Account has been Compromised

So I foolishly copied a forum link out of boredom and have lost access to my account. My character has finally logged out. Some friends followed my character around and it was just teleporting from world to world in front of the aetheryte in Gridania. I’ve received messages as well from friends that my character is being used to send the phishing link to other people.(I feel so violated knowing someone is maliciously using my character in this way.) They’ve also submitted GM tickets to try and have my account suspended until this can be resolved.

I tried to log back in but was prompted with a OTP, and had seen in my email that a software authentication was added which I have never set up. Due to this I can’t fix anything or log in at all. I know it was foolish to do this but I honestly wasn’t thinking anything of it asking for info since I had never been on the forums on my new computer. Luckily my phone was logged in and I was able to make this post.

I’ve submitted a few report tickets, probably should’ve just sent one but I was in a full on panic attack and wasn’t thinking right. I haven’t received any responses as of yet, but I’m praying I can get my account back. I have receipts/emails of all my purchases and everything else linked to the account.

I’m also currently going through chemotherapy and playing FFXIV while I’m in the hospital receiving treatment is one of the few things that has made this treatment tolerable. I really hope I can get my account back from these hackers.

Please help me Square Support, I’m begging.

Thank you for your time,
Eros Hagakure~

Sorry that happened to you, but you'll just have to wait for support to get back to you. GM's can't help you here.

Good luck with your chemotherapy, I hope all goes well and you get your account back soon.

Though I'm not support, I'm sure once investigated you'll receive a roll back. You have to be patient though. This can take a week to 10 days. All the phishers want from you is your gil pretty much. They'll check to see if your in an FC and if you have access to the FC's gil too. I hope that you don't have FC gil access, because support won't reimburse if gil is taken from the FC sadly. Good luck and hope you hear from them soon.

Quote:

---

Originally Posted by Arazehl

Though I'm not support, I'm sure once investigated you'll receive a roll back. You have to be patient though. This can take a week to 10 days. All the phishers want from you is your gil pretty much. They'll check to see if your in an FC and if you have access to the FC's gil too. I hope that you don't have FC gil access, because support won't reimburse if gil is taken from the FC sadly. Good luck and hope you hear from them soon.

---

Thank you, this really helps calm my nerves a bit. My friends were very quick to notice something was off and messaged me to confirm, they quickly demoted my character to a barebone rank with no access at all as well to prevent that from happening!

Just so that I know, was it that you just copied and pasted the link and it auto logged you in somehow, it didnt log you in but somehow stole your info anyway, or did you type in your information? I've never dared even peek at those links but I have wondered exactly how they manage to nab people like that.

Quote:

---

Originally Posted by Batbrat

Just so that I know, was it that you just copied and pasted the link and it auto logged you in somehow, it didnt log you in but somehow stole your info anyway, or did you type in your information? I've never dared even peek at those links but I have wondered exactly how they manage to nab people like that.

---

The scam page you land on does look identical to the forum login page, and they also ask for your OTP if you have one, pretty hard to spot the scam unless you check the link.

Yo CM, do your job for once and forward this to support.

Quote:

---

Originally Posted by Batbrat

Just so that I know, was it that you just copied and pasted the link and it auto logged you in somehow, it didnt log you in but somehow stole your info anyway, or did you type in your information? I've never dared even peek at those links but I have wondered exactly how they manage to nab people like that.

---

It's an identical website embedded with a keylogger or something similar that stores information entered in the fields. It records the keys (or text) you enter when you log in and then whoever is on the other end uses said information to access your account. Usually will change your email or add some type of security to your account so youre unable to access it afterwards.

I fell for it many years ago on another site and looked into it from there.

Quote:

---

Originally Posted by Batbrat

Just so that I know, was it that you just copied and pasted the link and it auto logged you in somehow, it didnt log you in but somehow stole your info anyway, or did you type in your information? I've never dared even peek at those links but I have wondered exactly how they manage to nab people like that.

---

It is not easy to spot. You get a link, which looks almost exactly like the forums url. But instead of forum.square-enix.com it could be forum.square-enlx.com etc. They bind the original forums website in a frame but replace the login part. If you enter your credentials into the replaced login fields then they intercept them and compromise your account because they have your login data.


Cheers

You have people who game for years and
still fall for this lmao. Crazy.
Welp, good luck.

Quote:

---

Originally Posted by Jybril

You have people who game for years and
still fall for this lmao. Crazy.
Welp, good luck.

---

In fairness it does look legit on first impression.

How many people read ToS?
Most people tend to skim read things if they read at all.
It's not too surprising they catch some people.

When people go to the link too and it looks real they won't think twice about it.

I got so many whispers saying I won a lot raffles, ranging from 100m to 500m gils.

Guess that’s where all my luck are spent, I can’t seem to roll higher than 15 in my unsync savage glam farm PFs! :o

Considering I'm getting 5+ tells from compromised people daily about their "300 million gil raffle that happens in 15 minutes", a lot of people are falling for this. One of my friends got 8 tells in an hour yesterday. Support will fix this though you might have to call them. I know 1 person that fell for it and it took weeks to get their account back but they did get it back. I don't know if it'll be a faster process now or not as this was still early in the pandemic when it happened to my friend.

For future reference, the real SE log in does NOT ask for your OTP/code on the same page as name/pw.

Quote:

---

Originally Posted by Kolsykol

In fairness it does look legit on first impression.

How many people read ToS?

---

I can't agree that it looks legit on first impression. It's quite obvious if you've spent time on the official forums since the fake always has letter and a hyphen after the .com(something like .com-hgo for example). Not only that, but anyone who uses the OTP should be able to instantly tell that it's not a legit SE site since when you have that enabled, it's never on the same page(other than the game launcher) as your username and password.

I also don't think it mentions these sites in the ToS, though I haven't looked through that since I first started in 2015.

Quote:

---

Originally Posted by Avatre

I can't agree that it looks legit on first impression. It's quite obvious if you've spent time on the official forums since the fake always has letter and a hyphen after the .com(something like .com-hgo for example). Not only that, but anyone who uses the OTP should be able to instantly tell that it's not a legit SE site since when you have that enabled, it's never on the same page(other than the game launcher) as your username and password.

I also don't think it mentions these sites in the ToS, though I haven't looked through that since I first started in 2015.

---

Most people don't use the forum and the OP has 7 posts since 2017 so probably doesn't rly either.

This is why you should use a OTP in the first place too. Makes it nigh impossible to be hacked. Even if you flat out told someone your credentials and current OTP, it would prompt them with a different OTP they don't have access to. And trying to remove OTP is impossible without that one secret key.

Quote:

---

Originally Posted by Raim

This is why you should use a OTP in the first place too. Makes it nigh impossible to be hacked. Even if you flat out told someone your credentials and current OTP, it would prompt them with a different OTP they don't have access to. And trying to remove OTP is impossible without that one secret key.

---

As I mentioned above, the fake forum sites have the OTP on the same page as the username and password, and the way those things work is it automatically enters it into the games login page to get onto your character right away and start sending the scam tells/steal your gil. Only the official sites have the username and password on one page, then when those are verified as authentic does it take you to the OTP page. Because of how the scam sites are, giving the current OTP to it still makes it work for the scammers. OTP is a good line of defense for people trying to brute force a password, but other than that, the scams where it is asking for it still get to those who don't watch for the tell tale signs of a scam.

Quote:

---

Originally Posted by Raim

This is why you should use a OTP in the first place too. Makes it nigh impossible to be hacked. Even if you flat out told someone your credentials and current OTP, it would prompt them with a different OTP they don't have access to. And trying to remove OTP is impossible without that one secret key.

---

OTP works well against weak or leaked passwords. But it does not work very well against keyloggers or faked websites. Because if you enter the OTP into the replaced loging window then the hackers can immediately use it.


Cheers

This happened to me in WoW about ten years ago, OP. I know it's scary and frustrating, but you'll probably have your account back soon!

Update: Got my account information reset and changed and resecured! Now just waiting for the suspension reversed so I can continue playing again!

Quote:

---

Originally Posted by Tokyx

Update: Got my account information reset and changed and resecured! Now just waiting for the suspension reversed so I can continue playing again!

---

Yay! Really happy for you, keep staying strong with the chemo!

Quote:

---

Originally Posted by Tokyx

So I foolishly copied a forum link out of boredom ...

---

You're not fooling anyone. You fell for the 300M gil raffle from that polish site.

Good job.

Quote:

---

Originally Posted by Tokyx

Update: Got my account information reset and changed and resecured! Now just waiting for the suspension reversed so I can continue playing again!

---

Glad that worked out! Next time if you see those tells, just ignore it and pass a warning to everyone about the “300M gil raffle” . Its a scam to steal your logins.