Fortnite players find hundreds of dollars have been charged to their accounts

[Cal Jeffrey]

The Fortnite subreddit and Epic Games’ forums have received several complaints about unauthorized charges showing up on players' accounts over the last few weeks.

One user told Kotaku that he was surprised when a friend messaged him asking if he had bought the base package “Save the World.” His friend claimed claimed to have seen his status listed as playing that mode, but he only plays the free Battle Royale mode had not even logged on recently.

After receiving the text message, he checked his email and found receipts totaling almost $250. He is unsure how anyone gained access to his account, but after contacting support, he was issued a refund for the charges.

Dozens of other players have been hit with similar charges. Purchases have included cosmetic items, game expansions, and V-Bucks (in-game currency). At least some of the receipts appeared to be in Russian.

"I opened a ticket after buying the Ultimate Edition .. this was over 3 weeks ago .. still no response.. amazing."

Player's have been trying to get their issues resolved for weeks now and are getting impatient, but it looks like Epic is finally taking action. A company spokesperson indicated that they are aware of the breach and are working to resolve the problem and provide refunds to those affected.

“We are aware of instances where users’ accounts have been compromised using well-known hacking techniques and are working to resolve these issues directly with those players affected. Any players who believe their account has been compromised should reach out to our player support immediately.”

In addition to providing relief to those affected, Epic has posted an Account Security Bulletin with tips on account security. The company also suggests setting up two-factor authentication — a feature it just recently implemented.

If you feel that your account may have been compromised or find charges for the game you did not make, contact Epic’s Player Support.

Permalink to story.

https://www.techspot.com/news/73676-fortnite-players-find-hundreds-dollars-have-charged-their.html

 

[ShagnWagn]

Yet another long stream of examples where it should be illegal and stiff penalties for storing customer credit cards. Anything that makes it possible for an external hacker or internal employee to charge accounts needs to be wiped.

 

[Theinsanegamer]

Yet another long stream of examples where it should be illegal and stiff penalties for storing customer credit cards. Anything that makes it possible for an external hacker or internal employee to charge accounts needs to be wiped.

Except that, by doing that, you would force the likes of amazon and ebay to not store data.

I dont want to have to type in my credit card every. single. time. I buy something, and most consumers dont want to either. Especially on mobile, that is a PITA.

The better solution seems to be "dont use your credit card on clearly wring-money-out-of-you" freemium games like this one

 

[Jroc187]

Yet another long stream of examples where it should be illegal and stiff penalties for storing customer credit cards. Anything that makes it possible for an external hacker or internal employee to charge accounts needs to be wiped.

Except that, by doing that, you would force the likes of amazon and ebay to not store data.

I dont want to have to type in my credit card every. single. time. I buy something, and most consumers dont want to either. Especially on mobile, that is a PITA.

The better solution seems to be "dont use your credit card on clearly wring-money-out-of-you" freemium games like this one

You are that lazy to risk the headache and hassle of dealing with credit card fraud. Rather then auto-filling your name and address then typing your card number in, when you buy something. WOW just WOW. I would like it if it was a law not to store my credit card info. **** like this is now happing all the time. Or just use PayPal

 

[Uncle Al]

Good to see that epic is on top of the situation enough to refund/cancel charges but should the users really need to request the refunds?

 

[Kibaruk]

Good to see that epic is on top of the situation enough to refund/cancel charges but should the users really need to request the refunds?

It's good that they implemented 2 step authentication, it's bad that it's not standardized for online accounts of any sort.

 

[ShagnWagn]

I don't understand why credit card companies haven't done this yet, but it would make a dramatic effect - give a credit card person the ability to generate a one-time-use number for internet purchases (maybe like a check number?). For repeat purchases then use the root number (or still assign a check number). Is this just too easy of a fix?

 

[mailpup]

I don't understand why credit card companies haven't done this yet, but it would make a dramatic effect - give a credit card person the ability to generate a one-time-use number for internet purchases (maybe like a check number?). For repeat purchases then use the root number (or still assign a check number). Is this just too easy of a fix?

Some credit card issuers do have one time use virtual card numbers for use online.

 

[Raytrace3D]

Yet another long stream of examples where it should be illegal and stiff penalties for storing customer credit cards. Anything that makes it possible for an external hacker or internal employee to charge accounts needs to be wiped.

To be PCI DSS complaint there are strict rules about how credit card numbers are stored (if at all). Some creditors require that no data be stored (or that certain data be stored for a limited window, say for the duration of the commit charge window). Sadly though, many companies perform only self audits or are not 100% truthful when filing paperwork with regard to how they store their data.

 

[ShagnWagn]

Yet another long stream of examples where it should be illegal and stiff penalties for storing customer credit cards. Anything that makes it possible for an external hacker or internal employee to charge accounts needs to be wiped.

To be PCI DSS complaint there are strict rules about how credit card numbers are stored (if at all). Some creditors require that no data be stored (or that certain data be stored for a limited window, say for the duration of the commit charge window). Sadly though, many companies perform only self audits or are not 100% truthful when filing paperwork with regard to how they store their data.

To use Target as an example, there should be stiff penalties for these types of problems. This will show companies how important it is. As far as I know, they just shrug their shoulders and the problem continues.