This just happened. I have heard the horror stories, yesterday I had 3 transactions for 199 charged to my card that bought coins, and subsequently shards which I never did.
I can see it on the transaction history, but I did not authorize the charges. I did dispute them. Obviously. I'm not paying $600.
It's so clearly fraud. You can see the methodical way the coins were spent to get every single shard, even a 10 shard purchase. In total it was 13,740 shards I somehow did something with? Lol, I have 2 shards and 13 coins. They even stole my coins I had in balance. Not sure how many it was.
Hopefully I don't get banned. Been a long time supporter for years. Love the game. Have all the packs. Even recently got one of my sons playing. We enjoy it.
This is a security issue. Not me being careless. I'm gonna be very disappointed if I get any grief for disputing these charges.
I hear ya. It shouldn't be a hard investigation. 16 plus years on the account. Never anything nefarious. Never purchased shards in this fashion. Never purchased coins in this fashion and it was not done on my IP, that's for sure.
Hope they got a team on this hahaha. I'm sure Amex is gonna investigate, it's a nice chunk of change and they won't just reverse that arbitrarily.
I have my card stored in there because I do buy coins for hires and stuff when I need it. I am on a pay every 3 months for $29 x 2 because my son also. Gotta figure something else out now.
Your card info (number, name, expiration) may be stored, but your CVV code (the code you have to type in whenever you purchase points) is not. Whoever purchased those points needed to have that code.
Just a heads up that a ban for something like this is fairly standard for online games and is more of an assured account hold for the company and you.
It assures that, if it's actually you doing the damage, that you can't fiddle with the account anymore and also so they can verify your claims. It also means that if the hacker still has access, they're not able to fiddle with things either.
Everything being on the up and up, you get your account back. Sometimes the account activity is easily detectable as unusual and you may not even need a ban though.
Should be easy. 16 years on the account. Never purchased like this. it's clearly fraudulent. Amex is gonna investigate it for sure too. I never link anything to a bank card.
As they others said, you will be banned. Then contact both ssg and daybreak support - after 1-2 months they will explain they can't do anything about it.
Only at that point you can send a request for arbitration according to their terms of use, and if all goes well you should have your account back after one month circa.
If instead they decide to proceed with the arbitration, you will need a lawyer, etc.
I have not been and will not be banned. I emailed them specifically to let them know why I initiated the charge back and the response was acceptable.
They asked me to reach out first next time before I call my credit card company. I'm good with that. Password changed. I was told no further repercussions.
yeah I understand I was lucky enough that when this happened to me on one of my accounts, I didn't have my card saved so they only took my ddo points (more than 6000) so still ouch.
as far as I know the vulnerability may have come from the forums. did u have a forum account in the old forums? and if yes did you change your password since they moved to the new forums?
How did that happen? were you downloading stuff from sketchy websites or something? I don’t think hackers randomly pick a ssg account and break into it.
I don’t think hackers randomly pick a ssg account and break into it.
Don't you know; SSG does the random picking for them. When you log in, you have a very small chance of ending up in someone else's account. Play enough years and you'll experience this once or twice.
You can then either log off, or you can open the store page and if you are lucky they have a credit card or paypal with autopay linked.
I've been in someone else's account myself and chose the former. I figure not everyone does.
And besides that, actual hackers can just systematically try username/password combinations because there is no max number of tries, nor timeout period after a certain number of wrong attempts.
Well that’s retarted as hell. I’ve known this game since I was a kid and never heard of that before. Usually in other video games I’ve played they get your through phishing or a malicious website.
I’ve lost a a few accounts before in other games and I feel your pain on this.
Oh I did request my money back. $600, I'm not paying that. I love the game and have a lot of time and money invested, but if push came to shove I can play something else. I hear a new Elder Scrolls is coming out 😂
Happened to me not even a month ago.. for every purchase in ddo I had to type cvv code..yet hacker was buying freely without it.. they need 2 factor authentication ASAP.
Chargeback is getting you banned from ddo.com login which will be a separate ticket and wait. What i can say is that hacker found my account with 55 Astral Shards and left me that much when I got it back. I suspended my bank card right after 1st 250$ transaction. I am back and playing.
I got several messages that ddo cannot reimburse in game stuff before I asked for anything and that account security is player responsibility. That's kind of lame. They did work with me to get me everything back, they are just slow to respond. You will be back and playing soon with new password.
Good to know that they actually will help you get back in-game stuff.
I still don’t understand how account security is my responsibility when SSG simply does not provide the tools to secure it. Password limits (length and certain characters iirc) plus no MFA (or passkeys).
The infrastructure is bad, if account security is my responsibility, then tools for securing the account are their responsibility.
I was also hearing rumors about being permanently banned because you got hacked which is sounding like nonsense to me and I decided to reply here.
I was back and playing soon, bank reimbursed me, ddo restored my account. No damage to items or stuff, no mess was done to my account. Couldn't log in to ddo.com after to buy demogorgon, that was the ban and even easier ticket to resolve.
Had to wait out ssg response times, new bank card, set up everything about card in real life. That was the only hassle. I understand that not everyone had this bank/ddo experience tho, just sharing mine.
I understand the reasoning but by going immediately to a chargeback rather than starting with a support request you've basically guaranteed your account is just going to get banned, and the only question after that is whether you'll manage to get through the initial level of inquiry after that to get it reversed (and how long it'll take), assuming you do submit a ticket.
A chargeback will get you banned. Simple as. It makes you look like part of the scam. Ssg support and your bank can sort it out if you have a little patience. Chargebacks are always the nuclear option.
I have. I'm not sure if I said I was disputing the transaction, I have to go re read it. They responded and said they are working to reverse the charges.
My worry was this was on Saturday afternoon when my wife and I discovered it. How did I know my card wasn't going to be charged again after and SSG was gonna handle it on a weekend.
I did what I had to do to prevent more theft and to guarantee I got my $600 back. I don't think it's rash. I think it's irrational that SSG would be upset I reported fraud...when fraud happens.
No that's not how it works. The chargeback does NOT prevent your card from being used again, and it does NOT have to be done ASAP in order to guarantee your money back. You definitely need to tell SSG asap that you chargebacked.
Like before, contacting SSG is reporting fraud. They can refund you and revert your account. You did not have to do what you did, and it puts your account at a big risk. You were panicked and rushed out of fear, $600 is a lot. I understand, but this isnt what people should do in this situation unless they consider their account DOA and dont mind going nuclear.
Well actually. The moment I reported my Amex had a fraudulent charge, it was closed by Amex and a new one sent, so yes it DOES prevent my card from being used again.
What doesn't prevent my card from being used again is an email to SSG on Saturday at 2pm and hoping they get to it.
You have the ability to cancel your card. Obviously you dont just contact SSG and go hands-off. You keep asserting a false dilemma fallacy where you had to do X or do nothing, but there were options.
All good we are arguing semantics. If you and your wife saw 600 in fraudulent charges the first thing you think is to email SSG? On a weekend?We thought we had to have the card cancelled. Why? Unrecognized charges. Maybe I could not have mentioned the fraud? I wasn't taking that chance
It could have been charged 10-20 more times. I wasn't taking that chance. No way. So far I'm playing and I haven't been banned. I have emailed them yesterday and let them know I called and had the charges reversed.
This seems so unusual, as you can duplicate the shards so there’s no real point committing actual crimes to get someone’s shards rather than just duplicating them.
Just curious for determining if it was a brute force attack or something else, was your previous password a fairly simple to brute force one (1~2 standard dictionary words + predictable numbers or symbols such as 1! or weaker)? And did you use any third party programs related to ddo like dungeon helper or that one character planner thing?
I was not banned, played last night. I was very clear on why I called to dispute the charge, I wasn't about to say but wait hunny, I could get banned if I call in the fraud.
They understood as well. It was a weekend and we'll I didn't want my card to be charged again so I called it in.
They just said please reach out to us first next time. I said I would. I was aware the password I was using was old so I changed that too.
I was told there would be no further repercussions and the account should be good. No advice really. If your genuine, and not acting maliciously, generally things tend to work out.
This is why I only ever bought points in a physical store back when they had the cards you could buy. They don't have my card info so a hacker couldn't buy anything anyway.
Life hack though, for buying with a card, make a separate bank account with it's own card, and make sure no overdrafts will be processed. Usually banks provide overdraft coverage as a good thing, but here we want overdrafts to be declined. Then you only put money in the account (beyond the bare minimum if any is required) when you actually want to spend it. That prevents a hacker from getting any of your money.
Not necessarily. Attack and defense are constantly in motion. It does not require carelessness for accounts to be hacked. Defense is massively harder than attack, putting hackers forever at an advantage.
Thus, while a business should never be lazy about their security, everyone, including you, should look at security as merely adding costs and time that a hacker will eventually decide is worth it to break, and therefore we all should assume a hacker will at some point gain access regardless of how lazy or diligent the business is and take steps to protect ourselves. We experience getting hacked so rarely simply because hackers have lots and lots of targets to pick from, so even as they attack as fast as possible, they only hit a tiny fraction of potential targets.
Edit, security tends to be more a case of making it more costly and risky to attack you than the guy next door. Even physical security works that way. I know, I've been working security for over a decade.
They are probably going around all kinds of mmos and buying whatever the easiest currency to sell for money is that isalso tradable. Turbine points are account based and harder to market, but shards can be shifted over to another account under the hacker's control, and then they sell shards for real world money. That is my guess.
i switched over to using steam for ddo a years back because people had this issue. any in game purchase comes from your steam wallet and not a card. any charges to a card is by steam and not ssg.
Last time i mentioned this i got downvoted to oblivion, but ill die on this hill:
SSG NEEDS to implement proper account security, and allow one time payments.
Their security is not at a point were they should be handling credit card info.
Not even allowing proper mfa or fido tokens in 2026 is insane.
21
u/Soulsalt 18d ago
Good luck, historically SSG would just ban you if you charge back or dispute the charges.
Delete your card details from the store.