Has anyone ever recovered their stolen gil? Any advice?

I'm usually good about not following chat links but this time I did and consequently lost 14 million gil, which was nearly all of my funds. This happened despite my having a software token, which I thought was supposed to protect me from such theft.

Customer service has been no help despite several back-and-forth messages. Their only solution is Game Data Recovery, which I do NOT want to do because of the problems written about it:

• The process takes several weeks at minimum.
• Any character and quest advances from the point of recovery are lost.
• The process is not guaranteed and seems to cause problems with unaffected items as well as previously completed quests.

Has anyone ever recovered their stolen gil? How did you go through it?

Do you have any ideas on how I can recover my stolen gil without going through Game Data Recovery? Is there anyone I can write to higher-up than the standard CSR for help?

I'm disappointed in this lack of customer service. In World of Warcraft, among other MMORPG's, lost or stolen items or money are usually restored immediately without fanfare and without going through data recovery. The CSRs there just look through a transaction log to see what happened and correct the problem. I don't know why FFXIV can't do the same thing.

Thanks in advance.

The data recovery thing is basically the only option you have. The XIV customer service sadly lacks the capacity to restore stolen items otherwise and is kinda laughably bad compared to the average MMO in general.

Also, the software token should have protected you unless you actually entered the password it gave you on a fraudulent website...which I'm assuming you did considering you mentioned going to a chat link.

Quote:

---

Originally Posted by KageTokage

The data recovery thing is basically the only option you have. The XIV customer serve sadly lacks the capacity to restore stolen items otherwise.

Also, the software token *should* have protected you unless you actually entered the password it gave you on a fraudulent website...which I'm assuming you did considering you mentioned going to a chat link.

---

This. They have one-time item restore per account available, but thats for a single item. If you want to recover everything, the data rollback is basically your only option.

Although on the flip-side, hopefully you're now more aware of better internet security habits and never open a link unless its from someone you trust. Even then, to never punch in your log-in details anywhere besides going to the official site manually yourself first. 99.9% of proper websites will retain your log-in state for a set period of time; if you log in at the official place first and then the link wants to log you in again, it's almost guaranteed to be a phish

Yeah....

Your first mistake was probably following the chat link at all, followed by not making sure the link was legit. They don't do this sort of thing through in game chats officially, and as far as I'm aware they never have. Sounds like your series of unfortunate events was a worst case scenario, and that sucks. I'm of the opinion, however, that caution while browsing the internet is just common sense. Sounds like your only option is that data recovery thing if customer service is slow or unwilling to help. I realize this post might come off as somewhat abrasive, but...it kills me how many people fall for this crap.

I don't get why people would click on links on chat. You're not 60 years old grandpa/grandma, you should have more than adequate sense not to do that.

OP I'm curious, after years of being careful about suspicious links, what was it about the one that gave you trouble that made you break your habit of ignoring them?

Quote:

---

Originally Posted by alocsin

I'm disappointed in this lack of customer service. In World of Warcraft, among other MMORPG's, lost or stolen items or money are usually restored immediately without fanfare and without going through data recovery. The CSRs there just look through a transaction log to see what happened and correct the problem. I don't know why FFXIV can't do the same thing.

---

I know you're the victim here, but those scams are as old as WoW and I'd like to know how you fell for it this time. Unless it just happens so frequently in WoW that they can just get back to you.

Quote:

---

Originally Posted by Penthea

OP I'm curious, after years of being careful about suspicious links, what was it about the one that gave you trouble that made you break your habit of ignoring them?

---

That is a good question I am also curious. I also ignore them but if someone else that has largely ignored them and was convinced otherwise would like to know if they changed up anything to make it seem more realistic.

Perhaps a dose of curiosity and temptation? The current popular chat link scam whispers people that they should go to the forums and vote against some update that's gonna wreck the game. While I'm pretty sure this is supposed to convey urgency to a player, the latter might just wonder intensely what this "update" is all about.

Quote:

---

Originally Posted by SenorPatty

Perhaps a dose of curiosity and temptation? The current popular chat link scam whispers people that they should go to the forums and vote against some update that's gonna wreck the game. While I'm pretty sure this is supposed to convey urgency to a player, the latter might just wonder intensely what this "update" is all about.

---

Maybe. But one look at the actual link in the search bar is all one needs to see whether it's legit or not, though I have never seen or heard of one that actually has been legit to begin with.

The security token doesn't protect you against theft. It greatly reduces the chance for your account to be compromised when you use caution in visiting websites.

The security OTP has a short duration it's valid for. It's not going to protect the account if the scammers are immediately trying to access the game account after the player enters their account information at the phishing site (which is exactly what these scammers have been doing to many players).

It would be nice if the customer service team was better equipped to handle account compromises but it is what it is. If you have any level 80 characters, I would suggest joining map parties the first couple of weeks after 5.3's release. Those will be a very good way to make gil quickly as rich players will pay millions to get the new items being added to the Zonureskin maps.

Quote:

---

Originally Posted by SenorPatty

Perhaps a dose of curiosity and temptation? The current popular chat link scam whispers people that they should go to the forums and vote against some update that's gonna wreck the game. While I'm pretty sure this is supposed to convey urgency to a player, the latter might just wonder intensely what this "update" is all about.

---

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

Quote:

---

Originally Posted by Awha

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

---

They've still been linking the same .xyz domain from what I've seen, so nope, they haven't actually changed their tactics at all.

SE should start only allowing Links to certain sites.

If it ain't from a site that is legit then it won't post it. I have seen websites do this.

Quote:

---

Originally Posted by KageTokage

They've still been linking the same .xyz domain from what I've seen, so nope, they haven't actually changed their tactics at all.

---

The last one I got had a switch to a .ru domain.

Still a red flag for anyone who has a basic understanding of how web addresses are formatted, meaningless to those who don't.

Quote:

---

Originally Posted by Zeonx

SE should start only allowing Links to certain sites.

If it ain't from a site that is legit then it won't post it. I have seen websites do this.

---

It's not an actual link. It's just a character string as far as game chat is concerned. They have to be careful what gets auto-silenced so it doesn't interfere with legitimate player communication.

Quote:

---

Originally Posted by alocsin

In World of Warcraft, among other MMORPG's, lost or stolen items or money are usually restored immediately without fanfare and without going through data recovery. The CSRs there just look through a transaction log to see what happened and correct the problem.

---

How does that even work btw ?

Let's suppose the player A stole 20 millions gils from me, and spend them on crafted stuff on the market board who has been made by B. B being an honest player who did work hard to do the crafted stuff he is putting on sale. Also prices for this stuff are quite high at the moment.

If the 20 millions are given back to me, are they deleted from B's account while he did nothing wrong ? Or does B keep them while the gils i get back are created out from nothing (in which case i don't doubt that some people will fake some robbery where they will be A and B at the same time to get twice the gils) ? Or does B get back his crafted stuff, but some days later (because my request will take some time to process), which can hurt him if in the meantime market board prices did crash ?

Just asking because depending on how it is handled, there might be some problems who make the "if you get tricked it's all on you !" answer easier to give.

Quote:

---

Originally Posted by Kleeya

How does that even work btw ?

Let's suppose the player A stole 20 millions gils from me, and spend them on crafted stuff on the market board who has been made by B. B being an honest player who did work hard to do the crafted stuff he is putting on sale. Also prices for this stuff are quite high at the moment.

If the 20 millions are given back to me, are they deleted from B's account while he did nothing wrong ? Or does B keep them while the gils i get back are created out from nothing (in which case i don't doubt that some people will fake some robbery where they will be A and B at the same time to get twice the gils) ? Or does B get back his crafted stuff, but some days later (because my request will take some time to process), which can hurt him if in the meantime market board prices did crash ?

Just asking because depending on how it is handled, there might be some problems who make the "if you get tricked it's all on you !" answer easier to give.

---

For RMT activity (provided they find you guilty of it) I've heard that SE takes your gil, takes your gear and essentially tosses you back into the game with nothing. Guessing something similar for hacked activity?

Quote:

---

Originally Posted by Jojoya

The last one I got had a switch to a .ru domain.

Still a red flag for anyone who has a basic understanding of how web addresses are formatted, meaningless to those who don't.

---

I guess they might've finally gotten blocked by the ones hosting the .xyz domains because their scam websites had apparently gotten shut down several times already.

The new .ru domain doesn't really surprise me considering that the website info was previously noting that the IP address was Russian.

Forgive me - out of morbid curiosity, how does this work exactly?

Did the OP have his account comprised and gil stolen through illegal access to his account? Is it a key-logger situation? Did they hand it over to some shady third party?

It’s less of “they can’t” and more of a “they don’t want to”.

I have seen the back end of FFXI, and if that is any indication, GMs have varied levels which give access to a variety of commands..somewhat similar to Minecraft creative mode..but less UI.

So it would be as simple as checking the log, confirming what happened and then doing a /setgil or /addgil command.

That said, it’s a hell of a lot of work to dig through the logs for the GMs, and not their responsibility to fix player mistakes.

Not trying to sound unsympathetic my friend- your situation absolutely sucks, but SE is under no obligation to fix your situation.

...that said I do think they should police or ban RMT quicker....

Quote:

---

Originally Posted by Ilyrian

Forgive me - out of morbid curiosity, how does this work exactly?

Did the OP have his account comprised and gil stolen through illegal access to his account? Is it a key-logger situation? Did they hand it over to some shady third party?

---

It's a chain scam where the scammers will send someone a tell with a link to a fraudulent website that's supposedly a forum post, but instead leads you to a phony log-in page that's sketchy as all heck; particularly due to it not being a secure website (Which immediately gets it blocked by any half-way decent internet security program). It's also not redirecting to the supposed forum post in the web address and demands your OTP at the same time as your account name/password, which the official log-ins do NOT do (They prompt for the OTP after verifying account name/password are correct).

If you're gullible enough to attempt to log in, they have a bot set up to immediately log into your account via Mogstation and change your password, afterwhich they'll strip your account (And FC if you have permissions) of gil before using it spam other players with links to the scam website until the GMs inevitably suspend your account.

The thing I'm curious about is whether or not the GMs bother tracing the stolen gil back to the "bank" account they're sending it to so they can purge it and reduce/prevent any potential RMT sales.

Quote:

---

Originally Posted by Awha

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

---

Probably just curiosity and a bad assumption that this game has easy account/item/currency recovery options like World of Warcraft does.

Every time I get some kind of scam message, text or anything there's a part of me that wants to take it as far as possible just to see how believable the phishing site is and how it all comes together.

Quote:

---

Originally Posted by Goji1639

Probably just curiosity and a bad assumption that this game has easy account/item/currency recovery options like World of Warcraft does.

Every time I get some kind of scam message, text or anything there's a part of me that wants to take it as far as possible just to see how believable the phishing site is and how it all comes together.

---

Not going to lie I have toyed around with the idea of buying another account and checking it out for myself.

I HIGHLY suggest people head to the real Square Enix website to see what it looks like. I find once people sihn up for the game, they never look at it again.

Quote:

---

Originally Posted by Penthea

OP I'm curious, after years of being careful about suspicious links, what was it about the one that gave you trouble that made you break your habit of ignoring them?

---

This current announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

Quote:

---

Originally Posted by alocsin

This announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

---

To be completely fair, that is already in your chat officially the second you log into the game, though not in /tell form. They would have no reason to message you about it privately, which they never have with anyone regarding these things as far as I'm aware.

Quote:

---

Originally Posted by MariaArvana

This. They have one-time item restore per account available, but thats for a single item. If you want to recover everything, the data rollback is basically your only option.

---

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

Quote:

---

Originally Posted by alocsin

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

---

Yeah, their restoration systems leave a lot to be desired.

Quote:

---

Originally Posted by Vahlnir

To be completely fair, that is already in your chat officially the second you log into the game, though not in /tell form. They would have no reason to message you about it privately, which they never have with anyone regarding these things as far as I'm aware.

---

Yea system messages appear automatically and don't have a player name next to them because...the server isn't a player! Even by default system messages are a completely different colour to private tells.

Quote:

---

Originally Posted by alocsin

The only thing I lost was gil, so I'm not sure why they don't allow the one-time item restore on that. Maybe they consider a million gil a million items.

---

That...really really sucks. Also thanks for answering my question about why you checked out the link.

Quote:

---

Originally Posted by Awha

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

---

If it's the one I'm thinking of, it can look very much like a real forum link at first glance (right downto the usual /ffxiv/threads/<numbers>-<title-breadcrumb> path), if you don't notice that the URL uses something like "com.xyz", instead of just ".com" in the hostname; just skimming over the link visually can be enough to look valid to someone tired/stressed—an unfortunately common situation right now given this whole "global pandemic" thing—even when they know better.

I've seen commentary from other normally-cautious players who were caught off-guard by the link on a day when they were tired/stressed, logged in, and got the /tell and saw a URL which their brain processed as "yeah, that looks like a real forum link", went "Huh, what fuss are people raising now?" and copied/pasted it in before their brain kicked in and they went "Oh crap no wait." Thankfully, most I know of caught themselves before entering login information ("Hey, wasn't I logged in on the forum already?") and others caught themselves when they hit a password autofill using 1Password/Keepass/LastPass/whatever and it didn't show a valid user/password for that site (which made them look at the address bar and go "Oh wait that's not the real site").

Quote:

---

Originally Posted by alocsin

This current announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

---

FWIW, anything Square-Enix links to in-game will show up in the server MOTD, and in-game URLs will pretty much always use the sqex.to URL shortener. But yes, having SE already providing official links to events there can contribute if folks are already a little hazy due to stress or exhaustion.

That said, I highly recommend using a password manager, and using it to log in to sites (as noted above). If you ended up on a scam site, even if you were tired/not paying as close attention, hitting 'Autofill' will show no password for the site, which is usually enough to shock people back out of complacency and make them look at the URL in the address bar more closely.

Regardless, sympathies. :(