Friend Account Hacked

[Repulse97]

Earlier today, my friend's account was "hacked" moments after our FC had a falling out and minutes after he was assigned a rank that could withdraw gil from the FC chest. I asked in nn and this happened to at least 1 other person. 28 million gil was stolen. Has anyone experienced this? Is it possible some salty member of the FC hacked his account or is this completely coincidental? Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

[RicaRuin]

Sounds to me as if your friend clicked on links in suspicious tells and willingly gave away his data to a Phishing Scam which allowed someone to log into his account... and that access just had a lucky timing.

In any case your friend should reset password asap.

[Rhaervis]

Good morning and thank you for posting in the Final Fantasy XIV Technical Support Forums.

We apologize for any inconvenience that has occurred when playing Final Fantasy XIV. Unfortunately the issue you are describing is not a technical issue. We will be moving this thread to "General Discussion".

Good luck with your adventures through Eorzea!

[AngelCheese77]

Sooo ...

1. Ask your friend if they have received any tells talking about getting gil or doing a poll or something, that included a link to a 'Square Enix' or 'other' website. If so, and they went there, their information was given to a third party who now has their log in info. Get your friend to change their password, and educate them on not going to suspicious links, or links in tells. Also, have them scan their entire PC or viruses, malware, spyware, and all that jazz. No quick scan either. Full scan.

2. Ask if they went to any Twitch streams for FF14 and clicked any links within such chat. See #1 above if so.

3. If what you say is true, your friend either already gave such log in information to their family member, or left it in a place where it could be found. Now if that is the case, then your friend must not have an authenticator attached to their account, as it would be needed as well as their log in and PW.

[Greyhawk]

And, why are they not using Two-Factor Authentication? Not only is it free, but even gives some perks in game. Not to mention, adding security to an account online is just... common sense to do anymore.

[KageTokage]

2FA won't protect you from this particular scam as it also demands that on a phony log-in page.

It's kind of sad that people fall for this so often and they need to learn it is not normal for complete strangers to be trying to goad you into going to a link without malicious intent.

[Arazehl]

My advice is that the only one who should have access to FC gil, is the leader only.

Yes this happened to us about 2 months ago. An officer clicked on a phishing link in all innocence and got their account hacked. I fully trust my officers, but giving others access is running a great risk. I see that now and learned the hard way. It takes just one person that has access to the gil to get their account hacked. Rmt will instantly wipe out the hacked account and the FC gil too if that hacked account has access to ranking in the Estate settings. They can promote themselves to those ranks with gil access. It's one way RMT earns their gil to sell in city states.

SE did reimburse her, her gil, but the FC was out of luck. SE's view is FC's that give gil access to any of it's members other than the leader, and the FC is responsible for the FC losses.

Best thing is to make your FC aware of these phishing scams via your FC's discord channels and have only the leader access to FC gil. Good luck OP in the future.

[Iscah]

...minutes after he was assigned a rank that could withdraw gil from the FC chest.

Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

Who gave him the promotion?

Were he and the FC leader on the same side of the argument?

Without knowing anything about the trustworthiness of either individual, the fact that they live together opens up more opportunities for a deliberate hack, either through better access to security-question answers or getting hold of the other person's device.

It's also possible (if not necessarily likely) that it wasn't a hack at all but deliberate revenge, either by the gil-taker alone or working with the FC leader, then excusing it with "I didn't really do it, I was hacked!"

[tdb]

Earlier today, my friend's account was "hacked" moments after our FC had a falling out and minutes after he was assigned a rank that could withdraw gil from the FC chest. I asked in nn and this happened to at least 1 other person. 28 million gil was stolen. Has anyone experienced this? Is it possible some salty member of the FC hacked his account or is this completely coincidental? Note that my friend and the FC leader are family and live in the same household so no foul play on the side of the player.

So what actually happened here? Was your friend assigned a high rank and took the money? Or was your friend's account used to assign a high rank to someone else? Were they online when this happened? If it was your friend who took the money, was it then transferred somewhere else? Did they lose anything of their own?

In any case, actually getting hacked, meaning someone accessing either SE's servers or the victim's computer without authorization, is exceedingly rare. The usual thing is that the victim divulges their credentials to a fake login prompt, enabling the perpetrator to steal their identity. I've heard that even 2FA doesn't always help against this since the fake sites can recreate the 2FA interface and get the code. They can only use it to login into the game once, but once is enough to steal gil and items. The only real defense is to be vigilant whenever credentials are asked and never to trust any links, especially those given to you by strangers.

[worldofneil]

Earlier today, my friend's account was "hacked"

It's actually possible to view the IPs of the last 10 logins on an account:

https://secure.square-enix.com/

Then click "Account" in the top left corner, then "Login History".

Who gave him the promotion?

Yes this is the big question.

It'll be in the FC activity log who changed the rank. If they changed it themselves, then that means the FC leader had already given them the "Promote" ability, which is not a good thing to give out as someone can just change their own rank.

It's also possible (if not necessarily likely) that it wasn't a hack at all but deliberate revenge, either by the gil-taker alone or working with the FC leader, then excusing it with "I didn't really do it, I was hacked!"

I agree with this too. I appreciate that I don't know the poster or their FC, but it seems very suspicious that this happens immediately after an argument. The timing is just too coincidental.