Slashdot Mirror
Indie Dev TinyBuild Lost $450K To Fraudulent Sales Facilitated By G2A (pastemagazine.com)
An anonymous reader quotes a report from Paste Magazine: Indie developer TinyBuild, the studio behind Punch Club, Party Hard and SpeedRunners, had thousands of their game codes stolen through fraudulent credit card purchases, which then wound up on G2A.com, a site that allows people to resell game codes. The basic idea behind G2A is straightforward and pretty harmless: with the amount of game codes sold through Steam, the Humble Store/Bundle, and more, the site gives consumers a place to sell unwanted game codes. However, in doing so, G2A has created a huge black market for game codes sales. As TinyBuild described in their blog post on the matter, the common practice for scammers is to "get ahold of a database of stolen credit cards on the dark web. Go to a bundle/3rd party key reseller and buy a ton of game keys. Put them up onto G2A and sell them at half the retail price." This allows scammers to make thousands of dollars while preventing any profit from reaching the game developers because, once the stolen credit cards are processed, the payments will be denied. G2A states that TinyBuild's retail partners are the ones selling the codes on G2A, not scammers, despite the thousands of codes they lost through their online store to fraudulent credit card purchases. In 2011, TinyBuild was in the news for uploading their own game, a platformer called No Time To Explain, to the Pirate Bay.
Wait... stolen or purchased illegally?
There's a difference, isn't there?
There are *tons* of companies that get ripped off by this exact same thing (I work for one of them). The transaction goes through, and then *after* the person the card is stolen from finds out hours or maybe days later, a chargeback is issued and the steam keys are already long gone. You could try to put a 3 day waiting time or something on redeeming your keys but that is obviously incredibly user hostile and nobody would put up with it.
a chargeback is issued and the steam keys are already long gone.
Have you ever done a chargeback? You want user hostile try doing that. First the bank will intimidate you and tell you there's a "service fee" of $25 or $50 or whatever for even TRYING to charge back, THEN they say they will "investigate" and MAYBE the charge will be reversed next week sometime. Then finally if the planets are aligned correctly and the bank really feels like it - they MIGHT approve the charge-back.
Seriously if this is such a major issue and not a flaw with this particular company's security/site design/business model (or a really shitty bank they happen to have chosen), how come absolutely everyone isn't bitching about this? I'm curious. At some point credit card fraud becomes the bank's problem and not the vendor's problem.
Seven puppies were harmed during the making of this post.
You have no clue how any of this works do you?
Your hair look like poop, Bob! - Wanker.
I mean, they are the ones handing out game codes without waiting for confirmation that the credit cards being used to buy them are in fact authentic
<citation needed>
These are chargebacks, not incomplete transactions. The banks provide confirmation almost immediately, but if you want to prevent chargebacks from happening after you've given the code then the only way to accomplish that would be to accept the payment and then wait 120 days before letting your customer access the code. No, "everyone else" doesn't do that.
I don't know about that. I got a nice email from my bank that someone had made a suspicious charge at a grocery store not too far from where I live. It said not to worry about it, and that they were investigating. I called the number on my card, and their security team did confirm they sent the email. They asked me to confirm a few charges I recently made as valid or not valid. A few weeks later, I got a letter in the mail that said they completed their investigation, and the entire charge was now void. I would not be responsible for it.
So...maybe your bank just sucks ass.
So basically a bank has nothing to lose from fraudulent use of THEIR credit card system. Either the account holder pays, or the merchant pays. No wonder banks are in no fucking rush at all to deal with the gaping security holes in their systems.
Seven puppies were harmed during the making of this post.
I worked for a company that had similar scam problems. These scammers are able to pull off these scams at absolutely massive scale and they've been doing it for years against everyone and anyone. They find any little rinky dink offer and exploit the living crap out of it. They have so much talent that you wonder why they don't conduct actual legitimate business.
nt
The obvious solution is cooperation between code resellers and code oems.
Specifically, the oem has a free mechanism for the reseller to check the time between original purchase, and attempted resale.
Couple that with a moratorium on resale, say a week before the reseller will buy you code, and you make the easy money not so easy, which will discourage fraud of this type.
And I want the pirate bay version now :). While we're on the subject what ever happened with Green Man Gaming and those gog Witcher 3 keys?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
As a mid-tier indie Game Dev, with two titles on Steam, the key system is something I've never quite understood.
It is a hold-over from box copy days. The box industry is still around in the third world, but outside of those few select counties why do keys still exist?
My publisher hands out about five figures worth of keys to about 6 different legit places. After a year, hundreds of "retailers" have my game, all selling them for under Steam price. (Well under discount margin too.)
Leaving out the credit card scamming. Someone can just purchase keys in Yuan or Bhat's or Rupiahs for 40-50% (Or more if the game is discounted) and resell them for 25% less than the steam price. Luckily they closed off Russian keys from being used by anyone but Russians.
On top of this, Steam makes no money on keys. Zero. It's just a distro lock for them.
The key system needs to be done away with. Replace it with an API that legit and official stores can use to grant users copies of games. Extend this API into the client for "gifting." If steam wants, charge a tiny fee for each API transaction from a vendor. More money in their pockets and the system doesn't really change. Allow ownership of multiple copies of a title and allow you to transfer these to other users (But you must always keep 1 copy.) This will allow bundles to still function as they did. If they just did that, it would close up the key black market and make everyone more money. (Except the folks buying on these black markets of course.)
But knowing Steam. This won't ever happen. Hell I can't even send out an update without having 50-100 people having corrupt files issues which file verification doesn't fix. I hate telling people to uninstall my product (and reinstalling) to fix their problems.
since most merchant processors require delivery of goods to be prompt. The best bet here would be to verify the 3/4 digit code on the Card and the billing address and (if you're not in North America) do "3D Secure". The trouble with this is it makes the transaction harder on legitimate purchasers.
What worries me is the possibility that G2A is making most of their sales off this. I honestly don't know, and I'm not sure how you could prove it. These key reseller sites always struck me as a little dodgy though so I've steered clear in the past. I'd rather pay an extra $5 bucks and get it from a site I know/trust. Heck, I don't even shop at GMG anymore because of the shady goings on with the Witcher 3...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
On the Guild Wars 2 forums, it turned out a player had purchased the Heart of Thorns expansion from G2A and their account was suspended. Later they found out the serial they purchased was obtained through a fraudulent credit card purchase. The player's account was reinstated but access to what they purchased was removed.
https://forum-en.guildwars2.com/forum/support/support/Guildwars-2-Account-Suspended-I-need-help/first#post6210373 [Guild Wars 2 forums]
So it seems G2A has a hand in defrauding multiple game companies
Have you ever done a chargeback? You want user hostile try doing that. First the bank will intimidate you and tell you there's a "service fee" of $25 or $50 or whatever for even TRYING to charge back, THEN they say they will "investigate" and MAYBE the charge will be reversed next week sometime.
I've done chargebacks numerous times, and haven't had this once happen to me. Who is your bank? They obviously suck and I'll make sure I never do business with them.
Anyways this is credit card theft rather than a simple chargeback. In the case of fraudulent transactions, by law the bank can only hold you liable for up to $50 in fraudulent charges. And basically every bank that doesn't suck has a zero liability policy, meaning that anything somebody put on your card without your permission doesn't cost you a cent. I've had this happen a few times as well (typically from some merchant who had their credit card database hacked) and the only negative thing that happened to me was that I had no credit card (which I buy practically everything with) until my new one came in the mail.
Just revoke the keys -- I'm really not seeing the issue, especially with digital/revokable media.
I've had both experences and everything in between.
Definetly time for a disruption in the business though.
Since when did "selling stolen property" become legal???
I work for the Department of Redundancy Department.
... should be the correct title.
In the current open payment environment TinyBuild should have considered building a system where they can revoke codes/accounts based upon their purchase information.
The few times I've done a chargeback, I simply had to swear, on a recorded call, that I did not have the item I was charged for. Just a few seconds on the phone, no fees, no threats of fees, just done.
Learn to love Alaska
In other news, the entire entertainment industry has lost more money than the GDP of the nations they sell their products to.
The chargeback penalty fee? PayPal, for example, will charge the merchant $20 per chargeback.
That is the problem with US cards and magstripes.
When you visit a site (eg Amazon or Paypal) you let those sites store your card number. You don't let Steam, GoG, Nintendo, Sony, Microsoft, etc store it. That way you know exactly who has your card number at all times. You also don't allow your web browser to store it either, all you need is a "form skimmer" ad on the website to snag your payment information because the web browser decided to auto-fill your contact information.
Only used tokenized payments (eg Apple Pay, which works everywhere that has a NFC EMV reader) and places that like to save your card numbers for loyalty purposes can go to hell.
Well, I've been a G2A customer for about a year, using it for Windows 8 licenses, antivirus licenses, Steam games, and a few other things.
Their "how do we do this" stuff always seemed a bit fishy but none of the license keys I bought has ever had any issues. I assumed it was legit or it would have been shutdown by now.
But now I see how G2A is able to stay hands off far enough to say it's not their fault, the same way pawn shops avoid being responsible for stolen goods that they end up reselling. I mean it's totally not the shop's fault if the entire neighborhood is being burgled for pawnable stuff. /s
Why are they/we all still using this sort of software key model? Why not do more authentication of purchases and tie them to email addresses or some other thing that can't be resold?
Sig for hire.
One of my banks will occasionally send me a text message asking if a charge is legit. I can approve or deny it by texting back "yes" or "no".
The real "Libtards" are the Libertarians!
Credit card fraud is ONLY the vendor's problem. On a fraudulent transaction the bank removes the money from the vendor's account, charges them a "chargeback fee" of $40-$50 and notifies the vendor after the fact. The vendor has no practical recourse. The credit card company APPROVES the transaction in advance, but if they change their mind, again no recourse.
Why not have face to face stores then? It is much harder to steal from someone when you are looking them in the eye.
Time is what keeps everything from happening all at once.
The issuing bank has usually already given the money back to their customer before initiating any charge backs.
Banks that don't do enough to prevent it lose a lot of money to fraud.
Dispute resolution takes time and money, it's not in their best interest to do it often.
False. The real scenario: That is the problem all over the world, but in my apple walled garden, that seemingly doesn't exist. Nevermind the fact that credit cards 'have never been cloned before'. I can take a picture of the front and back of your credit card and for apple's purposes, it's legit.
Yes, and if it's that hard, you need to get a new card.
Because I've had to do a chargeback, and it cost me 5 minutes.
Some background - basically I ordered a product online, and it never arrived. I contacted the store and they never replied, and after a month of waiting, I gave up.
I called my bank, told them this and they were more than happy to do a chargeback. They refunded the money immediately while they investigated, told me I could be responsible for the charge up to 3 months later, and that's it. Time passes, and no charge, because I never got the item. (I'm not even sure if the store ever bothered responding).
No muss, no fuss, the money was back 5 minutes after the call. And from what I can tell, all credit cards work that way - the charge back process is extremely easy and painless.
If you made the mistake and used a debit card, then heaven help you. Credit cards are governed by many laws and regulations which make chargebacks easy. Debit cards, not so much, so it's up to each financial institution to deal with it in their own way.
And even when the charge is fraudulent, they are super easy to deal with - they even will overnight me a new card if I needed it. For free.
If you're dealing with that, you either made the fatal mistake of using a debit card, or have a really shitty bank and need to switch, because even the nationals are way better.
Oh, and on the flip side - when you do a charge back, a hold is placed on the merchant's account for those funds so that money is captured while the investigation proceeds. Part of Paypal's shittiness stems from this fact - they allow anyone to pay anyone with credit cards and most people don't actually realize what responsibilities they have in doing so or what accepting credit cards really means. If you wonder why no one else tries to compete in this area, well, there you go. It's the only service Paypal has that has no competition because no one wants to enter the arena - it's just fraught with all sorts of bad user experiences and danger.
Hell, people were wondering why Apple wouldn't want to get involved - same reason. Shittiness all around if you aren't careful, and most people don't even read the ToS.
Really? Every once in awhile I'll notice a fraudulent charge on one of my credit cards, I phone the number on the card, challenge it, and then they either void it fairly soon afterwards, or, (only happened to me once), they send me a form to sign basically saying that I verify that I didn't make the charge, and then they void it. I get hassled more trying to return a mostly full container of cream that had gone bad before it's due date at the local grocery store (with a receipt).
Sleep your way to a whiter smile...date a dentist!
If it results in inactive codes they will stop bothering to try charging back
If the charge is cancelled by the bank, just cancel the validity of the code as well.
The only problem is that they probably didn't design their code system to allow this, but that's their own fault.
It's not rocket science.
In such a scheme as described there are two ways :
1) ream the end buyer and get it hostile to BOTH G2A and tinybuild because let us get real end buyer would also be unhappy with the developer
2) do what they did and eat the loss knowing this would be better PR rather than remove keys.
Frankly in their position I would do the same, and make sure the PR is out that they did not remove the keys from the end user.... Which is exactly what they did since we are getting them on slashdot and other outfit. That would be a positive points for them and if in the future they develop something it may makes me and other more interrested into supporting them. I would not be surprised if they are right now getting a slight surge in sales.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
It should be noted that the dev is assuming that the keys were sold on G2A with no proof. The only claimed proof is purely based on coincidental listing timing, but that could be due to several factors.
Also G2A offered to work with the dev, if they could provide examples of the allegedly stolen keys, and agree to revoke the keys (Which will drop teh devs sales figure). Instead the dev chose to write a blog post accusing G2A of criminal activity (Facilitating the sale of stolen goods).
Instead the problem here is that the dev failed to link keys to transactions, such that they could revoke keys that were subject to charge backs. This is the equivalent of accepting a promise to pay for goods, delivering those goods, and then blaming ebay because those goods were sold on to other people after the original seller fails to follow through on teh original payment.
The only failure here is the devs in providing safeguards against credit card fraud. But they sure do like getting a cheap shot in at 3rd parties that they don't like for other reasons.
Rule #1 if you're a startup (i.e. you don't have huge amounts of cash): don't be a bank in *any* way. That means, don't give out *anything* of value without *immediately* receiving cash for it. That's not a new rule. It has been like that forever. Because any such liability is uncontrollable and can catapult you out of business if it goes wrong.
That means your game codes should not work if the CC transaction was unsuccessful.
No it's not. If you are amoral (or better yet sociopath tendencies) - it is just as easy to steal from someone while looking at them.
Sure in this case, it creates overhead of having to have a physical card to program the stolen info on - but this is completely unrelated to your claim that the "personal touch" will stop thieves.
But congratulations, at least you have a conscience (just remember not everyone does).
You're assuming that it's the fraudster who's doing the chargebacks, saying "I changed my mind". It isn't - it's all the victims who notice unauthorised payments and complain to their banks. And in practice nearly all of them succeed, because if the banks don't pass the loss onto the vendor then they end up on the hook for it themselves.
Same. I once transferred a few hundred bucks to an account abroad only to get a call just minutes after placing it whether this was really me and whether I really wanted this to happen.
With all the flaws my bank has, this really impressed me.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They have so much talent that you wonder why they don't conduct actual legitimate business.
Because endless growth isn't, and the low-hanging real opportunities are already exploited by incumbents who will wield the legal system against new entrants into the market. If you go criminal, you don't have to deal with all the regulations that real businesses have to observe and you keep a lot more of what you earn.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Banks in the US cannot charge a fee to a consumer for initiating a chargeback.
They can and do charge merchants fees for handling chargebacks.
Dude, you need a different bank/card company.
Have you ever done a chargeback? You want user hostile try doing that.
how come absolutely everyone isn't bitching about this? I'm curious. At some point credit card fraud becomes the bank's problem and not the vendor's problem.
Like many other repliers... perhaps because this is not the norm? I also had a fraudulent charge appear on my credit card, one courteous call and ten minutes later, it was reversed without any hassle. Well, apart from having to wait for the new card in the mail.
On the off chance - are you talking about credit card or debit card transactions? Debit cards are fundamentally different, even though to most people they seem almost interchangeable. Essentially with a debit card, it is almost the same as handing over cash. Trying to get someone to hand back a wad of cash is different than what amounts to cancelling a debt. (I'm sure there are people who can explain the difference a lot better)
Sounds like these companies need to implement the game code equivalent of CRLs.
If your a business operating as a going concern then no the bank has little to lose, when a chargeback occurs it just get taken out of your current payments with an explanation and a service fee. A while back we had a rash of refunds and chargeback so the credit provider sent a representative out to have a chat with us, we explained that a consultant instituted some business practices had caused problems with buyers remorse and clients not fully comprehending what they were agreeing to. We fired the consultant and reverted some of the practices that were causing problems, our discount rates and transaction fees went up for a 6 month probationary period, and are now back to normal.
Now if a business isn't operating as a going concern the bank can really get hurt because the current payments may stop at any time. Businesses that sell tangible goods from a brick and mortar store get better rates because the risks are lower; an internet porn sites rates are very high because they get a lot of chargebacks on there intangible digitally delivered goods, so the risks are very high. Game keys are also an internet intangible.
Apocalypse Cancelled, Sorry, No Ticket Refunds
TinyBuild lost nothing since nothing was stolen. At least that is what I am repeatedly by people on here when they try to justify not paying people for their work (movies or music).
So which is it? Either TinyBuild lost money because people are using games they haven't paid for or they haven't lost money because nothing was stolen. You can't have it both ways.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
what? that does not make sense,
if i purchased game today, tried it, and want to sell it tomorrow for half price because it sucks why i have to wait with no money next 3 months, even worse game will be old than so worth less so i can get less of my money back
second, even worse problem, what if i am honest re-seller (majority ARE honest, very small percent are criminals) and i find big sale "family pack" where you pay 2 games and get 10 games "deal only valid today", i buy 200 games (100 "packs") and get 1'000 games, wait one day until offer is not anymore available, and than sell for a bit under normal price in packs of 1 (not 10) and make enough money to pay rent for next year
now if i have to wait 3 months after giving my money to be able to resell it, i will not be able to pay rent for 3 months, or even eat for 3 months since all my money is tied in this 1'000 copies of game ...
and after 3 months if im not already living on street value of game has fallen a lot, as you know games/movies are decreasing fast in value, so instead of having enough money to pay rent for whole year i might have just enough to pay rent for 6 moths
and all that just because some indie dev didnt want to pay for chargeback insurance to their credit card processor
All modded down to hide from Google scraper.
The American Government is actively monitoring Slashdot. Smartest post on Slashdot in 20 years.
For some reason my bank only does paper statements so it could be 45 days before I see who bought what on my card. They are quick at doing chargebacks though.
Website Just Down For Me? Find out
For a second I thought the genius was involved
Streisand effect
The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet. It is an example of psychological reactance, wherein once people are aware something is being kept from them, their motivation to access and spread the information is increased. More at "Wikipedia"
No for me. Charge backs are easy as can be.
Well's Fargo calls me. Hey we detected fraudulance on your card. Are these your expenses. They have called about 10 times. 2 times, I my card was pwned. Both times, they handled it all in seconds with no issues.
One time, I called Well's fargo, they didn't call me. Same deal. They canceled my current number, credited the charge and had me a new number all in a three minute phone call. Easy as can be.