My account hacked!

I went on vacation last Wednesday and decided to check my email today to see what I'd missed. I found a coinlock email, followed by a request to change my email address to some ungodly nonsense from hotmail, then... silence. I immediately tried to log into my account and of course could not. I just spent what seems like the longest half hour of my life on the phone with customer support and they were able to change my email address, etc and then temporarily ban my account while they straighten everything out. I have no way to access my character to find out what has happened in the meantime, but if you've seen Elsimer or Kreesis walking around this past week then it was NOT me playing them. If I've been kicked from the guild (or if the hackers took me out of the guild) that's another thing I'll have to fix when I get back.

This is NOT the way I wanted to come back from vacation. First time I've ever had a problem with my account, and it scares the bejeebers out of me! I'm still shaking. Anyway, I wanted to let the Family know what was going on. Hopefully nothing drastic has happened in the meantime.

No worries man we've got your back :)

So... how did they clear the coinlock? Did your e-mail get hacked, too? I would definitely throw out the password you were using for your e-mail and account and NEVER use it again. I had to retire my old standby back when linkedin was hacked for the same reason - it's just way too easy for somebody to set up a bot to try every e-mail/password combination in those compromised databases these days. Account lockouts aren't even effective - the farms these guys use will switch proxies to something geographically close to you.

what it looks like they did was first hack the account then when it got coinlocked they changed the password and email address so they could get around the coinlock. i'm still going to have to clear it up since they restored the characters as of friday - 2 days after i left on vacation

They really should not allow an account that is coin locked to change email or password without confirmation O.o Let me know if I can help.

Just in case, you might want to check your system for anything malicious. I mean there is really no way for anyone to know your Trion login is there? So, grab a program called Malwarebytes and let it scan your system. It is an excellent tool designed to find things that anti-spy tools will not. Such as key loggers, oddball network connections, etc. Here is a link. http://www.malwarebytes.org Also, on a another note, I have heard to folks can get coin lock if they log in from a different IP/network than the servers are accustom to you using. Did you happen to do that while traveling?

I'll give that a shot Jezzebell. No, I've been in South Dakota (still am) and I don't feel comfortable loading up Rift on my in-law's computer. Besides, it feels good to unplug every now and then. I'm pretty sure what happened was the coinlock was the hackers gaining access to my account the first time (which started the coinlock) and then changing my email address once they confirmed they had access but couldn't do anything with it. Then they changed the password to prevent me from easily changing the email address back before they were done with it. From what Trion changed it from it looks like they changed email addresses at least one more time after that so that when/if I ever called Trion I wouldn't be able to even give them the email address it was currently registered to. To give you an idea of how completely screwed the account was, they also changed my country (unless that happened while Trion was changing things around, which is possible) so I had to delete my credit card information which required me to cancel my subscription, change countries, then put in new credit card information and address info then call Trion Support again to confirm that I was still eligible for the Founders pricing. I got an email from the GM saying they had been able to recover both Elsimer and Kreesis as of their last save on Friday. I replied back that I had last logged onto them on Wednesday, but I haven't had a chance yet to see if anything is missing so it's still a bit of a question mark. I will say I've been impressed with Trion's support line. I was on hold for a few minutes at most both times I had to call and the representatives were able to get everything fixed up - pretty good considering the hackers had royally screwed over the account to the point where I fully expected to hear a canned "too bad so sad" at any minute. I couldn't help but notice Trion is listed as developing an MMOFPS as well, and this experience has got me thinking seriously about trying it when/if it gets to that point.

I'm sorry. I remember being hacked on my EQ2 account. Ultimately, it's why I left the game. I got everything back, but the time it was going to take me to try to figure out what belonged to whom and where was overwhelming. If you need anything, please holler :)

There's a pretty good chance that they got Elsimer's account info from a compromised database. I am really kind of shocked that they would allow you to change the account e-mail address while coin locked - that's just dumb! I think I might do some tests to see if that really is the case. I hope they manage to get you everything back. With free server transfers the gold farmers now have an easy way to transfer money from a hacked account. I wouldn't be at all surprised if Elsimer and/or Kreesis had been moved to a different server, all of their gear vended, and their gold dumped onto a mule.

Coin lock prevents server transfers and I'm sure that Elsimer will come out of this with little or no loss... maybe a grey hair or two

I was finally able to get on yesterday. It took me a bit to get Elsimer set back up correctly, and when I finally did I found that among the other things they had done was untraining my Mining and instead training Butchering(which was up to 270)! Well, I already had a master Butcher and desperately needed my Miner back so I had to put in a petition. One admin kick later I got back on and they had rolled Elsimer back to the 19th of July. I lost a few plaques out of it, but other than that everything was back to the way they should have been. Kreesis had barely been touched by the hackers. Based on what I saw on Elsimer before the last restore and Kreesis, they were using my account to farm gold and materials. Before Elsimer's restore, he had been camped in Stillmoore in his dps equipment with somewhere around 5 stacks of shadethorn lumber in his inventory and something like 11 stacks of ironpine drink. Oh, and he had just over 100 plat when I had logged him off with 14 plat to his name. Kreesis, similarly, experienced an increase in coinage so all in all I haven't lost anything except a few hairs and now I occasionally have nightmares about someone taking my account.

Sounds like their plans were interrupted, which is some small consolation. Good to know Trion was amicable to setting things right.

The dirty secret about fan websites is that they tend to use less robust security for their membership databases than gaming company websites. This makes them a target of choice for gold farmers trying to steal game accounts. If you register with a fansite, be sure to use a different email/password than your Rift account.

Another dirty secret about fan sites is sometimes their ads contain malicious script, and all you have to do is load the page onto their site and boom! Infected with a key logger or worse. I rarely ever go to fan sites, and if I do I enable NoScript Firefox addon (for Firefox browsers). The fan sites are pretty much the victims of this also, as the advertisers are the ones doing it. It has even supposedly happened at Zam although they do try to take precautions and remove any malicious ads as soon as they are discovered (this info comes from a rift forums post by a Zam employee). Also sometimes parsers contain malicious code. Be wary. I am glad to see you got it sorted out Elsimer.

Like Fairybella says, No Script is almost mandatory for browsing the internet now days. I highly recommend you guys install it with Firefox.

Make sure your game account details never match that of a forum account or any form of password you put into a webpage. Install Noscript - You would be surprised how many legitimate businesses have dodgy security. Use a strong password with !@#$%%^&^*() uppercase and lowercase letters and numerals, change the password monthly (use your numerals to designate the month if it makes it easier to remember). Personally I would also put Rift and any other programs that have large downloads onto a External HDD, then reformat your PC and give it a fresh install, just incase they planted something in your registry that anti-virus software hasn't picked up on. Yes I am paranoid. I was hacked in 2008 and haven't been since. The fault was mine as I had a forum account with the same password as the game in question. Since then I have done all of the above and used correct military procedure for password changes and strength.