Inside the super-popular online game "Fortnite," players must evade gunfire and rocket launcher attacks to be among the last ones standing in the multiplayer free-for-all.
But even bigger dangers involving the game await players in the real world.
Online profiteers hawking enhanced abilities for players' "Fortnite" characters in exchange for their account login information could take over the account or, worse, steal credit card information in the account for fraud.
Other internet peddlers pitch discounted or free allotments of the game's virtual currency, V-bucks, used to pay for new costumes and dance animations for in-game characters. What seems like a bargain could, in reality, be a transaction that assists cyber-criminals launder money spent acquiring stolen data on the Dark Web.
Has 'Fortnite' peaked?: As season 8 arrives, research suggests revenue dipped in January
'Fortnite' Econ 101: 'I want to look like Tom Cruise': How free game Fortnite makes so much money
Players do not have to pay to jump into the battle royale mode of "Fortnite," an aspect of the online game that has helped it become a phenomenon. But publisher Epic Games constantly adds new costumes, or "skins," and character animations called "emotes" that players can purchase to accessorize their game. The company also posts warnings in the game about not sharing your login information.
"I would say there is a pretty good chance that if you are trying to get V-bucks outside of that ecosystem you are probably going to get scammed," said Sierra Filucci, editorial director at Common Sense Media, where she tracks parental issues for games and multimedia.
A massive player audience of more than 200 million â€" across multiple platforms including smartphones, computers, and game systems such as PlayStation 4, Xbox One, and most recently, Nintendo Switch â€" and its young demographic makes "Fortnite" a target for criminals. Epic sells official V-bucks and upgrades within the game, as does Microsoft and Sony within its Xbox Live and PlayStation Network online game services.
But other unofficial vendors can be found on social media, on websites and in chat sessions on the popular Twitch streaming service, where you can watch seasoned players compete. These unauthorized sellers bring with them an element of danger, cybersecurity experts say.
"Buying V-bucks outside the official stores doesn't necessarily mean the user will get scammed," said Benjamin Preminger, cyber-threat intelligence specialist with Sixgill, a cybersecurity firm in Netanya, Israel. "A more serious side of it is that you're potentially party to a crime," such as buying a stolen account or unknowingly contributing to money laundering, he said.
The amount of risk of being ensnared in other scams depends on the type of scam, Preminger said. "The damage to the victim could be anything from a simple case of losing access to your 'Fortnite' account to the criminal use of any credit cards attached to the account to commit carding fraud," he said.
It's not unusual that "Fortnite," launched in September 2017, would draw a criminal element. The game is a cash-generating enterprise that produced as much as $3 billion in profit last year for privately-held publisher Epic Games, as reported recently by TechCrunch.
A scene from the online video game 'Fortnite.' (Photo: Epic Games)
Gaming news: Google expected to unveil long-expected gaming project at GDC
Epic sold $1 billion worth of V-Bucks, the game's virtual currency, in its first year, according to research firm SuperData. That comes from players wanting to spend $10 or so every once in a while to spruce up their game with new "skins" or special celebratory dance moves for their character from the game's richly-stocked emporium of goodies.
"Anywhere there is money, there's going to be people who try to abuse," said professional "Fortnite" player Loeya, who prefers to keep her real name anonymous. She has more than 637,000 followers on video game streaming service Twitch, where she recently responded to a question about scammers.
Criminal 'underground' arises around video game
The crimes being perpetrated involving "Fortnite" range from small-scale scams involving trading of goods to a vast Dark Web enterprise involving money laundering, cybersecurity professionals say.
A player may see "Fortnite" V-Bucks or a game account bargain-priced on social media or in an instant-messaging app or on eBay. Seems pretty simple, someone wants to unload some leftover currency or a profile they have tired of, right?
Not so fast, security experts say. This may actually be a multi-level criminal enterprise:
•Cybercriminals can buy stolen credit card information on the Dark Web, a hidden part of the Internet only reachable through specialized browsers and a bastion for criminal activity.
•Criminals create a game account and purchase "Fortnite" V-Bucks and other goodies through the game and attempt to sell the account on social media or instant messaging.
•Criminals also may sell V-Bucks at a discount, laundering illicit funds gotten from stolen credit cards or selling items purchased at a lower price in another global market, such as Argentina.
•Criminals may also lure gamers into giving their account access in return for free V-Bucks or a cool trick they can perform in the game. The bad guy could not only make use of a credit card linked to the account but also lock the player out of the account and sell it.
The game is "so massively popular, we’re seeing huge market penetration across demographics and across ages, and it’s coming up with the increasing trend of growing cybercriminal activity on both surface, deep and dark web forums and markets," saidPreminger.
A recent investigation by the firm, done with U.K. media outlet The Independent, found discounted V-Bucks being sold globally in English, Chinese, Russian, Spanish and Arabic. While it could not quantify all illicitly-sold game goods, Sixgill found a vibrant market on eBay for "Fortnite" items of more than $250,000 during a 60-day period last year.
"We're still detecting underground trade of V-Bucks, and certainly secondary markets for gaming-related goods, including 'Fortnite,' continue to flourish," Preminger said.
And new phishing attempts operated by criminals reselling in-game currency purchased with stolen payment cards has been observed by CyberInt, a Tel Aviv, Israel-headquartered security firm.
"For the gamers, owning a character with these items brings prestige and honor among their virtual and non-virtual friends and supporters," said CyberInt lead researcher Jason Hill. "This makes a perfect ground for hackers to hijack accounts and sell them in online markets."
On video game streaming service Twitch, professional 'Fortnite' player Loeya draws thousands as she plays the online game. (Photo: Twitch)
'Fortnite' fights back"Fortnite" publisher Epic Games and other gaming companies take hacks and criminal ventures seriously because it is bad for business, Hill said. They likely hire ethical hackers who test the system, he said.
But problems can inevitably occur. In January 2019, another cybersecurity firm Check Point Software Technologies of Santa Clara, California, notified Epic Games of a potential weakness in its system, in which an old web page could have been used to let "a threat actor to take over the account of any game player, view their personal account information, purchase V-bucks ... and eavesdrop on and record players’ in-game chatter and background home conversations," the security firm says in a blog post.
Epic, which closed that loophole after being notified, has tried to educate its players about the potential for fraudulent activity around its game. Back in May 2018, the company posted a notice on Twitter and it has a detailed account security bulletin in its online support center.
"We've seen several instances of account theft and fraud related to websites that claim to provide you free V-Bucks or the ability to share or buy accounts," Epic's bulletin says. "Please never share your Epic account details with anyone."
Epic Games declined additional comment for this story.
How to play safely on 'Fortnite' and other gamesEngaging in best security practices for "Fortnite" will make you safer across other online games such as "League of Legends" and other websites, security experts say.
For starters, it's best to "not buy things 'off the street,'" Sixgill's Preminger said. "Only use the official licensed stores for whatever merchandise" you are buying, he said.
Epic Games "has been pretty good about reminding kids," said Common Sense Media’s Filucci. "Every time you turn on 'Fortnite,' it has a little message on the loading screen that the only place to buy V-bucks is through Epic Games.... As long as kids are staying within that ecosystem, they are going to be totally fine.â€
Other tips:•Create a good password. No, "123456" or "password" does not pass. And don't use the same password you use on other games or online sites. Include upper and lower case letters, symbols and numbers. Cyber criminals likely have a past password of yours and can scour the net trying to use it on other sites to wreck havoc in your online life.
•Set up two-factor authentication on your account. When you want to log in, the game will send a security code to you via email or app and it must be entered to open the account. If your account is stolen, that can prevent someone from accessing and misusing it and its contents.
•Don't link a credit card to the game account. While that requires you to re-enter it when you or your child or teen wants to buy something, it prevents a bad actor from getting it should your account be compromised.
•Be alert to potential scams. They may pop up on chat streams, YouTube, social media, forums and elsewhere online.
"Parents can be very explicit with kids about not sharing personal information and not filling out surveys and questionnaires," Filucci said.
Last year from early September to early October, Baltimore-headquartered cybersecurity firm ZeroFox team said in a blog post that it had found more than 53,000 instances of "Fortnite" scams. Most (86 percent) came from social media, 11 percent from web sites, and just more than 2 percent from YouTube.
And be wary of potential phishing attacks, which can originate on a social network and lead to a potentially malicious website that could launch malware or spyware.
"These things are just so convincing. you can tell a human a hundred times to be weary of these attacks, but it’s only the 101st time in which it works," said Zack Allen, director of threat operations at ZeroFox. "This probably can be applied for more than just computer security, I guess â€" if something seems too good to be true, it probably is."
Related:
Online phenomenon hit with earthquake tremors as game nears Season 7 end
Kids are playing 'Fortnite' in class. So what can parents do?
'Fortnite': How young is too young to play?
Follow USA TODAY reporter Mike Snider on Twitter: @MikeSnider.
Read or Share this story: https://www.usatoday.com/story/tech/news/2019/03/04/fortnite-and-its-success-can-attract-bad-players/2789400002/
0 Response to "How to avoid 'Fortnite' V-bucks scams and cyber-criminal schemes"
Post a Comment