[NEW MERCENARIES] Please note that all new forum users have to be approved before posting. This process can take up to 24 hours, and we appreciate your patience.

PSA: Customer Support Scam

ReziRezi
Vindictus Vertreter: 2,585
Posts: 436
Mitglied
in General Discussion
This will likely be deleted quick because the mods on here do instant damage control for Nexon, but hopefully some of you will be able to read it and spread the word so you won't get scammed.

As far as I have ever heard, logging into the game from Steam logs into the Nexon account of the email associated with your Steam account. Knowing this, and my account fulfilling all requirements for the Miri registration, the website said I was not eligible despite there being no marks on my account. Because of this, I contacted support.

Support stated:

- They wanted a screenshot of the issue, even though I specified it was the normal "you are not qualified" error, so I provided them with a screenshot of the message on the webpage as well as a screenshot of my character list which only showed one character, with the name and level and everything.

- I asked them if there was a problem with the accounts being connected, having told them the email and even provided a screenshot of my Steam account details page to "prove" that email was the same in Steam, even though they should have been able to see whether the email given had the character on its Nexon account or not.

- They then said they couldn't even find my character in the server, which is weird because it exists and I even provided a screenshot of the character list showing the character and everything, and even provided them with the proper non-password info for both the Nexon and Steam accounts, including Steam ID and everything.

- After all this, they said to check other accounts to see if that character was on them, despite them before saying they couldn't find the character in the server. So I simply asked them if there was a way to check characters without installing on the Nexon side and trying to figure if any random account existed with another email I have that ISN'T the one associated with my Steam.

- Rather than answering that question, they full-on replied asking for sensitive information such as date of birth, photo ID, birth certificate, etc. (They also asked for me to name 3 characters on the account, despite the fact that I had previously shown there was only 1 character on that account.)


That last part is the scam. It exists with a few MMO companies, but most of them have the integrity not to do it. Blizzard, Ankama, and a few others do it, but typically only when it comes down to a purchase issue (because they claim they want to make sure you're the account holder of the card or something, which is stupid because that's up to the bank to investigate). However, a Nexon employee asked this despite there being no purchase issue at all.

An MMO company CANNOT prove that you own an account using your personal information, because MMO companies (at least in the West) do NOT collect that info when you first create your account. Personal, sensitive information like that does not in any way prove account ownership, nor are online game company employees legally obligated or even contractually obligated to take that information to determine account ownership. The only time such information can actually be used is with transaction issues, and even then it means nothing if you intentionally used a card that's not in your name for innocent reasons (like a family member's, or a gift card).

In case any of the rest of you end up in this scenario, DO NOT leak your vital real world information to MMO companies, especially when you've already given them enough info to solve the issue (Steam ID, Nexon email, etc). Case in point, they could have just registered Miri on the Steam account themselves since they had the Steam ID and the character information, but instead they claimed the character didn't exist and asked for real world information - this kind of suspicious activity is always a red flag, so please be careful.
Sir_Render

Kommentare

  • LeXicOLeXicO
    Vindictus Vertreter: 1,345
    Posts: 196
    Mitglied
    wow...
  • SuhpremeSuhpreme
    Vindictus Vertreter: 3,935
    Posts: 474
    Mitglied
    This will likely be deleted quick because the mods on here do instant damage control for Nexon, but hopefully some of you will be able to read it and spread the word so you won't get scammed.

    As far as I have ever heard, logging into the game from Steam logs into the Nexon account of the email associated with your Steam account. Knowing this, and my account fulfilling all requirements for the Miri registration, the website said I was not eligible despite there being no marks on my account. Because of this, I contacted support.

    Support stated:

    - They wanted a screenshot of the issue, even though I specified it was the normal "you are not qualified" error, so I provided them with a screenshot of the message on the webpage as well as a screenshot of my character list which only showed one character, with the name and level and everything.

    - I asked them if there was a problem with the accounts being connected, having told them the email and even provided a screenshot of my Steam account details page to "prove" that email was the same in Steam, even though they should have been able to see whether the email given had the character on its Nexon account or not.

    - They then said they couldn't even find my character in the server, which is weird because it exists and I even provided a screenshot of the character list showing the character and everything, and even provided them with the proper non-password info for both the Nexon and Steam accounts, including Steam ID and everything.

    - After all this, they said to check other accounts to see if that character was on them, despite them before saying they couldn't find the character in the server. So I simply asked them if there was a way to check characters without installing on the Nexon side and trying to figure if any random account existed with another email I have that ISN'T the one associated with my Steam.

    - Rather than answering that question, they full-on replied asking for sensitive information such as date of birth, photo ID, birth certificate, etc. (They also asked for me to name 3 characters on the account, despite the fact that I had previously shown there was only 1 character on that account.)


    That last part is the scam. It exists with a few MMO companies, but most of them have the integrity not to do it. Blizzard, Ankama, and a few others do it, but typically only when it comes down to a purchase issue (because they claim they want to make sure you're the account holder of the card or something, which is stupid because that's up to the bank to investigate). However, a Nexon employee asked this despite there being no purchase issue at all.

    An MMO company CANNOT prove that you own an account using your personal information, because MMO companies (at least in the West) do NOT collect that info when you first create your account. Personal, sensitive information like that does not in any way prove account ownership, nor are online game company employees legally obligated or even contractually obligated to take that information to determine account ownership. The only time such information can actually be used is with transaction issues, and even then it means nothing if you intentionally used a card that's not in your name for innocent reasons (like a family member's, or a gift card).

    In case any of the rest of you end up in this scenario, DO NOT leak your vital real world information to MMO companies, especially when you've already given them enough info to solve the issue (Steam ID, Nexon email, etc). Case in point, they could have just registered Miri on the Steam account themselves since they had the Steam ID and the character information, but instead they claimed the character didn't exist and asked for real world information - this kind of suspicious activity is always a red flag, so please be careful.
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    Um, okay, but why make a clone post?
    Sir_Render
  • YusuchineYusuchine
    Vindictus Vertreter: 630
    Posts: 6
    Mitglied
    edited November 26, 2017
    Rezi wrote: »
    Um, okay, but why make a clone post?

    he maybe fail x)

    and about your story . That's why i hate Steam and i will NEVER play Vindictus or another MMO with him (except if the game force to use steam )

    2 month ago a friend tried to play with another player at vindictus . But he never found it . because the other guy use Steam . like if he was in another dimension .

    Rezi wrote: »
    An MMO company CANNOT prove that you own an account using your personal information, because MMO companies (at least in the West) do NOT collect that info when you first create your account. Personal, sensitive information like that does not in any way prove account ownership, nor are online game company employees legally obligated or even contractually obligated to take that information to determine account ownership. The only time such information can actually be used is with transaction issues, and even then it means nothing if you intentionally used a card that's not in your name for innocent reasons (like a family member's, or a gift card).

    false . when you create a account on the vindictus website . you must use your date of birth and others things .
    i already did that to restore my account with DragonNest . they asked for a picture of my ID in front of my pc with a special file open on the screen to prove that I also have the mail u_u that was insane but i recovered my account
    Rezi
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    edited November 26, 2017
    Date of birth is one thing, but they do not ask for your photo ID, birth certificate, or other details when creating the account. Therefore, those extra, sensitive details do not prove account ownership.

    If you provided them with a photo ID and other sensitive details, you have been scammed. Unfortunately, it is not illegal for companies to take this sensitive information since you're giving it willingly, but withholding access to your account if you don't provide that information is blackmail and can get them into legal trouble depending on the nation, since there is no legal justification for them obtaining that personal information.

    Most people do not realize how sensitive that information is. Providing photo ID and/or your birth certificate can easily result in identity fraud, so you should never, ever, give it out.
  • PrototypemindPrototypemind
    Vindictus Vertreter: 8,530
    Posts: 1,320
    Mitglied
    Yeah, Nexon does actually ask for all that in some instances. You're only one of many who have posted about it. It's not something I'd deal with to get an account restored, etc., but it is something that they do.
    Sir_Render
  • TamagoTamago
    Vindictus Vertreter: 5,460
    Posts: 733
    Mitglied
    edited November 27, 2017
    This is something they've always done though. They only ask for it to prove account ownership if you've been banned, hacked, want an email change via ticket, etc. Of course, most people signed up with fake info anyway. If you remember the info you signed up with, they still require ID in addition to that. Black Desert Online requires ID for email changes, etc. as well. At least Nexon has the decency to remove/ censor the information after you provide it. BDO doesn't even do that.
  • RobertLiviaRobertLivia
    Vindictus Vertreter: 2,905
    Posts: 187
    Mitglied
    edited November 27, 2017
    Don't understand what is the scam part, you only need to show the name, I don't believe they ask for your social security etc.
    If you use fake info to register your account its not their fault if you lose it.
    The ID thing is normal for account verification, ownership etc...

    What is the scam? Since you put it in the title.

  • Order5Order5
    Vindictus Vertreter: 5,900
    Posts: 935
    Mitglied
    Unfortunately, my input is the same as the others. Currently, there's nothing in your post that indicates a scam, and asking for photo ID is something that Nexon has always done. In most cases it makes little sense.

    When I first started playing over 3 years ago, my account was put on lock after only 2 weeks, and Nexon asked for ID verification. I went to the forums for help, but I was pushed off by the community as someone that did something wrong and deserved to be banned (even though it was just an account restriction). I had to go to the EU boards for any kind of help or input, and they said that I'd just have to trust Nexon. So far I haven't had anything suspicious happen, but I am always anticipating that something might happen one day.
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    Mainichi wrote: »
    They only ask for it to prove account ownership if you've been banned, hacked, want an email change via ticket, etc.

    Except that none of those things existed in this incident. This was a question about why the same email wasn't linking, or why the linked account wasn't registered - it didn't have anything to do with email change, or hacking, or rule breaking. I all asked was if there was a way to look at the characters of a game on the site without having to install it, as other MMO companies have this function; I didn't even ask for the accounts to be linked (because I wasn't even told they weren't linked or anything, they couldn't even find the Steam account for some reason despite providing the Steam ID), or unlinked, etc. There was no reason for them to ask for this information, and even if that information is provided it DOES NOT prove account ownership.
    Sir_Render
  • PrototypemindPrototypemind
    Vindictus Vertreter: 8,530
    Posts: 1,320
    Mitglied
    Then it was poorly handled. There's still nothing to indicate that there was an attempt to scam you in any way.
  • RhapsodyOfFireRhapsodyOfFire
    Vindictus Vertreter: 5,375
    Posts: 625
    Mitglied
    There is a good reason behind that. Account thieves usually don't give over their personal informations, but if you are the real owner, you probably want to have your issue resolved so you will give it to them anyway. It's like a tertiary 'password'.

    They are obligated to delete those informations after your issue got resolved. If they use it in any way after, then they would be in a serious legal trouble.
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    but if you are the real owner, you probably want to have your issue resolved so you will give it to them anyway. It's like a tertiary 'password'.

    No, it's not. It's extortion and privacy invasion. The people who give that information are just impatient and don't care enough about identity theft to protect themselves. What they don't realize is that not only the company employees, but anyone who hacks the company can get all of that information.

    And while they are supposed to delete that information, they don't really have to because no government in the world investigates to make sure the information has been deleted, which is why many MMO companies keep that data over time. In fact, many nations that have the law you're speaking of (of which there are very few) allow companies to keep that information months or even years before the law requires them to get rid of it through super complicated means.

    In the beautiful world you're envisioning, a hacker could send a complaint about a false hack and give their real information over, then the legitimate account holder will lose their account just because the hacker gave over their own information. The company will think the hacker is the real account holder, and therefore the company will hack the account FOR them.
    Sir_Render
  • Order5Order5
    Vindictus Vertreter: 5,900
    Posts: 935
    Mitglied
    It's clear that your only aim is to slander Nexon, and posting on a site that they own is counter-productive; as you have said in your opening post, the forum mods can simply delete your post. Besides, what you're saying is already out there and easy to find just by Googling "Nexon asking for personal information". People don't need to get the word out anymore than they already have been.
    Rezi wrote: »
    but if you are the real owner, you probably want to have your issue resolved so you will give it to them anyway. It's like a tertiary 'password'.

    No, it's not. It's extortion and privacy invasion.

    There really isn't any extortion in this particular situation because the only thing hanging in the balance is a Miri registration package that you don't even own yet. And based on your argument, giving up false information would work just the same as real information
    Rezi wrote: »
    An MMO company CANNOT prove that you own an account using your personal information, because MMO companies (at least in the West) do NOT collect that info when you first create your account. Personal, sensitive information like that does not in any way prove account ownership, nor are online game company employees legally obligated or even contractually obligated to take that information to determine account ownership. The only time such information can actually be used is with transaction issues, and even then it means nothing if you intentionally used a card that's not in your name for innocent reasons (like a family member's, or a gift card).
  • MisterWhiskersMisterWhiskers
    Vindictus Vertreter: 2,615
    Posts: 348
    Mitglied
    this is done by other companies too,including riot games or blizzard

    what's the big deal here?
  • Order5Order5
    Vindictus Vertreter: 5,900
    Posts: 935
    Mitglied
    edited November 27, 2017
    this is done by other companies too,including riot games or blizzard

    what's the big deal here?

    Rezi's point is that it's not something that should be done by just any company for just any reason - billing or other transactions being a prime example of when it's appropriate to pry for personal information.

    A lot of people will just rub something like this off as paranoia. Others will comply to this fishing of personal information because they are already invested in social media, which I believe endangers a person more than a gaming company. I could be wrong though.
    ReziSir_Render
  • TamagoTamago
    Vindictus Vertreter: 5,460
    Posts: 733
    Mitglied
    edited November 27, 2017
    You realize that they delete/ censor all the information you provide in the ticket after they read it, right? I've gone through this process many times in the past. They don't store your ID anywhere. They've let me censor everything except for the name and birthday in the past as well, but I'm not sure if they still let you censor anything on your ID.

    It's not a scam or extortion regardless.

    They do this to verify account ownership. If you know the name and birthday you signed up under, regardless of whether it was fake or not, then you're likely the owner. If it matches your ID because the information was real, then that's pretty solid proof it's your account. I personally signed up with fake information back in 2007/2008, but I still know the name and birthday I signed up under.
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    edited November 27, 2017
    Order5 wrote: »
    There really isn't any extortion in this particular situation because the only thing hanging in the balance is a Miri registration package that you don't even own yet. And based on your argument, giving up false information would work just the same as real information

    I didn't mean extortion in this situation. Although technically failing to solve this in the way I already specified on here (just find the account with the character and register for me since I obviously owned the Steam account) just because I didn't give RWI in a situation where it wasn't needed does count as holding the solution ransom.

    And no, I said that if a random person contacted the company, said "here's my real world info, I want this account cuz I say it's mine", Nexon would take access away from the rightful owner and give it to that random person, if we follow Rhapsody's logic of RWI acting as a tertiary password.

    Mainichi wrote: »
    They do this to verify account ownership. If you know the name and birthday you signed up under, regardless of whether it was fake or not, then you're likely the owner. If it matches your ID because the information was real, then that's pretty solid proof it's your account. I personally signed up with fake information back in 2007/2008, but I still know the name and birthday I signed up under.

    I don't even remember putting in a name when I signed up with this account, because it was far too many years ago. I've made multiple accounts over the years, in some cases because I forgot I already had one, and I don't remember which names I used to sign up with. I likely haven't ever used my real name because it's none of their business what my real name is, but I may have - I don't remember because it's been so long ago, and I don't even remember there being a name section when I registered.

    And speaking of which, what will you do when they ask you to provide an ID for that 2007/2008 account? Are you going to photoshop an ID to get the issue solved? This is the problem - nowhere does the company say they need your RWI for account verification. They only say that in hindsight once you try to use Support, and tons of other MMO companies are the same way.

    I have access to my email, my Steam account, my character in-game, my secondary password, and I could easily answer some security questions if I ever set those up. RWI is completely unnecessary and proves nothing. It's an illogical invasion of privacy.
    Sir_Render
  • TamagoTamago
    Vindictus Vertreter: 5,460
    Posts: 733
    Mitglied
    edited November 27, 2017
    Rezi wrote: »
    Mainichi wrote: »
    They do this to verify account ownership. If you know the name and birthday you signed up under, regardless of whether it was fake or not, then you're likely the owner. If it matches your ID because the information was real, then that's pretty solid proof it's your account. I personally signed up with fake information back in 2007/2008, but I still know the name and birthday I signed up under.

    I don't even remember putting in a name when I signed up with this account, because it was far too many years ago. I've made multiple accounts over the years, in some cases because I forgot I already had one, and I don't remember which names I used to sign up with. I likely haven't ever used my real name because it's none of their business what my real name is, but I may have - I don't remember because it's been so long ago, and I don't even remember there being a name section when I registered.

    And speaking of which, what will you do when they ask you to provide an ID for that 2007/2008 account? Are you going to photoshop an ID to get the issue solved? This is the problem - nowhere does the company say they need your RWI for account verification. They only say that in hindsight once you try to use Support, and tons of other MMO companies are the same way.

    I have access to my email, my Steam account, my character in-game, my secondary password, and I could easily answer some security questions if I ever set those up. RWI is completely unnecessary and proves nothing. It's an illogical invasion of privacy.

    I've already stated this, not sure why you're asking me something I already answered. It's like you skipped the first half of my post.

    I've provided my ID several times already, due to various issues/ tickets throughout the years. I haven't had any issues with it at all. They've let me censor everything except my name and birthday in the past as well, but I'm not sure if they still let you do that. I don't get why you're making such a big deal over it when it's not. They state that you need this information in several of their help articles, such as this one. I'm not going to link the others because I'm too lazy to find them.

    As for your example with the tertiary password thing, you completely missed the point that you'd need to know the name and birthday on the account as well. First name/ last name/ birthday are the first things you need. ID is also something they require, and acts as a tertiary password in that sense.

    As for your actual issue, have you tried changing your Nexon account's email?
  • ReziRezi
    Vindictus Vertreter: 2,585
    Posts: 436
    Mitglied
    How would changing the email help? The Nexon account's email I'm using is already the exact same as the Steam account email, so they should already be linked.