Be Excellent To Each Other

I've simply removed my debit card entirely and in future will rely entirely on points cards, which are usually cheaper any way. It's win-win, barring the inconvenience of having to get a points card somewhere when you run out. At least I can't mainline my bank account into shite XBLA games any more.

I've simply removed my debit card entirely and in future will rely entirely on points cards, which are usually cheaper any way. It's win-win, barring the inconvenience of having to get a points card somewhere when you run out. At least I can't mainline my bank account into shite XBLA games any more.

As I explained earlier, I can't do that, so a prepaid credit card is a great idea.

You can still lose your account for a month, though.

I must've missed that bit. Why can't you do it?

Ah shit yeah, I did see that! Duh! Well that sucks. Where can I get one of these pre-paid cards by the way? I've always fancied one any way. For ordering stuff from the US and ting. And how do they work? Can I just stick £30 on it when I feel like it for each purchase (preferably online somehow), or do you have to buy like a £100 card and that's your lot?

Werl, unless you defriended me on Live, Mr Tosspot must've defriended any of your friends list who were online at the time of his crime lime pine rhyme.

That might explain why I had to re-add him but seemingly nobody else needed to...

You and Dimrill. The two least likely people I'd delete.

After all those times we've played... erm... well... there was that Burny Pee game that one time and er....

Carry on.

Tru dat.

But still! Forza tonight!

I don't have Myp yet

After all those times we've played... erm... well... there was that Burny Pee game that one time and er....

Carry on.

Likewise,

The only popularity contest that counts is the mod elections, obviously.

Ooh, speaking of which, can we get rid of DavPaz yet?

Edit: oops, that should have been a PM, please ignore.

Edit edit:

I didn't realise this was a popularity contest.

I thought you I was the only person whose face you bellowed in!

Good job I brought these wipes.

I used to go out with a girl that would...

I'm not sure what made me think anyone would want to know that.

Could everyone check to see if I'm still on their friends list? So far Alberto, Dimrill and DavPaz have been deleted from mine.

I'm worried about the potential of badness happening with my account, so have just ordered an Orange pre-paid Mastercard jobbie, which I shall be chucking onto my Xbox account when it arrives, and removing my Debit Card at the same time.

Yeah, will end up doing that, it's just wound me up.

Daft question. Have you activated the card?

Xbox Live 'FIFA hack' concerns continue to escalate, Microsoft states Windows Live ID not compromised

by Alexander Sliwinski on Jan 4th 2012 12:00PM
Additional reporting provided by Xav de Matos, Senior Editor for Shacknews.
Following an increasing occurrence of Xbox Live account hack reports, we are growing concerned over Microsoft's Windows Live ID system, the only layer of protection between a hacker gaining access to a person's Xbox Live account and their information. In our research, the only consistency we saw across users who were hacked was the general inconsistency of what email and payment method was used on their account. Hotmail, Gmail and school emails were used for their Windows Live ID, while payment methods used were credit cards and PayPal. Other than a compromised Windows Live ID, there wasn't a common thread we could identify.

It's been several months since we started following the "FIFA hack," a rather blunt scam that saw Xbox Live accounts drained so thieves could purchase in-game FIFA 12 'Ultimate Team' cards for use and sale. We have been tracking the FIFA issue and following up on other tips that weren't necessarily rooted in the FIFA hack, but related in that users saw exploitation of payment methods tied to their account. A recent Shacknews editorial detailed accounts compromised by the FIFA exploit.


"I was sitting on my couch watching ESPN on my daughter's Live account when the Xbox Live friends notification popped up and said that I had just signed in to XBL. I took a quick look at my status and to my surprise I was online playing Worms Armageddon. I logged in to my Xbox Live account to find out what was going on," hacked user Michael Adcock told us. "All of the Microsoft points that were stored in my XBL account had been spent on Prince of Persia: The Forgotten Sands and an in-game item for FIFA 12. Whoever spent my MS points had then tried to purchase 6,000 more. Lucky I was able to log in and change my Windows Live ID, bank account and email passwords before any more damage could be done."

Adcock's incident occurred on December 27 and his account is currently locked while Microsoft investigates.

Justin Heard is another victim, with $241 spent using the PayPal account tied to his Windows Live ID. "It seems the access point was through Microsoft's website, as Rift CE was purchased for Games for Windows and that can't be done on the Xbox 360," Heard said. He explained that the hackers purchased several point bundles and then a Family Gold package, which he believes was to transfer the points from his account to the new account.

Heard's account is also locked while Microsoft investigates.

"I can state we've not been made aware of anything like that either from users or PayPal to my knowledge -- a partner we work with closely," Xbox Live Director of Policy and Enforcement Stephen Toulouse told Shacknews. Heard had previously told site VGW that when he contacted PayPal, a representative told him the online banker had received 19 calls within the past hour about the issue. Toulouse dismissed that claim. "I just checked with a counterpart at PayPal who said they have no idea what that source is talking about."


"I got an email from Microsoft saying I had purchased 10,000 points. I immediately tried to get on my Xbox, and found that I couldn't sign in," another victim, Zackh Mackey, tells us. "I checked my credit information online, and sure enough, there were charges tied to the points. I called customer support and they locked my account for a month to investigate. This happened back in early November."

It took about 28 days before Mackey's account was investigated. He tells us his account was tied to Gmail and he used a credit card.

"Two months of [Xbox Live] Gold was credited by email and the money has been refunded to my credit card. No problems since, knock on wood."

The people we've spoken to don't feel they were victims of phishing or a social engineering scam to obtain their passwords. In some cases their Windows Live IDs were tied to email addresses they hadn't used in years.

"Enough people I know in the industry with good password discipline have been victims of some kind of hacking attack that I'm taking every precaution with my own account," expressed Ben Kuchera of Ars Technica, one of the first sites to report on the FIFA hack. "The easiest way to limit your exposure is to remove your credit cards and just use point cards for purchases and to pay for your account. It's slightly inconvenient, but I feel much safer."

We've been in contact with Microsoft regarding our Windows Live ID concerns, having asked directly if the system has been compromised and, for clarity, how the hack occurs.

"Windows Live ID was not compromised. The FIFA '12 and other similar incidents are cases of social engineering or phishing, which are industry wide problems. Microsoft constantly audits its systems and reviews its processes in an effort to help protect customers from such issues," a Microsoft spokesperson told us. "To help avoid becoming a victim of phishing, people can use the guidance found at the Microsoft Hotmail: Serious About Safety site. They can also visit the Windows Live Hotmail Help Center, if they believe their account was compromised."

At this point we feel comfortable in expressing that we can't explain exactly what's going on, but we are concerned. Changing your Windows Live ID and password would be prudent, as would disassociating any credit card or PayPal and relying on point cards instead.

We will continue to look into this. If you have more information to provide, please contact us.

I just got hit with this on the 25th. My points balance was drained dry on FIFA 12 Ultimate Team purchases and I have 3 FIFA 12 achievements. It also looks like the hackers tried to purchase a 6000 MS Points bundle using an expired credit card associated with the account. Fortunately, I had cancelled that card some years ago after a previous XBL fraud incident and moved entirely to prepaid for both XBL and PSN. Until recently, however, it was not possible to remove a payment type from your account.

My password was not changed and there were no other alterations to the account. I don't buy Microsoft's claims of phishing and social engineering. I suspect there is an API breach permitting Gamer profiles to be downloaded in an unauthenticated fashion. After I discovered the fraud, I took a look at http://www.xbox.com/security and found that, by default, profile logins from other consoles are not authenticated by password. This means that, should a hacker find a way to download your profile, he has full access to it without knowing your password.

Aside from changing my password, I also set my profile to require password authentication on login for all consoles except my own. I set a four button XBL passcode to be required for every login attempt, including on my own console. Then I signed out of XBL and redownloaded my profile, in order to invaliate all other copies. I secured the Windows Live account by adding mobile/SMS proof for password reset/recovery. I removed the expired credit card (it now seems to be possible to do this from Microsoft's Billing site).

At this point, I decided to contact Microsoft customer support. I explained the situation, with which they are all too familiar. Importantly, I mentioned the account hardening steps I had taken, so CS did not have to lock the account for 25 days. The account balance is frozen, but I can continue to play online as normal.

I'm going to do some more research on this and I'll update as the situation progresses. Interestingly, I can see the hacker's Console ID under my account billing history. I suppose Microsoft can ban this console, but it may just be a mule hackers use to acquire FIFA content before trading it away to another account.

If you haven't been hacked yet, I strongly recommend you follow the procedures recommended on the Xbox Security site. Honestly, I think Microsoft needs to enforce these measures universally through a system update.