Friend Account Hacked

Earlier today, my friend's account was "hacked" moments after our FC had a falling out and minutes after he was assigned a rank that could withdraw gil from the FC chest. I asked in nn and this happened to at least 1 other person. 28 million gil was stolen. Has anyone experienced this? Is it possible some salty member of the FC hacked his account or is this completely coincidental? Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

Sounds to me as if your friend clicked on links in suspicious tells and willingly gave away his data to a Phishing Scam which allowed someone to log into his account... and that access just had a lucky timing.

In any case your friend should reset password asap.

Good morning and thank you for posting in the Final Fantasy XIV Technical Support Forums.

We apologize for any inconvenience that has occurred when playing Final Fantasy XIV. Unfortunately the issue you are describing is not a technical issue. We will be moving this thread to "General Discussion".

Good luck with your adventures through Eorzea!

Sooo ...

1. Ask your friend if they have received any tells talking about getting gil or doing a poll or something, that included a link to a 'Square Enix' or 'other' website. If so, and they went there, their information was given to a third party who now has their log in info. Get your friend to change their password, and educate them on not going to suspicious links, or links in tells. Also, have them scan their entire PC or viruses, malware, spyware, and all that jazz. No quick scan either. Full scan.

2. Ask if they went to any Twitch streams for FF14 and clicked any links within such chat. See #1 above if so.

3. If what you say is true, your friend either already gave such log in information to their family member, or left it in a place where it could be found. Now if that is the case, then your friend must not have an authenticator attached to their account, as it would be needed as well as their log in and PW.

And, why are they not using Two-Factor Authentication? Not only is it free, but even gives some perks in game. Not to mention, adding security to an account online is just... common sense to do anymore.

2FA won't protect you from this particular scam as it also demands that on a phony log-in page.

It's kind of sad that people fall for this so often and they need to learn it is not normal for complete strangers to be trying to goad you into going to a link without malicious intent.

My advice is that the only one who should have access to FC gil, is the leader only.

Yes this happened to us about 2 months ago. An officer clicked on a phishing link in all innocence and got their account hacked. I fully trust my officers, but giving others access is running a great risk. I see that now and learned the hard way. It takes just one person that has access to the gil to get their account hacked. Rmt will instantly wipe out the hacked account and the FC gil too if that hacked account has access to ranking in the Estate settings. They can promote themselves to those ranks with gil access. It's one way RMT earns their gil to sell in city states.

SE did reimburse her, her gil, but the FC was out of luck. SE's view is FC's that give gil access to any of it's members other than the leader, and the FC is responsible for the FC losses.

Best thing is to make your FC aware of these phishing scams via your FC's discord channels and have only the leader access to FC gil. Good luck OP in the future.

Quote:

---

Originally Posted by Repulse97

...minutes after he was assigned a rank that could withdraw gil from the FC chest.

Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

---

Who gave him the promotion?

Were he and the FC leader on the same side of the argument?

Without knowing anything about the trustworthiness of either individual, the fact that they live together opens up more opportunities for a deliberate hack, either through better access to security-question answers or getting hold of the other person's device.

It's also possible (if not necessarily likely) that it wasn't a hack at all but deliberate revenge, either by the gil-taker alone or working with the FC leader, then excusing it with "I didn't really do it, I was hacked!"

Quote:

---

Originally Posted by Repulse97

Earlier today, my friend's account was "hacked" moments after our FC had a falling out and minutes after he was assigned a rank that could withdraw gil from the FC chest. I asked in nn and this happened to at least 1 other person. 28 million gil was stolen. Has anyone experienced this? Is it possible some salty member of the FC hacked his account or is this completely coincidental? Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

---

So what actually happened here? Was your friend assigned a high rank and took the money? Or was your friend's account used to assign a high rank to someone else? Were they online when this happened? If it was your friend who took the money, was it then transferred somewhere else? Did they lose anything of their own?

In any case, actually getting hacked, meaning someone accessing either SE's servers or the victim's computer without authorization, is exceedingly rare. The usual thing is that the victim divulges their credentials to a fake login prompt, enabling the perpetrator to steal their identity. I've heard that even 2FA doesn't always help against this since the fake sites can recreate the 2FA interface and get the code. They can only use it to login into the game once, but once is enough to steal gil and items. The only real defense is to be vigilant whenever credentials are asked and never to trust any links, especially those given to you by strangers.

Quote:

---

Originally Posted by Repulse97

Earlier today, my friend's account was "hacked"

---

It's actually possible to view the IPs of the last 10 logins on an account:

https://secure.square-enix.com/

Then click "Account" in the top left corner, then "Login History".

Quote:

---

Originally Posted by Iscah

Who gave him the promotion?

---

Yes this is the big question.

It'll be in the FC activity log who changed the rank. If they changed it themselves, then that means the FC leader had already given them the "Promote" ability, which is not a good thing to give out as someone can just change their own rank.

Quote:

---

Originally Posted by Iscah

It's also possible (if not necessarily likely) that it wasn't a hack at all but deliberate revenge, either by the gil-taker alone or working with the FC leader, then excusing it with "I didn't really do it, I was hacked!"

---

I agree with this too. I appreciate that I don't know the poster or their FC, but it seems very suspicious that this happens immediately after an argument. The timing is just too coincidental.

People have to be soooo careful about FC permissions, not just who can handle the gil but even more so who has permissions to “promote/demote”. This has brought a lot of FCs down because someone who is at the lowest level can promote someone to FC master (possibly even themselves) and then change everything, clear out the chest and gil, get rid of all other members and take over the FC house and even close down the FC all together. It has happened more than once because the ‘promote/demote’ permission default is a problem. So everyone please be careful, watch those those permissions and remove the ability to promote for most players.

Quote:

---

Originally Posted by NekoHina

someone who is at the lowest level can promote someone to FC master

---

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

Quote:

---

Originally Posted by tdb

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

---

Only the FC master can pass lead. If you attempt to do so as any other rank, the tooltip tells you that you can't. Anyone else with promotion permissions can, however, promote anyone to any rank outside master.

The way it's been explained to me (and really it's the only way it remotely made any sense to me) is that other than the master rank, the rest are all considered the same rank technically by the game, the leader just assigns those ranks different permissions depending on what they want that rank to be. The order of the ranks can be changed at any point. So to the game, promotion just means they're changing their rank horizontally. Because of this, only I and my one officer (who I trust completely) have to ability to both access the gil in the FC and promote/demote. We don't keep all that much gil in the chest, but I wasn't going to take any chances.

I do think over all that it's an extremely flawed system and creates issues like this where a hacked account can cause a lot of damage, and I wish it could be changed to an actual tiered hierarchy like it should be.

Quote:

---

Originally Posted by tdb

Seriously? I had thought the master rank was out of limits for normal promotions and only the master could choose a successor for themselves. But even without that it pretty stupid that the promote permission allows one to grant others any rank regardless of one's own. In every other permission system I've seen it's only possible to manipulate lower ranks (so if the ranks are master, officer, member and recruit, then officers can promote/demote members and recruits but can't promote anyone to officer and can't demote other officers).

---

The issue is with how SE makes the default settings for each rank when an FC is created. They make it (IIRC) that each rank can do everything pretty much. It is on the FC creator to fix each rank's permissions right away.

Quote:

---

Originally Posted by AngelCheese77

The issue is with how SE makes the default settings for each rank when an FC is created. They make it (IIRC) that each rank can do everything pretty much. It is on the FC creator to fix each rank's permissions right away.

---

Exactly and most people do not check permissions. It can lead to some bad situations. SE should make the default with no permissions instead of all of them allowed at the start. It makes no sense.

Quote:

---

Originally Posted by NekoHina

Exactly and most people do not check permissions. It can lead to some bad situations. SE should make the default with no permissions instead of all of them allowed at the start. It makes no sense.

---

I think SE doesn't want to baby us.
It's our FC's we run them as we wish. It also absolves SE of liability, though they'd probably have some way around it regardless of default settings.

I could be wrong here, but from memory it creates three ranks automatically and the default rank isn't a threat.

The three ranks as I remember it: The main FC leader rank, an officer rank which does have the permissions and a default rank which everyone gets which doesn't have any big permissions.

If the FC leader changes someone to the officer rank without them first changing the actual officer permissions, then this could happen.

Perhaps you're too quick to believe it was a hack. It sounds like after the falling out, he stole it and claimed he was hacked.

Quote:

---

Originally Posted by Canadane

It's our FC's we run them as we wish. It also absolves SE of liability, though they'd probably have some way around it regardless of default settings.

---

How does giving too broad permissions by default absolve SE of liability? If it doesn't occur to players to check them, doesn't that make SE responsible? Seems to me that setting safe permissions by default would be the thing to do to avoid liability.

Or did the "it" which absolves them refer to something else?