Whichever MMO you play, you'll eventually see players complaining they have been hacked. It happens more often than you might think. Keep reading for advice to prevent this from happening to you.

In the first part of this article, I described how players' accounts can be stolen through the use of keyloggers, phishing scams or by simply asking for passwords in-game. In the second and final part, I'll be taking a look at three more ways that MMO accounts are stolen: through insecure passwords, buying gold or being taken by a friend.

Insecure Passwords
If you have a poor password, you put yourself at risk of someone guessing it or being a victim of a "brute force" attack, where an automated system attempts to guess your account's password. However, even strong passwords can put you at risk if you use them in more than one place. Corrupt forum administrators have been known to try their users login details in MMOs in the past, stealing their accounts if the login details match up. Some websites that require you to set up accounts with them could also be subject to a similar attack. However, it's not just your game account that's at risk from this type of hack - email accounts can also be stolen if they're web-based (i.e. with Hotmail, Google or a similar provider). This can be even more dangerous than your game account being stolen, as once someone gets into your email, they have access to all the information stored in your inbox and your "sent messages" folder. In other words, they could be able to see what type of accounts you have (and not just game accounts, but online banking accounts too) and use your stolen email address in order to reset or change their passwords. If this happens, you've not just lost one account - you stand a chance of losing EVERY account you have access to online.

Game accounts aren't the only things at risk of being hacked.

The first method you can use to avoid such attacks is to have a strong password, containing lower-case letters, upper-case letters and numbers. These passwords are the most difficult to guess, so are safer than using simpler passwords. Also, don't choose a password that someone who knows you may be able to guess, or some of the more commonly used passwords out there. These include names of sports teams, people's names and number sequences (e.g. "123456"), as well as "letmein", "password", "qwerty" and "monkey". If you're using a password like this, I'd recommend changing it straight away. Secondly, never use the same password in more than one place. It may be a pain having to remember multiple passwords, but doing so will help keep your accounts secure or at least minimise the damage if one of them is stolen.

Buying Gold
Before I get into this subject properly, I'd recommend that everyone reads Guild Wars' policy on gold sellers, as the information contained there is good and applicable to most MMOs. The fact of the matter is that gold sellers' gold doesn't just come from using bots, it also comes from stolen game accounts. Keyloggers and phishing attacks often come from the gold sellers themselves, or if not directly from them, then from their suppliers. However, this isn't the focus of what I'll be talking about here: the fact of the matter is that if you buy from a gold seller, you set yourself up to have your account stolen by them at a later date.

Many gold sellers want high-value accounts to steal from, and if you've purchased from them in the past there's a good chance there's still a large amount of money - or items that can be SOLD for large amounts of money - on your account. The gold sellers will then be able to target your account for a hacking attempt, either by sending phishing emails to your email address or by knowing your character name and/or login details. If you've previously given a gold seller your password and haven't changed it since they transferred the money onto your account, you might as well be asking them to steal from you. Gold sellers can get away with targeting their old customers because it's not always obvious to players WHO has stolen their accounts. As a result, some people may fall into the trap of buying back their own stolen gold , in order to replace what was taken by the gold sellers.

Spamming isn't the only thing that gold sellers are responsible for...

The way to avoid being targeted by gold sellers in this way is simple: DON'T BUY GOLD. If you have bought gold in the past, you're at risk of them coming after your account. I'm loathe to give advice to people who've bought gold online (as I know where much of it comes from), but I have to accept that many won't have known its true source. First, if you've previously given a gold seller your password, change it immediately. You should also change the password on ANY OTHER accounts you have that use the same one. This includes your accounts on other games, as well as your email address and any other online accounts that the gold sellers may be able to identify as yours. Second, remain on the alert for phishing emails or messages directing you to sites containing keyloggers (see Part 1 of this article) or other infected files. The gold sellers will probably have your email address on file, so they'll be able to go after you time after time with this type of scam. Finally, consider changing the email address listed on your game account. You should be able to avoid some of the attacks on your previous email address by doing this and discard any emails about MMOs sent to them as being from hackers.

Stolen by a "Friend"
It's common practice in some guilds for members to know each other's passwords. This is more common in high-end guilds, where highly-geared characters may be needed in order to complete instances or participate in other types of raid. However, giving your password to someone else so they can use your character is a bad idea. Someone may be your friend now, but there's no guarantee that they'll remain that way forever. One day, a member of the guild could decide to log into your account and strip it of anything of value, either maliciously deleting everything or transferring the contents to their own account. It's not just online friends that this can happen to though - people you know in real life may do the same thing. Real-life friendships and relationships can also go sour and things can get ugly when they do. As tempting as it may be to let your friends, family or boy/girlfriend play on your account, what happens if the relationship goes bad? It's not uncommon for people to take revenge should something like this happen, and sometimes that revenge means destroying the MMO characters someone's worked so hard to build up. Having your account stripped down or stolen isn't the only problem you could face though - password sharing could result in your account being sold on an online auction site. After all, how is the buyer going to know they're not purchasing it from the original owner?

Stealing someone's account is a criminal offence.

The way to stop any of this from happening is simple - never give your password to anyone you know, no matter how close they are to you. It's better to mildly annoy someone at how careful you are than it is to lose years of progress across all your characters. Also, don't assume that this couldn't happen to you, as that's what everyone else thought before it happened to them. If you've ever given your login details to someone, change your password now, before someone else does it for you.

General Tips
I'd like to finish by giving some general account security tips which don't fit under any of the headings above, or in the first part of this article:

• Don't log in from insecure PCs. Your PC at home may be well-protected from keyloggers and the like, but what about those belonging to your friends and family? Similarly, PCs in LAN centres and internet cafes may not be as well protected as your own, so if you have to log into your email address or anything else from them, be sure to change your password once you get home.
• Don't save game account details in your email account. If someone gains access to your email address, the less information they have access to the better.
• Read the forums for warnings phishing scam warnings. Official forums often contain warnings from the game's publishers about ongoing scams, to help protect their users.
• Check for game-specific security tips. Official websites and forums often give advice on how to make sure your account remains secure. Make sure to read and act on this advice, as it could prove useful.
• Hold onto your game boxes and serial codes. If your account is stolen, some publishers will ask you for the serial code entered when first signing up for the account. This is done so that they can be sure they're talking to the account's real owner. If you've bought a boxed copy of the game, this is something the hacker should not have access to. Providing this code to the GMs should help you get your account back.
• If you get hacked, check the official forums for advice. Most MMO companies have "stickied" threads on their forums giving details on what to do if your account gets hacked. You'll need to follow these to the letter if you want to get your account back quickly and with a minimum of fuss.
• Find out how to identify GMs in-game. Members of staff usually have something special to identify them in MMOs, such as a "GM" tag in front of their names or their messages looking different to other players'. Finding out how to recognise a GM should help you avoid being tricked by an impersonator.

That's about it from me, but if anyone else has tips on how avoid being hacked, please feel free to add them below. The more information we have to protect ourselves against hackers, the better.

SAM "azerian" Maxted
Editor
ZAM.com