Success getting Gil restored that was removed by a compromised account?

Has anyone found any?

Our FC has been saving up for (hopefully) a large plot with some extra for furnishings come Endwalker.1. We had precisely 70,000,000 Gil saved up in the bank, ready and waiting for that first content patch to release the Firmament to us.

Enter the compromised account.

FC member falls for a phishing scam. He notices and immediately requests a character rollback. A few days later, I notice that the chest had been emptied. We both put in tickets - he is told to wait until his restoration is resolved, I am told that I can't put in a ticket on his "behalf."

Weeks later, the restoration is completed. But the Gil? Nowhere to be seen (and to get ahead of it, this guy is an IRL friend - he didn't swipe it and keep it). At this point, I take a look to see what other steps he can take. Going over the fine print of the restoration form, I note the following: "Therefore, please note that any items or gil which you acquired after the account was compromised will be permanently lost."

Obviously, the "hacker" would have withdrawn the Gil after obtaining access to the account, and the restoration process would restore the account to the point at which it was compromised (right before the withdrawal was made). As such... did we lose all that Gil permanently?

Has anyone with a similar situation had any success in actually recovering the Gil or items? I can't say my previous experiences with FFXIV support has me confident...

Quote:

---

Originally Posted by Berkilak

I can't say my previous experiences with FFXIV support has me confident...

---

Yeah, there's not much hope here, I'm sorry to say.

You can keep nagging support/GMs, or perhaps see if you can get a reddit thread to get enough traction to be noticed... but it most likely won't be resolved. Sorry to hear about your situation.

Quote:

---

Originally Posted by Risvertasashi

Yeah, there's not much hope here, I'm sorry to say.

You can keep nagging support/GMs, or perhaps see if you can get a reddit thread to get enough traction to be noticed... but it most likely won't be resolved. Sorry to hear about your situation.

---

Their support is so strange... you get 99% copy/paste responses, but once in a blue moon, you get someone that absolutely combs through the logs to help you out. I suppose it comes down to keeping a line cast hoping for that rare bite.

Unfortunately unless the gil was on his character, you won't get it back.

If he (the phisher) invited someone to the fc who took it, you are sol.

Quote:

---

Originally Posted by Berkilak

Their support is so strange... you get 99% copy/paste responses, but once in a blue moon, you get someone that absolutely combs through the logs to help you out. I suppose it comes down to keeping a line cast hoping for that rare bite.

---

That's a good way to put it. Not just combing through the logs, though - SE is a very much a "letter of the law > spirit of the law" kind of company so it's also about their internal policies, and can the person you're talking to find a way to do it within policy or get an exception made. If it's not something cut and dry they have a specific form for, 99% of the time, you're out of luck.

But occasionally reddit or similar can pressure them into exceptions.

Pro tip: Do not give anyone, not even your spouse, access to the guild bank. Or stuff like this can happen.

SE will not restore stolen gil from an fc bank, just like they will not restore a house that was dismantled. From the replies other ppl have gotten about the same issue, SE leaves that up to the fc to safeguard and if you give access to your gil to multiple ppl, you are forfeiting it if its stolen.

Quote:

---

Originally Posted by Valkyrie_Lenneth

Unfortunately unless the gil was on his character, you won't get it back.

If he (the phisher) invited someone to the fc who took it, you are sol.

---

The gil was removed by the compromised character and not a proxy, "thankfully." It seems pretty cut and dry to any onlooker. The time the account was compromised was identified by FFXIV support. The withdrawal was made thereafter. But since he instantly went to the "restore character" route (understandably), we're seemingly screwed.

It's so obvious to anyone with the slightest capacity for thought what happened. It is beyond frustrating that they'd refuse to restore the gil because of a technicality. No wonder I'm seeing more gold selling spam recently when they're implicitly enabling the practice...

Quote:

---

Originally Posted by MicahZerrshia

Pro tip: Do not give anyone, not even your spouse, access to the guild bank. Or stuff like this can happen.

SE will not restore stolen gil from an fc bank, just like they will not restore a house that was dismantled. From the replies other ppl have gotten about the same issue, SE leaves that up to the fc to safeguard and if you give access to your gil to multiple ppl, you are forfeiting it if its stolen.

---

I've long since given up on this route, because of the reasons you stated.

We'd be perfectly content with the gil being restored to the character it was ultimately stolen from, instead of him being reverted to the wallet amount he had before the compromise.

Quote:

---

Originally Posted by MicahZerrshia

Pro tip: Do not give anyone, not even your spouse, access to the guild bank. Or stuff like this can happen.

SE will not restore stolen gil from an fc bank, just like they will not restore a house that was dismantled. From the replies other ppl have gotten about the same issue, SE leaves that up to the fc to safeguard and if you give access to your gil to multiple ppl, you are forfeiting it if its stolen.

---

There's a difference between "Someone with proper authorization withdrew the money and I want to retroactively cancel it" (Your examples) and "Someone literally hacked an account to get access."

Not that it'll make a difference to SE. But the two situations aren't the same.

Quote:

---

Originally Posted by Risvertasashi

There's a difference between "Someone with proper authorization withdrew the money and I want to retroactively cancel it" (Your examples) and "Someone literally hacked an account to get access."

Not that it'll make a difference to SE. But the two situations aren't the same.

---

And again, we'd be fine with the gil being restored to the character that withdrew it. It doesn't have to be added back directly to the FC chest. I've already been rebuffed on that front...

Quote:

---

Originally Posted by Risvertasashi

But occasionally reddit or similar can pressure them into exceptions.

---

To this point specifically, I think I'd need to commission a portrait of a dramatization of the theft (with a few additional scantily-clad femroes thrown in) if I wanted to get any sort of attention on reddit...

Quote:

---

Originally Posted by Risvertasashi

There's a difference between "Someone with proper authorization withdrew the money and I want to retroactively cancel it" (Your examples) and "Someone literally hacked an account to get access."

Not that it'll make a difference to SE. But the two situations aren't the same.

---

I wasn't saying they were. SE doesn't know if an account was hacked, it would be ridiculously easy to fake and make SE your very own gold press. Also if that money is no longer on the hacked account and instead went to buying items and what not off the mb or a house or something of that sort, what is SE supposed to do? Go back and nullify all those transactions and restore it all? That would be a nightmare and effect a whole lot of likely innocent players. It's not as simple as typing in a couple commands. There is a lot to consider here which is why SE has these sort of policies.

Just stop giving ppl access to your bank.

And for the love of all that's good, it's 2021, most of us grew up with or learned computers and basic internet interactions at a young age, so why on earth would you ever clink a link sent to you by some random player? That's like opening a link that is emailed to you from your bank saying there is something going on with your account or they are having a raffle or anything of the sort. Never click links, especially from strangers, is internet 101.

Quote:

---

Originally Posted by MicahZerrshia

And for the love of all that's good, it's 2021, most of us grew up with or learned computers and basic internet interactions at a young age, so why on earth would you ever clink a link sent to you by some random player? That's like opening a link that is emailed to you from your bank saying there is something going on with your account or they are having a raffle or anything of the sort. Never click links, especially from strangers, is internet 101.

---

The rest of us were just as flabbergasted. Dude is smart. Educated. Didn't expect that lapse in judgement.

And if the compromised account bought a bunch of stuff, that's immaterial. They verified that the account was compromised. They aren't being "scammed." Delete those items on the rollback, but give the person back the gil as well. No one is getting hacked and being given gil. Moreover, we both know that gil didn't go toward MB purchases - it went to a dummy account for a gold-selling service. Let's not let some hypothetical, far-flung, and ultimately unrealistic situation get in the way of giving your players actual support.

As for locking up the bank... it's done now. Doesn't help in retrospect, though. It would be absolutely asinine to have to completely shut out a group of a dozen or so IRL friends and family... but apparently that's a hard truth the players had to realize when SE left them cold after experiences like this. But it shouldn't be this way.

Quote:

---

Originally Posted by Berkilak

They verified that the account was compromised. They aren't being "scammed." Delete those items on the rollback, but give the person back the gil as well. No one is getting hacked and being given gil. Moreover, we both know that gil didn't go toward MB purchases - it went to a dummy account for a gold-selling service. Let's not let some hypothetical, far-flung, and ultimately unrealistic situation get in the way of giving your players actual support..

---

In this case, most likely yes. But that is not always the case and in game money, just like real world money, can be laundered. And they already have enough on their hands dealing with hackers and rmt, all they need to throw into the mix is adding a gil laundering ring.

I am not trying to start an argument here, but we really need to take a moment to understand why they have policies like this in the first place. It's not so cut and dry as we verified your account was hacked, here is your money! Thank for using SE customer service.

Quote:

---

Originally Posted by MicahZerrshia

In this case, most likely yes. But that is not always the case and in game money, just like real world money, can be laundered. And they already have enough on their hands dealing with hackers and rmt, all they need to throw into the mix is adding a gil laundering ring.

I am not trying to start an argument here, but we really need to take a moment to understand why they have policies like this in the first place. It's not so cut and dry as we verified your account was hacked, here is your money! Thank for using SE customer service.

---

Let's not forget this this is a video game. This kind of policy makes sense in reality. But in a fictional setting wherein your players are simply trying to enjoy your game? And the worst case scenario is that you give a couple devious players a little more fictional currency? This is much too draconian.

If they can take a look at the login logs, see that weird IP address from halfway around the world... there's your evidence. If they're accessing at a strange time or doing weird things (like emptying their FC chest and giving away all their items, for instance), anyone with half a brain can draw the correct conclusion. If a few people get convoluted with VPNs and the like and they get a few extra gil... so what? The harm these kinds of policies do to to the otherwise boundless amount of goodwill FFXIV has isn't worth it.

Quote:

---

Originally Posted by Berkilak

Their support is so strange... you get 99% copy/paste responses, but once in a blue moon, you get someone that absolutely combs through the logs to help you out. I suppose it comes down to keeping a line cast hoping for that rare bite.

---

My gut feeling is that it comes down to the support team being overworked about 98% of the time -- so roughly 98% of the time you get someone who's having to blitz through tickets doing the generally-approved-process for stuff -- and then like 2% of the time you have hit them during the rare moment that they're not buried under some avalanche, and so the CS person really gives that ticket some serious personal attention and focus. :(

Unfortunately, my other gut feeling is that restorations track "prior to account compromise, the account had X resources" and give the CS folks just that number to work with, because I gather that many times, the compromised accounts may be used as mules (pick up gil from some other account, transfer it to someone who bought gil via RMT or whatever to try to obscure the transaction sources a bit more), and they don't want to mix in gil that passed through the compromised account with the account's own actual gil (which was probably otherwise added to the RMT folks' gil-to-sell money vault).

But worse, what I've seen happen with FCs hit by this -- both via tales from an affected friend, and threads here and on reddit -- is that it isn't the compromised account that takes the gil. The automated system that acts on phishing information appears to do something akin to:

1. Person gets phished, enters enough information for the automated system to log in as them.
2. Automated system checks if they are a member of an FC. If they are -- and are an officer -- zip them to the nearest company chest in a starting city.
3. Deposit all gil from the compromised account into the FC chest.
4. Invite another compromised account (Account #2) that's already waiting by an FC chest to the FC, and give them officer permissions.
5. Account #2 withdraws all gil from the FC chest, and then immediately leaves the FC.

All of which seems to be an automated process designed to obtain as much gil from the victim and their FC as quickly as possible, while also keeping the actual gil transactions from being gathered into any sort of automated log. After all, the compromised account just put the gil into the FC chest; it's someone else, wholly unrelated to that affected account, who took all the gil out.

It sucks, too, because it's depressingly easy for even a smart, savvy player to have a moment of The Dumb when tired. Someone pastes a link that, when you skim it visually, looks like the appropriate forum link at first glance, and then you just think "ugh, the forums logged me out again" when presented with a login screen. There are tells, of course; the phishing pages evidently put the OTP prompt on the same page as the login/password, because they can't do the 'login and then check if you need to provide an OTP' that the real forums can. And if you use a password manager and just hit 'enter password' on webpages rather than typing it manually, it will obviously refuse to fill the password (because it's on some random phishing page for which you have no login, not the actual forums).

(So, side note: I strongly recommend using password managers and letting them fill in passwords, because they do string comparison on domains and won't be fooled by visually-similar website addresses.)

That said, if your scenario is different than the one described above and the person whose account was compromised was also the one who withdrew the gil from the FC chest, I'd say that you might have a better chance at it -- since those transactions would be, presumably, preserved in the logs associated with the incident. In that case, I might keep trying on ticket submission.

(Can you tell that I used to work in the games industry, and had to think about how to track this sort of stuff, what the people doing it were likely to do, and how to counter it? I would like to reformat that part of my brain to reclaim the space...)

Quote:

---

Originally Posted by Packetdancer

That said, if your scenario is different than the one described above and the person whose account was compromised was also the one who withdrew the gil from the FC chest, I'd say that you might have a better chance at it -- since those transactions would be, presumably, preserved in the logs associated with the incident. In that case, I might keep trying on ticket submission.

---

It was indeed the compromised (and subsequently restored) character that removed the gil. The withdrawal is still visible in the in-game chest activity log, and I took a screenshot just to preserve it. Here's hoping!

Quote:

---

Originally Posted by Berkilak

It was indeed the compromised (and subsequently restored) character that removed the gil. The withdrawal is still visible in the in-game chest activity log, and I took a screenshot just to preserve it. Here's hoping!

---

I'll admit I'm still not holding my breath that you'll get the gil back, unfortunately. But I'd be marginally more inclined to maybe consider holding said breath than I would be if it were a secondary character who did the withdrawal.

Good luck, regardless!

Quote:

---

Originally Posted by Berkilak

(and to get ahead of it, this guy is an IRL friend - he didn't swipe it and keep it).

---

See the thing is, how can you prove to Square Enix's devs (or for that matter any game's devs) that you and your friend did not fake an account theft, agree to remove the money out of the chest, trade it to another FC friend for safekeeping, request a rollback for the FC money and then retrieve the money from your FC friend essentially doubling what you initially had?

Not saying it's the case here, but it's the reason why games generally don't do rollback for compromised accounts: because people can act in cahoots outside the game. SE is extremely nice in rolling back accounts that were phised when they are not in the obligation of doing so as per the ToS (it was not hacked, hack involves a failure on part of Squarenix's security whereas phised is the player's fault at failing to comply with not sharing their account information rule)

Quote:

---

Originally Posted by Risvertasashi

There's a difference between "Someone with proper authorization withdrew the money and I want to retroactively cancel it" (Your examples) and "Someone literally hacked an account to get access."

Not that it'll make a difference to SE. But the two situations aren't the same.

---

Wait, so are you saying that someone got their account phised and then whoever phised that account hacked the game code to give themselves access to FC bank? Cause that's an entirely different and more grave issue from "someone with bank access got their account phised" that would require SE to investigate their servers' security.

Literally any other MMO would have restored the currency by now. This absolute paranoia does not justify refusing to assist your player base when it is flagrantly obvious what happened.

I checked back in on Aion recently and even their support was leagues better that Square’s. That shouldn’t be acceptable to anyone playing this game, especially as FFXIV gains popularity.

Paranoia is not a bad thing. It's what keeps people from clicking on "I'm leaving the game and throwing a 500M gil raffle" links.

And again, it's not flagrantly obvious. I can very easily contact you through Discord or any other 3rd party app, give you my account name and password and then claim that my account info was stolen. From SE's side they will verify that indeed my account was logged in from a different IP/region/through different nodes than what it usually logs in, but that is not certain proof that it was phissed. I know this for a fact because this happened to a friend in TERA whose ex (then boyfriend) decided he was not playing the game anymore so he left my friend his account and password and after they broke up IRL he sent a ticket saying his account was hacked and Enmasse restored the account to him and my friend lost all the items and money he had put into that account.

Quote:

---

Originally Posted by Berkilak

Literally any other MMO would have restored the currency by now. This absolute paranoia does not justify refusing to assist your player base when it is flagrantly obvious what happened.

I checked back in on Aion recently and even their support was leagues better that Square’s. That shouldn’t be acceptable to anyone playing this game, especially as FFXIV gains popularity.

---

I've had accounts on 2 MMO's in the past that had items and money stolen from them due to compromise that was actually caused by a confirmed database leak or compromise on the provider's end (numerous accounts effected all at once).

I had to wait over a month before the restoration was completed on either of them and by then I had lost interest in those games and moved on to something else. I believe Aion's publisher was NC soft and one of the games involved in my scenario was another title published or hosted by them.

At the very least, a reply that actually takes into account the specifics of the case should be warranted. Not a copy/paste reply that is only tangentially relevant and has me questioning if they’re even read or understand the issue.

Quote:

---

Originally Posted by lezard21

Wait, so are you saying that someone got their account phised and then whoever phised that account hacked the game code to give themselves access to FC bank? Cause that's an entirely different and more grave issue from "someone with bank access got their account phised" that would require SE to investigate their servers' security.

---

I think Rivertasashi was trying to draw a distinction between "someone in the FC was given access to the chest, then that person stole all the gil" versus "someone not in the FC obtained illicit access to an account that is in the FC (via phishing or whatever) and then used that compromised account to take all the gil". Both are problems, and both result in "the FC lost all their gil". But you might be able to make a stronger case trying to justify the latter being reversed.

Unfortunately, from a pure FC-chest-transaction-log standpoint, the two are functionally identical.

The good news is your friend will get reimburse the gil they were out. The bad news you can kiss the FC gil goodbye. SE see's this as the fault on the leaders part for giving access to FC funds to any other, but the leader of the FC. How do I know this? It happened to me and one of my officers who is a irl friend awhile back. The FC had 29 million gil taken from the Company Chest.

I change the access to FC to only myself now and everytime I see a post like this concerning someone getting hacked/pished I speak up in those threads too. Do Not give gil access to officers, friends,your dear Memaw or anyone other than the leader of the FC. This isn't about a trust issue, you jepordize the FC gil when you do and SE won't be responsible for it.

Fortunately my friend/officer reimburse what the FC was out over time and she did that on her own without a word or me asking her to.

To add the person with the hacked account, they invites an accomplise partner into the FC with the hacked account they are now on. Then the phisher ranks them if they need to, to the rank of whatever rank has access to the FC's gil in the Company Chest. It's all rather a neat and tidy crime. You can probably even see the Company Chest History to see exactly who took it, but still SE won't reimburse the FC gil ,saying it was the leaders fault for giving anyone access other than the leader.

Oh and one more thing. SE saying that any gil earned by your friend after the incident will be lost is because of the rollback your friends account will get. That includes gear, items or any gil after he regains control of his account. It can take up to a week to 10 days to rollback. Your friend just needs to be patient for that long.

Quote:

---

Originally Posted by Berkilak

And again, we'd be fine with the gil being restored to the character that withdrew it. It doesn't have to be added back directly to the FC chest. I've already been rebuffed on that front...

---

Was the FC's gil in on your friend's account/retainer? Then there is a chance, but if it got taken from the Company Chest directly sadly it's gone. Yep and I still have my screenshot of the gil being taken by someone with the initials A. L. being the culprit. Won't give the full name due to forum rules. If your friend's compromised account hacker took it out of the Company Chest, with the friends character than maybe, but I doubt it. The Leader Only rule may still apply. Yes this is RMT's little racket they got going.

Quote:

---

Originally Posted by Arazehl

Oh and one more thing. SE saying that any gil earned by your friend after the incident will be lost is because of the rollback your friends account will get. That includes gear, items or any gil after he regains control of his account. It can take up to a week to 10 days to rollback. Your friend just needs to be patient for that long.

---

That's the thing - they rolled back their character without really reading the fine print or checking to see if the FC chest was compromised. So their character did withdraw the 70 million, but then they rolled back their character to right before they did so.

Quote:

---

Originally Posted by RitsukoSonoda

I've had accounts on 2 MMO's in the past that had items and money stolen from them due to compromise that was actually caused by a confirmed database leak or compromise on the provider's end (numerous accounts effected all at once).

I had to wait over a month before the restoration was completed on either of them and by then I had lost interest in those games and moved on to something else. I believe Aion's publisher was NC soft and one of the games involved in my scenario was another title published or hosted by them.

---

I remember my account of Lineage II got stolen because the publisher got data leak. Lost most of my stuffs and in game currency, contact the CS team and never get any rollback

Pretty sure the general stance is:

If you gave someone permission to take money out of the chest through the FC and that person used that power to remove funds, it's basically your problem. Square views that as fine and dandy because you gave their character the original permission. This is why it's strongly encouraged to ONLY give those perms to the owner of the entire FC and make sure they're educated on how these scams work.

Quote:

---

Originally Posted by LianaThorne

Pretty sure the general stance is:

If you gave someone permission to take money out of the chest through the FC and that person used that power to remove funds, it's basically your problem. Square views that as fine and dandy because you gave their character the original permission. This is why it's strongly encouraged to ONLY give those perms to the owner of the entire FC and make sure they're educated on how these scams work.

---

Which is an asinine policy - they shouldn't even have the option to collectively store gil if you're essentially supposed to lock it down entirely because they do nothing to protect that gil from scams.

But here's the thing: he took the gil, fine. Should it not be restored to him on the character rollback? They overtly confirmed that his account was compromised. Why shouldn't that gil be restored to him, if not to the FC?

Quote:

---

Originally Posted by Berkilak

That's the thing - they rolled back their character without really reading the fine print or checking to see if the FC chest was compromised. So their character did withdraw the 70 million, but then they rolled back their character to right before they did so.

---

Ooooh. I'd somehow misunderstood the earlier posts; I thought the character took the gil and then gave it away while compromised. If he got the account back quickly enough that he still had the 70 million gil in inventory, but it got wiped away by the account restore before he put it back in the FC chest... ouch. Not surprising, mind you, but ouch.

Still, how account rollbacks work in most game systems (and, I would lay odds, in FFXIV as well) is they point to a specific time and go "revert all assets to this". It's not "hand back missing gil and/or items individually", it's literally "restore from backup" like bringing a hard drive back from an older image of it. Which is great in terms of not having specific items overlooked when returning things, but it's a problem in terms of it being an atomic transaction.

To put it another way, imagine the following sequence:

1. Account is compromised.
2. Person who took the account sees expensive materials in the account's inventory, gives those all away to an accomplice.
3. Person now steals all the gil from the FC chest.
4. Person gives the FC gil away to accomplice.
5. Account is reclaimed.

If you rollback the account to a point between 3 and 4, the FC gil is retained (by virtue of being in the person's inventory) but all the expensive materials are gone. If you rollback the account to between 1 and 2, all the expensive materials are back, but the gil is lost. Add to that the fact that the easy marker for "where to roll back to" is "just before the first login from the unauthorized/unusual IP address" -- i.e., to just before 1 in that list -- and you have an issue, inasmuch as the FC chest state is entirely separate from the account state, so is not affected by the rollback. (Nor should it be, honestly, because otherwise you'd lose materials people had put into the FC chest in the meantime or whatnot.) But the gil only was added to their inventory after that point.

Doesn't make this any less unfortunate -- or screw your FC over any less, I'm afraid -- but it does make sense from a technical standpoint. :/

Most of my fc has real world friends.

Only 3 of us have gil withdrawal permissions, and only 2 of us have rank permissions (or 1 outside fc leader)

Quote:

---

Originally Posted by Packetdancer

Doesn't make this any less unfortunate -- or screw your FC over any less, I'm afraid -- but it does make sense from a technical standpoint. :/

---

From a technical perspective, perhaps. But from a customer service standpoint? A human standpoint? This overwrought rigidity does no one any favours.

Quote:

---

Originally Posted by Valkyrie_Lenneth

Most of my fc has real world friends.

Only 3 of us have gil withdrawal permissions, and only 2 of us have rank permissions (or 1 outside fc leader)

---

Which is asinine to have to do to protect against shoddy customer service.

There's only a dozen or so of us in a small web of IRL connections. The bank was open because it was a collective wallet for those of us in the free company. You know: its intended use. If these permissions aren't meant to be utilized, don't have them at all.