Account stolen by tricking support - need your help

[[BG]Archon]

Hi Betty, one of my guild mates had a severe incident that started 12 days ago - I want to share with you what happened and ask for your assistance. I hope the end result will be that you will be able to get him his account back and compensate him in some manner since it was YOUR (!) support that gave his *VIP16 over $10K spent in the last year* account away to some bottom feeder for $20.
--------------------------
Executive summary: Hacker got into account, migrated from s34 down to s25 and then to s1, used those two $10 transactions to email support and claim ownership of the $10000+ account.
Support believed him, ignored the pending ticket of a hacker breech from the original owner opened days before and gave the account away.
--------------------------
Timeline:
October 16th, 12 days ago:
My guild mate (named "Creeper") was playing as he usually do, fighting arena and thinking about the next event when he could spend another $230 to get succubus skin and the new hero when all of a sudden a pop up appeared on his screen.
"You've been disconnected because someone login with your account. Please make sure your account info is safe"
He immediately sent a screenshot in our Line guild chat and asked what does it mean - to this I replied "Your account has been hacked! contact support ASAP and let them know!"

He did as I asked, and on October 16th he started a conversation with support, telling them that someone got into his account and he needs a way to reassign his HC account to another apple ID.
Support didn't help him for three days. The hacker and my guild mate kept disconnecting each other whenever they logged in until...

October 19th, 9 days ago:
The hacker had enough of getting disconnecting and decided he is going to take the account away. He left the guild and migrated (!) using $10 to s25, thinking that will make my guild mate lose hope and stop trying to connect. My guild mate asked me what to do and I replied - just contact support and let them know what he did, he continued the conversation from October 16th and told support his account is now on another server.
Support didn't answer since this was the weekend, my guild mate decided he is still going to play his account until support answers and again the hacker and him kept disconnecting each other.

October 22nd, 6 days ago:
The Hacker migrated the TL110 VIP16 account to s1, opened a new lvl1 account there and msged support to help him recover "his" account using the two $10 transactions he made!
Just like that, the hacker claimed ownership over a VIP16 $10k spent in the last year - all he needed was a screenshot of the last two $10 transactions.
Support helped the hacker, believe it or not, and now my guild mate sees a lvl1 account when he logs into original apple ID and another lvl1 account he created on s34 when he logs into his new apple ID.



The details:
His original TL110 account on s34:
Account ID 28925331
Name: Creeper
The hacker migrated that account to s25 on October 19th, three days after creeper let support know his account has been hacked.
If you look for this account you won't find it because it's now named "NK28925331" and deleted from the server.

His TL110 account that was on s25:
Account ID 29060163
Name: hacker changed account name to "vk 33"
That account was migrated by the hacker on October 22th to s1, it's now named "NK29062931".

His TL110 account on s1:
Account ID 29062931
Name: hacker kept the name "vk 33", msged ingame support that he lost his account and switch it with another lvl1 account he had on s1 using the two transactions for migration for proof of ownership for a $10k+ account, and you did it! I can't believe you did it.


The account my guild name (Creeper) sees now when he tries to log in into his account:
Server 1, lvl8 account named "NickName"
Account ID 29060208


I asked him to start a new lvl1 account on our original s34, I don't know how you are going to do it - but he shouldn't have to pay $400 to migrate his account that is currently being owned by the hacker on s1 to s34.

Account ID 29070372, lvl1 account connected to his new apple ID.


Some big transactions ID so you will know he is the ORIGINAL owner of the account and not that guy who sent you a screenshot of two transactions of $20 as a proof of ownership for a $10k account:
Oct 9th, $49.99, MSL70ZM3T9
Oct 9th, $19.99, MSL70ZLYVG
Oct 9th, $99.99, MSL70ZM97Z
Oct 11th, $99.99, MSL7473FNY
Oct 15th, $99.99, MSL7871MJG

If you want I can send you as many more as you want, starting from the account creation.

Now, what I think should happen:
1. Give him his account back on s34.
2. Compensate him for the fact that ingame support helped steal his $10000+ account to someone who sent you a screenshot of two transactions of $20 total from the last week.
3. Make sure you require $99.99 transactions, preferably done 2weeks+ ago when you demand proof of ownership for a VIP16 account.

Please keep me updated, I can supply further details if required.


Thanks.

[Betty]

Hi Betty, one of my guild mates had a severe incident that started 12 days ago - I want to share with you what happened and ask for your assistance. I hope the end result will be that you will be able to get him his account back and compensate him in some manner since it was YOUR (!) support that gave his *VIP16 over $10K spent in the last year* account away to some bottom feeder for $20.
--------------------------
Executive summary: Hacker got into account, migrated from s34 down to s25 and then to s1, used those two $10 transactions to email support and claim ownership of the $10000+ account.
Support believed him, ignored the pending ticket of a hacker breech from the original owner opened days before and gave the account away.
--------------------------
Timeline:
October 16th, 12 days ago:
My guild mate (named "Creeper") was playing as he usually do, fighting arena and thinking about the next event when he could spend another $230 to get succubus skin and the new hero when all of a sudden a pop up appeared on his screen.
"You've been disconnected because someone login with your account. Please make sure your account info is safe"
He immediately sent a screenshot in our Line guild chat and asked what does it mean - to this I replied "Your account has been hacked! contact support ASAP and let them know!"

He did as I asked, and on October 16th he started a conversation with support, telling them that someone got into his account and he needs a way to reassign his HC account to another apple ID.
Support didn't help him for three days. The hacker and my guild mate kept disconnecting each other whenever they logged in until...

October 19th, 9 days ago:
The hacker had enough of getting disconnecting and decided he is going to take the account away. He left the guild and migrated (!) using $10 to s25, thinking that will make my guild mate lose hope and stop trying to connect. My guild mate asked me what to do and I replied - just contact support and let them know what he did, he continued the conversation from October 16th and told support his account is now on another server.
Support didn't answer since this was the weekend, my guild mate decided he is still going to play his account until support answers and again the hacker and him kept disconnecting each other.

October 22nd, 6 days ago:
The Hacker migrated the TL110 VIP16 account to s1, opened a new lvl1 account there and msged support to help him recover "his" account using the two $10 transactions he made!
Just like that, the hacker claimed ownership over a VIP16 $10k spent in the last year - all he needed was a screenshot of the last two $10 transactions.
Support helped the hacker, believe it or not, and now my guild mate sees a lvl1 account when he logs into original apple ID and another lvl1 account he created on s34 when he logs into his new apple ID.



The details:
His original TL110 account on s34:
Account ID 28925331
Name: Creeper
The hacker migrated that account to s25 on October 19th, three days after creeper let support know his account has been hacked.
If you look for this account you won't find it because it's now named "NK28925331" and deleted from the server.

His TL110 account that was on s25:
Account ID 29060163
Name: hacker changed account name to "vk 33"
That account was migrated by the hacker on October 22th to s1, it's now named "NK29062931".

His TL110 account on s1:
Account ID 29062931
Name: hacker kept the name "vk 33", msged ingame support that he lost his account and switch it with another lvl1 account he had on s1 using the two transactions for migration for proof of ownership for a $10k+ account, and you did it! I can't believe you did it.


The account my guild name (Creeper) sees now when he tries to log in into his account:
Server 1, lvl8 account named "NickName"
Account ID 29060208


I asked him to start a new lvl1 account on our original s34, I don't know how you are going to do it - but he shouldn't have to pay $400 to migrate his account that is currently being owned by the hacker on s1 to s34.

Account ID 29070372, lvl1 account connected to his new apple ID.


Some big transactions ID so you will know he is the ORIGINAL owner of the account and not that guy who sent you a screenshot of two transactions of $20 as a proof of ownership for a $10k account:
Oct 9th, $49.99, MSL70ZM3T9
Oct 9th, $19.99, MSL70ZLYVG
Oct 9th, $99.99, MSL70ZM97Z
Oct 11th, $99.99, MSL7473FNY
Oct 15th, $99.99, MSL7871MJG

If you want I can send you as many more as you want, starting from the account creation.

Now, what I think should happen:
1. Give him his account back on s34.
2. Compensate him for the fact that ingame support helped steal his $10000+ account to someone who sent you a screenshot of two transactions of $20 total from the last week.
3. Make sure you require $99.99 transactions, preferably done 2weeks+ ago when you demand proof of ownership for a VIP16 account.

Please keep me updated, I can supply further details if required.


Thanks.

Dear Leader
Hi, it's a bit complicated. It seems that he shared his Apple ID information with others. I search our support's skype group. The player provided all purchase history screenshots this month for the account. And that person is in the same country with your friend. With the proof, we helped the player re-linked the account. If he made the re-link proccess. We can get it back for you, please just give us the account id on your device which switched yours out. But since it migrated twice, we still need the advice from our developer and production team to see how it can be resolved. And ask your friend to change his social media or Apple/Google password once he found that the account is hacked. Because the account can only be hacked with the Apple/Google/Facebook passwords.

Best Regards
Betty

[[BG]Archon]

I can assure you the hacker currently playing the account didn't invest any money in it besides the last $20 used to migrate the account to s1, and he will also not invest anything in it in the future.
I'm not sure how the hacker obtained the login information but he most certainly IS NOT the rightful owner and he used you in order to deny access from the rightful owner.
United states is a big country, so being in the same "country" doesn't mean that much (being in the same state is a better resolution).

My friend already opened a new lvl1 account associated with a new apple ID:
s34 lvl1 account ID: 29070372, it's on s34 because that was his server before the hacker migrated the account.
The original s34 lvl110 account ID: 28925331, doesn't exist after migration (you will only find 29062931 on s1 that is being played by the hacker, he's laughing his ass off for manipulating you and getting a $10000+ account for $20).

So you're saying the hacker mailed you transactions before October 16th? before he accessed the account for the first time? that's interesting, because if that's the case then he most definitely somehow hacked his apple ID and all my friend's information is at risk.

I just want to comment that this could all have been avoided if:
A. Support would help the original owner as soon as he opened the original ticket that someone took over his account on October 16th, that was 3 days before his account was migrated by the hacker for the first time OR
B. If support has two tickets regarding a specific account from two different sources you should do a thorough investigation to understand what's going on. It doesn't make sense to me that you had a support ticket open from October 16th from the original owner that his account got hacked and on October 22th you decided to give the account to a different person based on some bogus purchase history he got.


Please keep me updated and let me know what we should do, I'm determined to help my guild mate on this and hope karma will take care of the hacker.

[[BG]Archon]

Update: I asked my guild mate to also create a lvl1 account on s1 with his new apple ID.

lvl1 accounts connected to new apple ID:
Server 1: 29074089
Server 34: 29070372

The original lvl110 account:
Server 1: 29062931 (hacker is now playing it)
Server 34: 28925331 (migrated by hacker on October 19th, 3 days after the original owner contacted support)


Thanks, please keep me updated.

[Betty]

Dear Leader
Hi, we are sorry for this. But we cannot help if he doesn't change his Apple ID password. He gave us the Purchase History Screen which matched his history on our side. If you would like to check those screenshots, I can PM them to you. I can see that we had removed all access from the account the day he reported being hacked. If the account can still be accessed, then it means that the player's private information was hacked or he shared it to other players. I will try to list the accounts and ask our admin to switch it back first. And then we can move on to solving other problems.


EDIT: I can see that our agent helped switch 29060163 and 29060208 yesterday. And from the item log. I can see that the account 29062931 was active again after 21st. So I assume that our support is helping your friend right now. Please confirm that you've got back the account or not first. Or further re-linking operation will revert it. Thanks.

Best Regards
Betty

[[BG]Archon]

Hi,
He changed his apple ID password and the hacker is not able to access it anymore.
You absolutely did not remove all access from the account the day he reported it (October 16th), he was still able to log into it until October 22nd and so did the hacker - they kept disconnected each other and I have screenshots of him fighting arena during that time. The hacker even migrated the account to s25 on October 19th - how is that possible if you removed access from it?

about your edit - he told me he stopped talking with support until I rectify it. I talked with him 2h ago and he said he still doesn't have access to his account.


EDIT: the account you mentioned (29060163) is on s25 and he still doesn't have access to it, please switch these two and let's continue from there:
Server 34: 29062931, lvl1 account connected to new apple ID
Server 34: 28925331, lvl110 migrated by the hacker on October 19th, currently sits on server 1 with ID 29062931

You can talk with April from support, I think she knows the details.

Thanks again.

[Betty]

Hi,
He changed his apple ID password and the hacker is not able to access it anymore.
You absolutely did not remove all access from the account the day he reported it (October 16th), he was still able to log into it until October 22nd and so did the hacker - they kept disconnected each other and I have screenshots of him fighting arena during that time. The hacker even migrated the account to s25 on October 19th - how is that possible if you removed access from it?

about your edit - he told me he stopped talking with support until I rectify it. I talked with him 2h ago and he said he still doesn't have access to his account.


EDIT: the account you mentioned (29060163) is on s25 and he still doesn't have access to it, please switch these two and let's continue from there:
Server 34: 29062931, lvl1 account connected to new apple ID
Server 34: 28925331, lvl110 migrated by the hacker on October 19th, currently sits on server 1 with ID 29062931

You can talk with April from support, I think she knows the details.

Thanks again.

Dear Leader
If he changed the password. Others would have not been able to log in. And I double check the group conversation history, the first time some one asked for a relink was on October 24th, but later the admin replied that he could not relink it because 29060163 was already invalid, this one was with payment screenshots. So, from the conversation history, We didn't help re-link the account. I will ask more help from our admin first. Thank you.

Best Regards
Betty

[Betty]

Dear Leader
And our admin double checked the operation log. He told me that we never switch this account out to another Google/Apple ID. The account was just lost the link after migration which was fixed a couple days ago with the help of another support. So no one stole or hacked his account. And since we never helped him relink the account. We think that this claim is pretty suspicous. He could further contact our in-game support if he needs further help or compensation. Thank you.

Best Regards
Betty

[[BG]Archon]

Dear betty,
He did change the password - but only after the hacker already got in and it appears he saved some screenshots when he was inside the account.
The account was never lost! the original owner could still access it on s1 until YOUR support took it from him! Right now the guy who plays the account is the hacker who used YOU to deny access from the original owner!

Of course this claim is suspicious, YOU TOOK THE ACCOUNT AWAY FROM THE OWNER! Please read again my original post at the top, go over my msg history in the forums (going back 3.5 years ago) - Talk with Elena from the facebook feedback group - she knows me.

I'll let the original owner send his older transactions using the ingame support ticket he has open and update here. I again want to emphasize that it was your support that took his account away based on some screenshots from the hacker even though he told you his account is hacked on October 16th.

I'll write here the status, after he gets access to his account again I expect you to help him get his account back to s34 (before the hacker migrated) and send him one hell of a compensation.

[Betty]

Dear Leader
No one took his account. There's no re-link operation history for the account. And the account was back active again on 29th. Thanks.

Best Regards
Betty

[[BG]Archon]

The account is active alright - just not by the original owner, despite him changing his apple ID password. He told me that when he tries to login to his account he sees a lvl8 account and not his original one.

He bombarded ingame support yesterday with transactions IDs in order for them to assign his HC account to a fresh new apple ID he opened, I'm waiting for them to do it so he'll finally be able to play his account.

I'll keep you updated, after he gets his account we can discuss how to get him back to his server (34).

[[BG]Archon]

Update:
Tina from support told us yesterday that the hacker is trying to contact you using player ID 2687130. He is asking you to switch the original account to 2907307 - THIS IS THE HACKER, BAN HIS ASS.
I'm guessing he is sending you some screenshots he saved while he had access to Creeper's apple ID (he doesn't have it anymore, Creeper changed password).

Tina asked for some more transaction IDs and Creeper gave it to her - he can supply all of them ever since the account was created. Still waiting for him to gain access to his account.

[Betty]

Dear Leader
As I have said before, purchase history is needed for us to re-link the account. And our admins have already notice this account that we will take tighter measures. And as the account was not re-linked that the account owner should still have the access to it. And since our in-game support already reply your ticket in a moderate time that I don't think we should deal with it here because personal information is involved to re-link such accounts. Thanks.

Best Regards
Betty

[[BG]Archon]

Hi betty,
Good news - yesterday Creeper got his account back and he can play it, unfortunately - the hacker migrated it from s34 down to s25 and then s1 using Creeper's credit card that was in his Apple ID.

Creeper filed a claim with Apple and his credit card company for identity theft, my question is - what we can do to help him get back from s1 to s34 without paying $400? All his friends are here and right now he's playing alone on s1.

I'm sure that if you help him he will show his appreciation in the long run, he spent over $10000 in the last year and is happy to spend on a game he enjoys.

Thanks for all your help, I appreciate it.