Has anyone ever recovered their stolen gil? Any advice?

Quote:

---

Originally Posted by Ilyrian

Forgive me - out of morbid curiosity, how does this work exactly?

Did the OP have his account comprised and gil stolen through illegal access to his account? Is it a key-logger situation? Did they hand it over to some shady third party?

---

It's a chain scam where the scammers will send someone a tell with a link to a fraudulent website that's supposedly a forum post, but instead leads you to a phony log-in page that's sketchy as all heck; particularly due to it not being a secure website (Which immediately gets it blocked by any half-way decent internet security program). It's also not redirecting to the supposed forum post in the web address and demands your OTP at the same time as your account name/password, which the official log-ins do NOT do (They prompt for the OTP after verifying account name/password are correct).

If you're gullible enough to attempt to log in, they have a bot set up to immediately log into your account via Mogstation and change your password, afterwhich they'll strip your account (And FC if you have permissions) of gil before using it spam other players with links to the scam website until the GMs inevitably suspend your account.

The thing I'm curious about is whether or not the GMs bother tracing the stolen gil back to the "bank" account they're sending it to so they can purge it and reduce/prevent any potential RMT sales.

Quote:

---

Originally Posted by Awha

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

---

Probably just curiosity and a bad assumption that this game has easy account/item/currency recovery options like World of Warcraft does.

Every time I get some kind of scam message, text or anything there's a part of me that wants to take it as far as possible just to see how believable the phishing site is and how it all comes together.

Quote:

---

Originally Posted by Goji1639

Probably just curiosity and a bad assumption that this game has easy account/item/currency recovery options like World of Warcraft does.

Every time I get some kind of scam message, text or anything there's a part of me that wants to take it as far as possible just to see how believable the phishing site is and how it all comes together.

---

Not going to lie I have toyed around with the idea of buying another account and checking it out for myself.

I HIGHLY suggest people head to the real Square Enix website to see what it looks like. I find once people sihn up for the game, they never look at it again.

Quote:

---

Originally Posted by Penthea

OP I'm curious, after years of being careful about suspicious links, what was it about the one that gave you trouble that made you break your habit of ignoring them?

---

This current announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

Quote:

---

Originally Posted by alocsin

This announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

---

To be completely fair, that is already in your chat officially the second you log into the game, though not in /tell form. They would have no reason to message you about it privately, which they never have with anyone regarding these things as far as I'm aware.

Quote:

---

Originally Posted by MariaArvana

This. They have one-time item restore per account available, but thats for a single item. If you want to recover everything, the data rollback is basically your only option.

---

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

Quote:

---

Originally Posted by alocsin

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

---

Yeah, their restoration systems leave a lot to be desired.

Quote:

---

Originally Posted by Vahlnir

To be completely fair, that is already in your chat officially the second you log into the game, though not in /tell form. They would have no reason to message you about it privately, which they never have with anyone regarding these things as far as I'm aware.

---

Yea system messages appear automatically and don't have a player name next to them because...the server isn't a player! Even by default system messages are a completely different colour to private tells.

Quote:

---

Originally Posted by alocsin

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

---

That...really really sucks. Also thanks for answering my question about why you checked out the link.

Quote:

---

Originally Posted by Awha

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

---

If it's the one I'm thinking of, it can look very much like a real forum link at first glance (right downto the usual /ffxiv/threads/<numbers>-<title-breadcrumb> path), if you don't notice that the URL uses something like "com.xyz", instead of just ".com" in the hostname; just skimming over the link visually can be enough to look valid to someone tired/stressed—an unfortunately common situation right now given this whole "global pandemic" thing—even when they know better.

I've seen commentary from other normally-cautious players who were caught off-guard by the link on a day when they were tired/stressed, logged in, and got the /tell and saw a URL which their brain processed as "yeah, that looks like a real forum link", went "Huh, what fuss are people raising now?" and copied/pasted it in before their brain kicked in and they went "Oh crap no wait." Thankfully, most I know of caught themselves before entering login information ("Hey, wasn't I logged in on the forum already?") and others caught themselves when they hit a password autofill using 1Password/Keepass/LastPass/whatever and it didn't show a valid user/password for that site (which made them look at the address bar and go "Oh wait that's not the real site").

Quote:

---

Originally Posted by alocsin

This current announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

---

FWIW, anything Square-Enix links to in-game will show up in the server MOTD, and in-game URLs will pretty much always use the sqex.to URL shortener. But yes, having SE already providing official links to events there can contribute if folks are already a little hazy due to stress or exhaustion.

That said, I highly recommend using a password manager, and using it to log in to sites (as noted above). If you ended up on a scam site, even if you were tired/not paying as close attention, hitting 'Autofill' will show no password for the site, which is usually enough to shock people back out of complacency and make them look at the URL in the address bar more closely.

Regardless, sympathies. :(