What I learned about an account getting hacked- not a rage thing.

Preface: This is NOT a "slam" post against ArenaNet or Guild Wars 2 in general.  It is intended only as an information type of guide of things you should do if you get hacked by one of these "botter" dudes and catch it BEFORE your account gets "banned" for something like "gold selling" or "botting" or hits a magical, mystical trigger that earns your account the ever-dreaded apparent "autoban." 

There were things I could do that I did not realize I could do because I had never really checked into what was available through my account/security area of the Guild Wars 2 website (NOT the "Support" area) and I am so happy that I know about these things now!

How all of this came to be before any type of ArenaNet trigger was hit to autoban my account:

Because my husband also plays Guild Wars 2 he and I are "friends" ( I know, freaky hunh?) via our two accounts. Shortly before 11:30p.m. (game time) on 12-29-2012 Hubby was logged in to his game account and playing when he noticed that one of my characters (my only level 80 - Kaeleer) was logged in to game.  (At this point who knew how long someone had control of my account? I didn't know cuz he is notorious for NOT looking in his friends window, I suspect this is the same gene in men that makes them less inclined to enjoy chatting endlessly on a telephone!)  He yelled up at me from his man cave that I was "in game" (heehee) and my reply was, "Well, no, I am not in game I am reading a book right now."  I hopped up and the first thing I did was try to log in to my Guild Wars 2 game.  I was able to log in and even select "play" and get to my character select screen which told me that whomever hacked my account had not actually changed my password.  The character select screen showed me that my account had been moved from Sanctum of Rall (US) to Far Shiverpeaks (Euro). I had been violated in the worst possible way!! I could not actually get in game because the hacker/botter dude actively had one of my characters in-game.

Very quickly I hit the web, logged in to the Guild Wars 2 site (NOT Support) and changed my password there. I did this FIRST and foremost so I could retain control of my game account should the bad-guy-botter-dude get booted.  (Side note: While we seem to get booted for all sorts of things and have to log back into the game this didn't happen at all to the bad-guy-botter-dude over a 19-hour period of continuous login it seems - heehee.)  I did not realize, or see the option that I could "disconnect" my character via the "account" and "security" area becausef I had not  scrolled down a bit on the page below the password reset area of "security."  I would not have done it at that time even if I had seen it because I was excited that I could fill out a support ticket on hacking while the hacker actually had control of one of my characters so that a GM could get information about the hacker-botter-bad-guy.  Being an ex-cop IRL I figured they would hop on this.

Another handy thing you will see in the "security" section of your Guild Wars 2 account area are the last two IP addresses that log in to your account so ArenaNet would be able to see the "bad guy" was showing a "Korea" IP address.  Once I saw this I was excited because the bad-guy IP addy matched up with an e-mail sent to my account about someone trying to do an unauthorized log-in to my Guild Wars 2 account. I rubbed my hands together, giggled maniacally to myself and set about bringing justice to the world!

The next thing I did was log in to the actual "Support" area and made out a ticket about hacking.  I was totally stoked, the bad guy was right there! He was logged in and doing his evil deeds and finally going to get caught.   Over a 19 hour period and several "updates" to my ticket on hacking, all that was actually done by a GM was they reset my account password twice (which was not actually effecting the bad guy but was annoying me because they were changing my awesome passwords).  Despite my explaining more than once very clearly that the bad guy was actively on my account where they could see them the only feedback I got on the ticket about that was that all was fine and dandy with my account.

I gave up trying to get them to understand and went back to the "security" part of the GW2 site  and hit the "disconnect" button on the bad-guy-hacker-dude since all of my characters stilll showed wearing the gear they were supposed to so I didn't want to lose anything more than they would have already taken/sold.  I didn't really have anything of awesomeness in my bank and by this time I had posted here so my account could be removed from the guild to protect the guild's bank ((that was before I realized that a) my account had already been moved off Sanctum of Rall and b) that they would not be able to move it back before 7 days passed)).

I quickly logged in and my lvl 80 ranger was there, in an out of the way area of the Far Shiverpeaks world, still grouped up with four other "botted" accounts so I quickly reported each of the members of that group as being botters, ungrouped and logged out of my game account.

My account was fortunately never banned for anything so I do not have to deal with that.  Where the ArenaNet support has dropped the ball on this whole failed attempt at bringing a nefarious bad-guy-botter-dude to gaming justice is that over three days time I can't seem to get them to either a) reset the 7-day "transfer" timer so I can just simply move my account back home to Sanctum of Rall and go on about my business or b) do an account restore to a date before 12-29-2012 which not only would return to me the few items I had in my bag that are gone (like food they removed for bag space - nothing of real consequence) and should put my account back to Sanctum of Rall on it's own.  This is admittedly frustrating because I have to wait for the game's "Transfer" button from the character log in screen to not be "grayed out" on this upcoming Friday and they won't actually respond to any "updates" I do to my still active ticket.  Should you be in a situation where you have an active ticket over three days old and not "fixed" there is a spot on the Guild Wars 2 forums where you can make a post about it being over three days and your ticket/issue is still not resolved - I don't know for a fact posting there will actually help but I am giving it a try .

Should you end up in a similar situtation as to what I have gone through (and am actually still going through) just be prepared that NOTHING will happen quickly to get you back to Sanctum of Rall gaming goodness.  After you file your support ticket dig up your game purchase information either the email from digital purchase (that has the 25 number activation key) or the game box from a store purchase because they will want assorted information from it as part of their verification process that they are dealing with the legal holder of the account.  Depending on what you have wrong/reported via Support, it will very likely take hours and probably days of back an forth "updates" and replies to get anything restored/handled/fixed.  When ArenaNet posts something to your ticket you should see it on the ticket via their support and also get an email to your game associated email.  If they need you to respond you ONLY need to either respond in the "Update" area of the actual support ticket screen or the email reply area, not both.  Reply via their "email" just posts it onto your ticket the same as "updating" posts to it.

There is a lot of "hurry up and wait" with the support system.  I recommend using the time to read a nice book (I am enjoying Goodwin's "Team of Rivals" which is one of the two non-fiction books the movie "Lincoln" is based on).  Or maybe clean out a closet or four, bake some nice cookies. Travel and see the world (j/k =)).

It's odd that they're not restoring your account, because there is an FAQ that talks about how it can be done with accounts hacked after December 1st. Though they do say that they will only do it once, ever, per account, and depending on when the last snapshot was taken you could lose more than you gain from it. I'm guessing they must just be overwhelmed with a lot of hacking right now and just don't have the resources to focus on your particular issue. This whole thing makes me want to change all my passwords to something ridiculously long and complicated. I almost got hacked into, but my email password is much tougher than my game password and so they weren't able to get into my email to confirm their login from China.

Are you all using google authenticator to authorize your account? I am curious if this is happening to those who have google authenticator linked to their accounts.

Dang! Sounds like they not only sent you around the barn a few times, but they also seemed to almost let you get run over by the train that went through your barn at the same time.... ( DISCLAIMER: any and all analogies that fail to make any sense are indeed the fault of the mad man writing them. ) A lot of good things to know though. Thanks for sharing them. On the bright side, at least you wasn't left naked in the Shiverpeaks with all your money, items and posibly a kidney missing.

» Edited on: 2013-01-02 14:08:39

*I deleted this because on re-reading what I wrote it does come off as sounding more negative than I intended, my bad*

» Edited on: 2013-01-03 03:45:30

Thanks for the info Kirleen. I have to say, as a fan of a lot of what Arenanet do, I think their security and response to hacking info is absolutely appalling. Blizzard, Trion and even NCsoft were way better at giving players back their gear and bank mats. The cynic in me says it is because these games cost a monthly sub, whereas GW2 does not. I find it hard to believe that with the technology available, GW2 cannot restore items to hacked accounts, for example. Very poor customer service is in evidence time and time again when people are hacked.

They won't rollback or restore your account. Whatever is on your account now, is yours. As far as blaming Anet for not restoring accounts, well to be blunt, its not their fault that players are not taking the appropriate steps to secure their accounts, and there is no valid reasoning as to why they should artificially place more items and gold into the game economy. Their business model relies on a strictly controlled game economy, unlike those other games that you refer to, Hex. It sucks for those that got hacked, but you know... hard knock lessons are sometimes to be had in life.

I just beefed up my Email account so no one can verify a new ip for my account. I will also update my Gw2 account when I get home. No "bad guy botters" for me. :0

I disagree Sekkerhund. Many of those hacked did try to secure their accounts, without success. Many were in the first wave before more stringent security measures were put in place, but that was a hell of a scramble. Arenanet simply dropped the ball. What I said above was my opinion based upon simple business ethics and the need for a company to treat their customers with respect, and come to the party when things go wrong. As someone involved in feeding back on processes, even the community managers have admitted faults on this from their side. While they are making attempts to communicate more swiftly with players who are hacked, they are plainly not doing a good job in this area. That is just fact, and well documented. We can only hope this will improve with time, and keep bringing it to their attention as examples arise.

Like I said, this little "guide" was not meant for hateful things or slamming ArenaNet. I really had intended it as a semi-humorous posting of things for folks to be aware if they catch the hacking on their own. You know, little things you can do to stop it on your end before things get any worse because there is some "lag time" or delay before ANet comes on board to assist you. And so folks could have a realistic idea of the time it will take to get things straightened out and ways to avoid wasting your time. =) Cyrexae, If the Google thing is the security feature that sends you something to your cell phone then no, I do not because I don't have a cell phone with "data/internet" capabilities. My personal economy is such that my cell phone is just talk and text capable. Also, if I read the description right (and I will happily admit there is a 50% chance I got it all confused! lol) the "message to cell phone" thing just replaces the email you get sent feature when someone tries to access your account without authorization. Sekkerhund, I do apologize for any tension in this area, I never meant to convey that I was "owed" anything or special treatment. I did not even realize that there was a possibility that they could do any type of "restore" (what was called a rollback back in the "good old days") until I saw the ANet FAQ back on Dec. 30th when I was going through the GW2/ANet site making sure I was utilizing the ways they had things set up to help deal with this type of situation. I mentioned it because if they could have done it then it would be a way for me to get back "home" and back in the guild and would have removed the botters items from my bags. I got lucky and it doesn't look like I lost anything of real consequence at all, just a random sigil or something that was taking up a bag slot (which I think the bad-guy-botter-dude might have sold on the trading place thingie - yeah, that's tech talk for me!). I removed my above "reply" because it did come across as being more "negative" than I wanted this to get. =) Blades out, not in and yeah, I will hush up now. =)

» Edited on: 2013-01-03 04:06:47

Hey Kirleen, Thanks for the answer, I was just curious. It isn't like the email. You have to enter the code the app gives you to login to GW2. So if someone is attempting to hack you, they would need the code sent to your cell phone through the google authenticator app as well. It changes every maybe 15/20 seconds or so. So it won't just be one extra code to figure out, because it is dynamic. I wanted to make sure I didn't have a false sense of security about it you know? It was the same way with Rift. I used their authenticator service for a long time (back when I was playing Rift, thinking of it I should login over there and see what is up lol). Paid for a year and maybe have played for a few months total so far (sub goes through april). Gonna let that game go to the wayside. I barely have time for GW2 lol. So glad your account wasn't stripped and was only moved. So tomorrow you will get to move back to SoR server? I think your post was informative, so don't feel that you shouldn't have posted. I didn't know there was a way to disconnect the connection under security. ANet is nortorious (sarcastic remark/rolls eyes lol) for dropping the ball with regard to accounts that have been hacked. I have read/heard many horror stories. A friend of mine cannot get his account back because he can't prove ownership of the account (threw away his receipt from when he bought the box version of the game). ANet won't help him out at all. It happened back around launch and he finally gave up. He is so disgusted with them that he won't play (even though I bought him another copy for Christmas, at least his son plays the game so it wasn't a complete loss). I am gonna still work on him though ;) I'll stop rambling now :) See you in game :) Jen

Kirleen, sorry, my comments were in response to Hex's, we're in disagreement about where player responsibility ends and developer responsibility begins, when it comes to ensuring accounts are secure. Only my first comment was in response to you, I just forgot to do the whole "@" thing to make it clearer. You won't get a rollback, congratz on at least coming out ahead of the ordeal. ;) Now change your account's email if you haven't, it won't happen again. :)

You can opt in to receive your 2-step verification code via text message or phone call. See 2-step verification setup. http://support.google.com/accounts/bin/answer.py?hl=en&answer=185839&rd=1

The conclusion to all of this came in the form of them replying at the same time I was finally able to move my own account back to Sanctum of Rall. I had already decided Thursday night to just not try any further work/update on the ticket, and move my happy self back to Sanctum of Rall as soon as time was up by their weekly timer thing for changing home worlds. =) They replied to the ticket on Friday (01-04-13) that they had concluded their investigation and had determined my account had indeed been hacked into by the evil-botter-person-dude and the person handling the ticket (a different name not the original person working on it) had already moved my account back to Sanctum of Rall without using my weekly "transfer" so I could have used that if needed. She very kindly offered to "restore" my account to a date before the hacking if I wished it but that I did not have to accept the offer of the restore since anything in my bags would be rolled back to what I had before the hacking, they would leave the decision totally up to me. I chose not to "restoring" since what they left in my backpacks were harvested items that were better than what the bad-guy-hacker-dude deleted from my bags to make space for the items. lol. I figured since she gave me the choice I would take the items that were in my bags at that time and not do a restore. So all turned out well save for not being on the right world for a week. ;) It does seem they do "investigate" and that it takes about 5 or more days or so for that type of investigation and they won't necessarily communicate to you in any way that they are still actively working on your ticket during that time. I even joked with Atheas that with my luck at the same time I could move back home on my own they would do a restore back to Sanctum of Rall ... heehee. Final thought, be ready for it to take 5-7 days (there was the whole New Year's issue going on during this same time so I suspect that at least on New Year's day they might have not been on for that purpose) for them to really investigate a "hacking" and get the offer out to you for account restoring if they confirm that you were hacked.

» Edited on: 2013-01-16 21:06:13

I'm going to chime in on this one since this happened to me in Guild Wars. When NCSoft set up the Master Accounts and had us link Guild Wars/Anet games to it, there was a bad security glitch where people were able to see email addresses from other accounts. Now, this happened a few years back, so it's old news. However, I think NCSoft continues to have some security issues. Microsoft isn't immune, either. My hotmail got hacked (and since all XBL accounts are linked to hotmail, they got into the XBL account, too). Microsoft denies they had a security problem, but it happened right around the time Origin went live and I had signed up for that. Go figure. I use strong passwords. I don't use the same password for forums, emails, or games. It's a PIA to manage it all, but it's worth the extra security. They're not bullet proof (nothing is), but they're tough to crack. A hacker cracked my NCSoft one anyway, and since they had my email from the glitch, they were able to access my account. A gold seller ravaged my GW account in under 4 hours. Fortunately, it happened right after Anet started their restoration process, so I got everything back. The moral of the story is that you can do absolutely everything right from a security standpoint, and still get hacked. The challenge is to make it a lot harder for the would-be thieves by not using the same password(s) for everything. I have a few junk email addresses I use for sites I think might sell my email address, too. Use a hard-to-crack password. Avoid using words that can be found in a dictionary. Make it a nonsense word and add numbers and characters to it. Use a different one for each account. Using an authenticator helps, too. Being a TORWars.com writer, I'm pretty high profile in SWTOR, but so far with the authenticator, no one's been able to hack in there. DON'T keep credit card information saved on your accounts if you can at all avoid it. Use the credit card, but delete the information in the account afterwards. Also, only buy as many gems/XBL points/cartel coins/doo-dads that you need at that time. If a thief sees your account has a number of points on it, he'll be more inclined to hack and spend. Also, keep a copy of your game key in a file, and save a back up somewhere as a hard copy. That way, if you ever throw away the receipt, you'll at least have the information available if your account does get hacked.