020, 06:05 PMIscahQuote:
Originally Posted by Deceptus
And as others have said in reply to the people who said to use a one-time password - repeatedly whenever the discussion comes up and in this very thread - two-factor authentication will not save you from this particular scam.Quote:
Originally Posted by Xatsh
It is designed to get you to hand over that one-time password, which they will immediately use while it is still valid. -
07-06-2020, 10:10 PMBristolRuss
Very easy way to fix this. If you log into your account from a new location/IP Address, regardless of whether you used an OTP or not, then you need to verify that this is an authorised login. The easiest way would be by entering a code that they text to you. Could also be by email for people who don't have phones, but emails are easier for scammers to get access to as a lot of people reuse passwords, so go with the text message route if possible.
-
07-06-2020, 10:20 PMAwhaGM's cannot help people from their own ignorance. Sadly these sre lessons that much be taught the hard way for some.Quote:
Originally Posted by RareItems
-
07-07-2020, 05:29 AMSamSmootI use the token, but the SE version is a pain in that you have to enter the number every time. WoW's system is superior, in that you only have to re-enter the authenticator number if the IP address changes, and then, with the app, all you need to do is tap a button if a number request is pending, and it sends it automatically. The only time you have to manually enter a number is when your phone doesn't have an internet connection and your user IP address has changed.Quote:
Originally Posted by Scox
You can set it to request a number every time if you live with someone who might log in on your PC and mess with the game. -
07-07-2020, 07:06 AMYue_AmariyoMy Wow account was hacked with token attached. I never was on any iffy sites, gave out my info but people bought them stupid shiney ponies mounts through my account. lucky fir me i had already quit. i just saw a pop uo in my email one day with something being bought.Quote:
Originally Posted by SamSmoot
-
07-07-2020, 07:14 AMCanadane
Sadly not enough people have learned the harsh realities of internet scams.
It's a shame when it happens but hopefully lessons learned so nothing of actual value (real life information or money) will be lost in the future. -
07-07-2020, 07:20 AMVahlnirI've used a WOW token (physical and digital) for 11 years. Not once have I been hacked since getting one.Quote:
Originally Posted by Yue_Amariyo
-
07-07-2020, 07:47 AMJojoyaNeither have I but it doesn't mean it never happens. Nothing is foolproof.Quote:
Originally Posted by Vahlnir
The authenticators, whether software or physical, are an additional layer of protection that help reduce the risk. I don't have a mobile phone so I had to get the physical token. Do I regret paying the $15 for it (which included the shipping/handling fees)? Not one bit. Do I think my account is 100% secure because I have one? Of course not. I still need to use common sense in my online interactions. Even normally careful people can make mistakes sometimes. -
07-07-2020, 07:48 AMVahlnirYeah, I suppose this is true.Quote:
Originally Posted by Jojoya
-
07-07-2020, 08:01 AMPacketdancer
One thing I'll note is that a password manager is really useful here, and not for the reason you'd expect. If you get what looks like it's supposed to be a login page, and you hit 'auto-fill' on your password manager and it does not fill out, then that's a big warning sign that you might not be on the site you think you are. Because the password manager doesn't care what the site looks like, it looks at the URL and sees it isn't where it thinks it's supposed to be. That's half of the reason I have my parents using password managers now. (The other half being "please stop using the same 4 passwords everywhere, dad, or writing down every password in a notebook, mom; your approach to security is going to give me an aneurysm".)
I mean, even savvy sorts can have an off day and fall for it, especially if tired. One of my friends fell for this, even though they normally would not; they'd had a long day, they were exhausted, they logged on to check stuff and got a tell, and copy/pasted it to look at it without really thinking or fully engaging brain the way they normally would. (And lost a looooot of gil as a result.) Using a password manager's autofill would've probably provided the "Wait, why didn't that work?" moment that would've shaken them back to full awareness rather than exhausted-brain autopilot.
The 2FA token is great, but it isn't enough. Plus the Square-Enix 2FA token also has a very long timer on it; if you provide that 2FA code on a phishing site (as you are baited into doing on this one), there is more than enough time for someone to log in as you. I mean, even the standard TOTP or HOTP implementations that Google Authenticator, Authy, 1Password, etc. have are flawed that way; they just have shorter (30 second) timers. But with bots that could log in with the provided credentials, even the 30 second window would probably be long enough.
Though, I mean, the best (and final) defense against such things is "just be careful whenever you have a login page which you didn't type the address for yourself". -
07-07-2020, 08:09 AMDarkobra
-
07-07-2020, 09:22 AMCanadaneThe rest of your post is excellent and I agree with it I just wanna touch on this bit.Quote:
Originally Posted by Packetdancer
It's very likely automated. There isn't someone sitting around waiting for an alert to pop up telling him someone fell for the phishing site. It's much more likely that once someone enters that information it's nearly instantly populated into a game client and logged in without human intervention.
It's only at that point a human operator would probably make more sense to take over, but even then I wouldn't put it past them to bot the gil removal, FC gil check, and future tell spam. -
07-07-2020, 04:22 PMPacketdancerOh, I agree; it absolutely is. I suspect the entire process is automated given how quickly it happens, and how it seems to work identically for everyone who’s reported it. There wouldn’t even need to be any human involvement beyond the victim entering their information. I meant “someone” in the abstract sense, as even if the login is done entirely automated there’s still someone behind the scenes running those bots.Quote:
Originally Posted by Canadane
-
07-07-2020, 04:30 PMHysterior
Contact a GM in-game, I don't think "general discussion" will help.
-
07-08-2020, 05:02 AMYue_Amariyocool, i have. had to get rid of my old email because if it tbh. what i presented was a small bit of what happen.Quote:
Originally Posted by Vahlnir