Playing A Game Fez X360

Like everyone else, I've been looking forward to Fez since its first showing, however many centuries ago that was. And although the independent game scene has grown quite a bit around it in the intervening time, it still looks pretty interesting. But, as it currently stands, I won't plan to buy Fez when it comes out -- because I can no longer trust Xbox Live Arcade. Permit me to editorialize.

A few months ago reports started to come out about a rash of Xbox Live account thefts, strangely linked by the accounts being used to buy FIFA and its DLC. A buddy of mine actually got caught by this; fortunately his credit card company noticed something was amiss, and he didn't lose any money from the ordeal, but he did lose access to his Xbox Live (Gold) account for about a month while Microsoft "investigated" the theft. Since he actually played multiplayer games quite frequently, this was no trivial thing for him.

What was most unusual about his experience is that, after the account theft occurred, he had to recover his gamertag to sign in again. And when he did this, the gamertag he recovered was someone else's. There was no information in this new account, that is, it looked like it may have been set-up explicitly as a dummy account. But his own gamertag - which still existed, as we could check its current activity online - had effectively been swapped out with this one.

Fast forward a few months, and I decide to pop in GTA4 on an Xbox at work, to while away some time. And I have to recover my gamertag. It worked, eventually, but when I checked my account status online all of my Microsoft Points were gone -- spent on FIFA DLC. (Fortunately, and since I never bothered with a Gold account, I didn't keep any credit card information on my account; so my losses were limited to Points.) What I found odd about my incident, was that none of my account information was changed: my password was the same, my email address was the same, my security settings were the same. Someone had just logged in to my account, spent its Points balance on multiple copies of the same FIFA DLC packs, and then left, without attempting to get anything more or even cover their tracks.

I changed my password as a precaution, and as it is, I can still use the account just fine. The net effect is that I lost around $25 worth of points that were sitting around, waiting for something like Fez.

What's bothersome about this whole series of events is:

  • They are not isolated. Tons of people have been hit by account thieves with this same MO: just buying a bunch of FIFA stuff. It is technically possible for them to gift these purchases to other accounts, but based on the sheer volume, it seems more like they're just doing it because they can.
  • My buddy's account was not a simple hack. They changed account information that, as far as I know, can't be changed manually on the Xbox Live website. They needed to either enlist a customer support rep (which shouldn't have worked, since they couldn't prove ownership of the account), or have some more direct access to Microsoft's internal information.
  • My account was less than a simple hack. Generally, if you're going to steal someone's account, you need to work around the password; meaning that you need to change it to actually log-in. But my password was unchanged, which either means that they already knew it (and chose not to change it, which is pretty indicative of sloppy script-kiddy methods), or that they were able to access my account without my password.

The nail in the coffin, though, is Microsoft's laissez-faire attitude about the whole situation. Even discounting my personal experiences, just from reading the news around the Internet it should be obvious that this is an Xbox Live problem: if not an actual technical issue on their part, then at least someone specifically targeting them. Yet Microsoft has refused to acknowledge it.

As for their treatment of specific cases, taking my buddy's account offline for a month is not acceptable for a paid, real-time service. And when I emailed Xbox Support about my incident, the reply was that they're "unable to discuss [account theft] over email for security and confidentiality purposes" -- so, they did nothing. And based on my friend's experience, I know that if I were to call Microsoft about this, I would have to supply them with a bunch of Xbox serial numbers (for all the machines I've used the account with), verify my personal information with them (which I don't even want to have listed on my account in the first place), and then wait a month for them to do nothing.

I'm pretty sure this is a whole bunch of bullshit, and Microsoft is just writing off the losses so far as less costly than doing a real investigation. But I digress. Ultimately I just decided to accept the Points loss, rather than go through a bunch of a rigmarole on the phone and lose access to my account for a month. And I certainly don't feel like trusting Xbox Live with any more money.

Hopefully this will come out on Steam, sooner or later. (Yeah, yeah, I know. Don't get me started.)

Progress: Gave Up