I already sent a few tickets

But to address it so all can see. My account was hacked. That person cleaned out my retainer all the gil i had. Then joined my FC given full access. That person then cleaned out our FC chest of 138mil in gil, left our FC. I took screenshots of FC activity, FC CHEST history, and my login history on my account. Which clearly shown the person logged in from BULGARIA. I live in Ontario, Canada.

Since SE stated they NOT REPLACE FC CHEST GIL. It be only fair they ban the IP address used. It be some justice. That it not happen again from that same person.

Lastly SE should warn such tolerance will NOT be allowed and the result be to ban IP address. Which i do know they be able to trace IP addresses.

My rant is done. I won't be quiet about it either. Since this be shared on FB fan pages, Twitter, instagram and any other social media for all to see.

Banning an IP address won't do anything which is why SE won't likely do that - most home users have dynamic IP's which change over time (could be a week, a month, couple of months, but they do change), or the hacker could be using a VPN to mask their actual IP address (in which case banning that IP could result in hundreds/thousands of players getting banned/blocked). It is unfair that they can't do anything about the FC Gil, especially if there's evidence of it happening but I think I read previously that they put the security responsibility of the FC stuff on the players (granted yeah, not great if they manage to hack the FC owner and use that account to add their own character in with full rights). At most they may ban the hacker's account, though won't stop them getting a new account and doing it again.

Banning is not going to solve much. They just make a new account. What is going to solve this activity is that people do not follow links like this, to a fake account website and click on "log in".

Greed got the better of you and yeah the FC won't see a dime of that gil returned. Best thing to do there is for only the "leader" of the FC to have access to the company chest's gil.

When you get your rollback, I suggest maybe drop a good chunk of gil to the FC chest, since the fault lies in your lap. And for goodness sakes get FC leader to fix access to gil in company chest to "Leader Only"

Gil is not issue and easily get back. I am glad they not demolished the FC, which that person could had done. I NOT agree SE not reimburse the gil from FC chest. Its only a line of code they can change. With the provided evidence i given with screenshots of FC activity and FC chest history that sackofshit took the gil.

I had full rights since I am 2nd in charge. I changed the part where i can remove gil from FC chest. But its redundant considering the damage was done.

I changed my PW and bought the damn token also for added security. I been playing for over 6yrs and now i need to have that on my account is BS. Would like they allow to add your cell# & email notification of any account changes for added security. But neither is offered or given from SE. I use other sites with my cell# & email added for security I never ever had issue with my other accounts elsewhere being compromised. Since i receive either or both, if their was attempt to get in other accounts.

Regardless i am not happy and i doubt SE will ever change their stance on security or to reimburse the lost gil. I been a loyal fan for yrs and now i am on the fence if my loyalty was misplaced. Since they not given me any encouragement to continue supporting their products.

Quote:

---

Originally Posted by AndreD69

Gil is not issue and easily get back. I am glad they not demolished the FC, which that person could had done. I NOT agree SE not reimburse the gil from FC chest. Its only a line of code they can change. With the provided evidence i given with screenshots of FC activity and FC chest history that sackofshit took the gil.

I had full rights since I am 2nd in charge. I changed the part where i can remove gil from FC chest. But its redundant considering the damage was done.

I changed my PW and bought the damn token also for added security. I been playing for over 6yrs and now i need to have that on my account is BS. Would like they allow to add your cell# & email notification of any account changes for added security. But neither is offered or given from SE. I use other sites with my cell# & email added for security I never ever had issue with my other accounts elsewhere being compromised. Since i receive either or both, if their was attempt to get in other accounts.

Regardless i am not happy and i doubt SE will ever change their stance on security or to reimburse the lost gil. I been a loyal fan for yrs and now i am on the fence if my loyalty was misplaced. Since they not given me any encouragement to continue supporting their products.

---

I'm sorry this happened, but on the other hand if you think two factor authentication is BS then I think it's time you have a look around, dual factor is a basic requirement for pretty much everything you do online. People should have it set up on any and every account they possess if it is possible. If it is not possible then do not do business with or have an account with that site/business. Even a leak from a minor, inconsequential account could lead to identity theft, or monetary loss irl. If people are not willing to take online security seriously then they're going to learn the hard way. It's quite literally the old wild west out there. If there is any take away from this, it is that SE should REQUIRE dual factor, not just weakly recommend it.

Hate to say it but there are some companies out there that won't lift a finger to help/restore account access if they notice that your account wasn't sufficiently secured with dual-factor authentication/security tokens.

Quote:

---

I changed my PW and bought the damn token also for added security. I been playing for over 6yrs and now I need to have that on my account is BS

---

Do you know that there is a free app you can use instead on iPhone/Android phones? You don't have to buy the physical security token. That said, 6 yrs with just basic security and you only got hacked now? You've been lucky. Personally, I don't trust a subscription-based online game (or any website that stores my information) that doesn't offer some form of 2FA on accounts - it's an open target for hackers if you're only using a password to protect your account. I know SE has had 2FA on the game for years and it's regularly advertised to help protect accounts from malicious access.

Yes, it would be nice to have some notification of account changes, but to be honest, getting told about something after it's been done wouldn't really help the situation. Good security is about preventing something from happening in the first place, not being informed about it after the fact.

Quote:

---

If there is any take away from this, it is that SE should REQUIRE dual factor, not just weakly recommend it.

---

Agree 100% - I think all online MMO's should require some form of 2FA.

2FA wouldn't have prevented a situation like this when you log into a phishing site, which 99% of these cases are. You'd have just entered your OTP and thought you were logging in like normal. The hacker would have logged into your account all the same.

Quote:

---

Originally Posted by AndreD69

Gil is not issue and easily get back. I am glad they not demolished the FC, which that person could had done. I NOT agree SE not reimburse the gil from FC chest. Its only a line of code they can change. With the provided evidence i given with screenshots of FC activity and FC chest history that sackofshit took the gil.

I had full rights since I am 2nd in charge. I changed the part where i can remove gil from FC chest. But its redundant considering the damage was done.

---

Yeah I don't agree with the FC being SoL. SE takes the stance that if a FC leader gives gil privileges to anyone besides the leader, then they are responsible for any theft or loss of gil from that chest. It doesn't matter if you are the right hand man to the leader or not.

This is a RMT racket on making gil in game, so they can sell it for real money. They want one thing and one thing only "the gil". They don't care about the property, or bother with demolishing it. They don't care about any expensive materials inside the chest. All they are after is the gil.

This is a two man operation. They send these bogus mass /tells to a bunch of players, promising a chance at riches, which contains a link to a bogus SE account page. Looks just like the real SE account login and people input their user name and password. Once the victim has done this they have your login info. As soon as they can they log into your account. They invite their partner into the FC, then check your retainers for your gil, collects it and see if you have access to the FC's gil as well. Then they promote their partner in crime to the rank that has gil access to the FC chest and deposits all your personal gil from retainers and such into chest as well. Once that's done, they remove "every drop" of gil in the chest. From there their job is done and they go skipping off into the horizon.

Now that you've reported it as a compromised account to SE, it usually take 10+ days for SE to rollback your account to a time when you had your gil. Sadly they don't do it for FC gil. So be careful of what you put in your pockets in game from this point forward until you get your rollback, because it will be gone once you get your rollback.

Like to add. From my other accounts else where like Steam for example. I receive email right away with code to type in on STEAM if it be unfamiliar PC or cell app IP trying to activate my account. Another site gives me txt msg with a code to confirm account access. Without either no other person can get in my accounts. WITH SE YOU GET NEITHER OF THESE OPTIONS.

Only notice i had was a email, that a security software was activated on my account. I had to send ticket to SE and that took 2hrs. In those 2hrs the damage was done. For whoever it was who hacked me used that software app to lock me out of my account. I prefer to have notice right away on such action against my account. Instead of waiting on support when they decide to respond. Anyways it don't matter. My faith/loyalty is lost with SE and i will continue playing till my sub runs out. Afterwards i may take a long hiatus from the game. If i go that route I give everything i have to my current FC, then will remove myself from it so it will not happen again.

Quote:

---

Originally Posted by AndreD69

I NOT agree SE not reimburse the gil from FC chest. Its only a line of code they can change.

---

I assume their stance comes from the fact that it could so easily be exploited if they'd just restore the money to you without accounting for it. If they did so there would be a lucrative scam going on where someone makes it look like their account has been hacked, spirits all the money away and then asks SE to restore what was stolen from them.

I do think it's odd that they can't at least try to retrieve the amount of gil that was stolen and not yet spent, but once they've started spending it on the marketboard and the gil is in the hands of players who did nothing wrong, it's rather hard to take it back.

Quote:

---

Originally Posted by Canadane

2FA wouldn't have prevented a situation like this when you log into a phishing site, which 99% of these cases are. You'd have just entered your OTP and thought you were logging in like normal. The hacker would have logged into your account all the same.

---

Not without the code from the physical token, or the app. The hacker would not have been able to remove the token, nor log in. 2FA isn't fool proof but it isn't as simple as "get password, log in". This is precisely what 2FA is designed to prevent as far as I know.

(Edit for clarity) The code I'm referring to is the on printed on the back of the physical token, or the one generated by the app when it is registered. This is needed to remove 2FA from the account. SE will remove it if reported lost or stolen, though I cannot say what the process there is but I would hope it is extensive in regards to confirming the legitimate account holder.

Quote:

---

Originally Posted by AndreD69

Like to add. From my other accounts else where like Steam for example. I receive email right away with code to type in on STEAM if it be unfamiliar PC or cell app IP trying to activate my account. Another site gives me txt msg with a code to confirm account access. Without either no other person can get in my accounts. WITH SE YOU GET NEITHER OF THESE OPTIONS.

Only notice i had was a email, that a security software was activated on my account. I had to send ticket to SE and that took 2hrs. In those 2hrs the damage was done. For whoever it was who hacked me used that software app to lock me out of my account. I prefer to have notice right away on such action against my account. Instead of waiting on support when they decide to respond. Anyways it don't matter. My faith/loyalty is lost with SE and i will continue playing till my sub runs out. Afterwards i may take a long hiatus from the game. If i go that route I give everything i have to my current FC, then will remove myself from it so it will not happen again.

---

This is a valid point, and something SE really needs to get on point with. ANY login from a new device or location should provide a notification on a trusted device. They should also prevent login UNTIL IT IS CONFIRMED OK ON THE TRUSTED DEVICE. This would put them in line with other services as you rightly point out.

The two factor authentication is pretty powerful against stuff like this. If you did get caught up and accidentally logged into a fake account, they have literal seconds to use that same code to get into your account. You also would have known to be suspicious if the fake site DIDN'T ask for your auth, because SE always does.

Most gaming companies aren't willing to play ball with this, because of the examples listed above. You can prove someone from Bulgaria accessed your account, and you don't live in Bulgaria. You can't prove it wasn't you, because of VPNs. You can't prove you didn't give someone the password so that they could get the gil and then you demand it be returned. Whatever gil was released into the economy is simply gone. It really sucks and it's awful this happened to you, but gaming companies are used to being scammed in these situations as well.

When they offer extra security features, please use them. You can complain all you like that it's not the exact extra security measure(s) you want, but it likely would have prevented this. Petition/ask for more or different ones in the meantime, but don't cut off your nose to spite your face and not use what's available. SE isn't the bad guy here for upholding their rule, especially when there was at least 1 tool in place from them to help prevent it.