Indie Dev TinyBuild Lost $450K To Fraudulent Sales Facilitated By G2A (pastemagazine.com) 104
An anonymous reader quotes a report from Paste Magazine: Indie developer TinyBuild, the studio behind Punch Club, Party Hard and SpeedRunners, had thousands of their game codes stolen through fraudulent credit card purchases, which then wound up on G2A.com, a site that allows people to resell game codes. The basic idea behind G2A is straightforward and pretty harmless: with the amount of game codes sold through Steam, the Humble Store/Bundle, and more, the site gives consumers a place to sell unwanted game codes. However, in doing so, G2A has created a huge black market for game codes sales. As TinyBuild described in their blog post on the matter, the common practice for scammers is to "get ahold of a database of stolen credit cards on the dark web. Go to a bundle/3rd party key reseller and buy a ton of game keys. Put them up onto G2A and sell them at half the retail price." This allows scammers to make thousands of dollars while preventing any profit from reaching the game developers because, once the stolen credit cards are processed, the payments will be denied. G2A states that TinyBuild's retail partners are the ones selling the codes on G2A, not scammers, despite the thousands of codes they lost through their online store to fraudulent credit card purchases. In 2011, TinyBuild was in the news for uploading their own game, a platformer called No Time To Explain, to the Pirate Bay.
Re:Serves them right (Score:4, Informative)
There are *tons* of companies that get ripped off by this exact same thing (I work for one of them). The transaction goes through, and then *after* the person the card is stolen from finds out hours or maybe days later, a chargeback is issued and the steam keys are already long gone. You could try to put a 3 day waiting time or something on redeeming your keys but that is obviously incredibly user hostile and nobody would put up with it.
Re: (Score:2)
a chargeback is issued and the steam keys are already long gone.
Have you ever done a chargeback? You want user hostile try doing that. First the bank will intimidate you and tell you there's a "service fee" of $25 or $50 or whatever for even TRYING to charge back, THEN they say they will "investigate" and MAYBE the charge will be reversed next week sometime. Then finally if the planets are aligned correctly and the bank really feels like it - they MIGHT approve the charge-back.
Seriously if this is such a major issue and not a flaw with this particular company's s
Re:Serves them right (Score:5, Informative)
I don't know about that. I got a nice email from my bank that someone had made a suspicious charge at a grocery store not too far from where I live. It said not to worry about it, and that they were investigating. I called the number on my card, and their security team did confirm they sent the email. They asked me to confirm a few charges I recently made as valid or not valid. A few weeks later, I got a letter in the mail that said they completed their investigation, and the entire charge was now void. I would not be responsible for it.
So...maybe your bank just sucks ass.
Re: (Score:2)
Re: (Score:2)
Same. I once transferred a few hundred bucks to an account abroad only to get a call just minutes after placing it whether this was really me and whether I really wanted this to happen.
With all the flaws my bank has, this really impressed me.
Re: (Score:2)
Have you ever done a chargeback? You want user hostile try doing that. First the bank will intimidate you and tell you there's a "service fee" of $25 or $50 or whatever for even TRYING to charge back, THEN they say they will "investigate" and MAYBE the charge will be reversed next week sometime.
I've done chargebacks numerous times, and haven't had this once happen to me. Who is your bank? They obviously suck and I'll make sure I never do business with them.
Anyways this is credit card theft rather than a simple chargeback. In the case of fraudulent transactions, by law the bank can only hold you liable for up to $50 in fraudulent charges. And basically every bank that doesn't suck has a zero liability policy, meaning that anything somebody put on your card without your permission doesn't cost you a
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Really? Every once in awhile I'll notice a fraudulent charge on one of my credit cards, I phone the number on the card, challenge it, and then they either void it fairly soon afterwards, or, (only happened to me once), they send me a form to sign basically saying that I verify that I didn't make the charge, and then they void it. I get hassled more trying to return a mostly full container of cream that had gone bad before it's due date at the local grocery store (with a receipt).
Re: (Score:2)
Re: (Score:1)
No for me. Charge backs are easy as can be.
Well's Fargo calls me. Hey we detected fraudulance on your card. Are these your expenses. They have called about 10 times. 2 times, I my card was pwned. Both times, they handled it all in seconds with no issues.
One time, I called Well's fargo, they didn't call me. Same deal. They canceled my current number, credited the charge and had me a new number all in a three minute phone call. Easy as can be.
Re: (Score:3)
I worked for a company that had similar scam problems. These scammers are able to pull off these scams at absolutely massive scale and they've been doing it for years against everyone and anyone. They find any little rinky dink offer and exploit the living crap out of it. They have so much talent that you wonder why they don't conduct actual legitimate business.
Re: (Score:2)
They have so much talent that you wonder why they don't conduct actual legitimate business.
Because endless growth isn't, and the low-hanging real opportunities are already exploited by incumbents who will wield the legal system against new entrants into the market. If you go criminal, you don't have to deal with all the regulations that real businesses have to observe and you keep a lot more of what you earn.
Re: (Score:2)
Why not have face to face stores then? It is much harder to steal from someone when you are looking them in the eye.
Re: (Score:2)
No it's not. If you are amoral (or better yet sociopath tendencies) - it is just as easy to steal from someone while looking at them.
Sure in this case, it creates overhead of having to have a physical card to program the stolen info on - but this is completely unrelated to your claim that the "personal touch" will stop thieves.
But congratulations, at least you have a conscience (just remember not everyone does).
Re: Serves them right (Score:2)
Re: (Score:2)
You have no clue how any of this works do you?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If your a business operating as a going concern then no the bank has little to lose, when a chargeback occurs it just get taken out of your current payments with an explanation and a service fee. A while back we had a rash of refunds and chargeback so the credit provider sent a representative out to have a chat with us, we explained that a consultant instituted some business practices had caused problems with buyers remorse and clients not fully comprehending what they were agreeing to. We fired the consult
You can't do that either (Score:2)
What worries me is the possibility that G2A is making most of their sales off this. I honestly don't know, and I'm not sure how you could prove it. These key reseller sites always struck me as a little dodgy th
Stolen? (Score:3)
Wait... stolen or purchased illegally?
There's a difference, isn't there?
Re:Stolen? (Score:5, Informative)
Re: (Score:2)
* Scammers get stolen credit card data.
* Scammers buy lots of CDkeys from tinybuild.
* Scammers put keys up on G2A.
* Legit cardholders chargeback unauthorized purchase
* tinybuild out money and a cd key.
Re:Stolen? (Score:5, Informative)
* tinybuild out money and a cd key.
Well apart from fees and administration they're just back to zero. The more interesting part is what follows:
* tinybuild are too dumb to link chargebacks to game keys
* tinybuild doesn't deactivate any keys
* G2A customers happy, G2A happy, tinybuild unhappy
Instead of:
* tinybuild links transaction id and game key on sale
* tinybuild invalidates game keys with chargeback
* G2A customers go mental
* tinybuild says too bad, take it up with seller
* G2A customers chargeback their purchase
* G2A ends up in trouble
They're complaining because they're too dumb to solve their own problem, particularly if this happens on a mass scale.
Re: Stolen? (Score:2, Informative)
Exactly, this. Tinybuild keys are between the original purchaser and Tinybuild. If the purchase is charged back, Tinybuild should immediately revoke the key that went with that purchase. Nobody should give a crap about the middleman reseller and the secondhand buyers -- this had nothing to do with them.
Re: (Score:2)
> , Tinybuild should immediately revoke the key that went with that purchase.
Companies have tried this before and customers went postal. Since they paid money for those keys, how dare they deactivate them.
Re: (Score:2)
Re: (Score:1)
tinybuild says too bad, take it up with seller
And a large percentage of buyers still hold it against tinybuild. Of the people I've seen that had keys invalidated for one reason or another (and know offline, so not just some kid bitching in a forum), the vast majority hold it against the publisher that invalidated the key. This is regardless of who much it is not the publisher's fault, including people who were blatantly cheating on a server that gave them warnings before banning them to even people who used a keygen and didn't actually lose any money
Re: (Score:2)
Can Steam even do that? I know that they can revoke games purchased within the Steam ecosystem, but I've never heard anything about revoking a copy that comes via a key.
Since Valve isn't involved with how that key is sold, I could certainly see them not allowing vendors to revoke games. The last thing Valve wants is customers bitching to them about losing access to a game, and of course Valve can't do a thing since they aren't the original seller and can't refu
Re: (Score:3)
Re: (Score:3)
They absolutely can. In late 2011, one of the graphics card manufacturers did a promotion where they bundled Steam keys for Dirt 3 (which was a $60 game at the time) with their cards. The exact delivery system involved something like entering a code from a piece of paper inside the card box into a thing on the manufacturer's site, which would then spit out a Steam key.
Somewhere along the line, someone figured out that you could access a directory on the manufacturer's website that had a single .txt file wit
Re: (Score:2)
Interestingly, this requires DRM (dialling home to validate keys periodically). So if the company does the "good" thing and releases their game without DRM, they are set up for exactly this kind of rip off.
buyer hostile (Score:2)
1) ream the end buyer and get it hostile to BOTH G2A and tinybuild because let us get real end buyer would also be unhappy with the developer
2) do what they did and eat the loss knowing this would be better PR rather than remove keys.
Frankly in their position I would do the same, and make sure the PR is out that they did not remove the keys from the end user.... Which is exactly what they did since we are getting them on slashdot and other outfit. Tha
Re: (Score:2)
They aren't dumb, they spun this situation into some great and almost free publicity. As you point out, the "lost" codes actually cost them almost nothing since it's likely just an automated back-end and key generation server. If they revoked all those codes it would create additional cost (admin, the need to create a key revocation system) and misdirected rage towards them.
This way they get some nearly free publicity for their games, much like they did when they uploaded a previous title to The Pirate Bay.
Re: (Score:2)
As you point out, the "lost" codes actually cost them almost nothing since it's likely just an automated back-end and key generation server.
There's some cost because some percentage of the customers that bought keys through G2A would have been willing to pay the higher cost on Steam if there weren't keys being dumped at artificially lower prices financed by credit card fraud. That number is probably not the full $450k, because some number of those customers don't value the game at the full retail price, but it's probably nowhere near $0 either.
Re: (Score:2)
It's probably worth noting that G2A shouldn't be treated as some kind of saint, the organisation is in itself as dodgy as they come. They engage in all sorts of illegal practices such as advertising instant delivery on purchase of game keys and then demanding you hand over your phone number, or e-mail them a scan of your passport inevitably resulting in deliver of your key being far from instant.
Furthermore, in the past they've been outed as one of the biggest abusers of paid reviews to give their company a
Re: (Score:2)
Except that isn't what happens. Companies have tried this before and all this does is get those customers pissed at the developer, instead of their shady sellers.
Re: (Score:2)
> They're complaining because they're too dumb to solve their own problem, particularly if this happens on a mass scale.
You really have no clue what you're talking about do you? Companies have tried this before and people go postal. Instead of going "Well I should stop buying from G2A" they'll go "Well fuck you tinybuild"
No time to Explain is fantastic (Score:2)
Game Dev here. (Score:3, Interesting)
As a mid-tier indie Game Dev, with two titles on Steam, the key system is something I've never quite understood.
It is a hold-over from box copy days. The box industry is still around in the third world, but outside of those few select counties why do keys still exist?
My publisher hands out about five figures worth of keys to about 6 different legit places. After a year, hundreds of "retailers" have my game, all selling them for under Steam price. (Well under discount margin too.)
Leaving out the credit card scamming. Someone can just purchase keys in Yuan or Bhat's or Rupiahs for 40-50% (Or more if the game is discounted) and resell them for 25% less than the steam price. Luckily they closed off Russian keys from being used by anyone but Russians.
On top of this, Steam makes no money on keys. Zero. It's just a distro lock for them.
The key system needs to be done away with. Replace it with an API that legit and official stores can use to grant users copies of games. Extend this API into the client for "gifting." If steam wants, charge a tiny fee for each API transaction from a vendor. More money in their pockets and the system doesn't really change. Allow ownership of multiple copies of a title and allow you to transfer these to other users (But you must always keep 1 copy.) This will allow bundles to still function as they did. If they just did that, it would close up the key black market and make everyone more money. (Except the folks buying on these black markets of course.)
But knowing Steam. This won't ever happen. Hell I can't even send out an update without having 50-100 people having corrupt files issues which file verification doesn't fix. I hate telling people to uninstall my product (and reinstalling) to fix their problems.
Re:Game Dev here. (Score:4, Informative)
Humble Bundle used to require you to sign into your Steam account and they would add the game directly to your account instead of giving you a key. It was originally keys, then the linking system, and then back to keys.
I'm guessing that Valve disabled that API because they don't want to make the process of buying games outside of Steam as seamless as their own store.
Re: (Score:3)
http://blog.humblebundle.com/p... [humblebundle.com]
Re: (Score:2, Insightful)
"Someone can just purchase keys in Yuan or Bhat's or Rupiahs for 40-50% (Or more if the game is discounted) and resell them for 25% less than the steam price."
Oh noes! Someone bought the game for a price you were willing to sell it for, and then sold it on.
Why is it when companies/corporation take advantage of globalisation it's good. But when consumers take advantage via parallel imports, it's bad?
Besides, steam has a region system (it's not just Russia) for preventing this if you really wanted to.
Re: (Score:3)
Luckily they closed off Russian keys from being used by anyone but Russians.
And that's why, as a Russian, I need keys to exist. After the ruble crash happened, Valve decided to region-lock activation of gifts from Russian accounts. And I have many friends outside the geofence.
As a result, I have to use sources outside Steam to gift games to those friends (Humble, GMG, direct sales).
Re: (Score:2)
Extend this API into the client for "gifting."
No thanks. This is why players want codes, they want something physical that they can re-sell, gift and lend without having to rely on the good grace of Valve to allow it. If you want to tie games into a system like that you had better reduce your prices appropriately, because your product is worth much less than a physical copy.
am I missing something legally here? (Score:1)
Since when did "selling stolen property" become legal???
Re: (Score:2)
You're right, of course, that there is criminal activity here and that getting law enforcement involved would in theory be a better idea than just complaining on the internet.
However, for quite some time there's been a level of criminality around the margins of games-reselling - and I'm not talking about piracy here. As others above have pointed out, what is likely going on here with G2A is money-laundering; people are probably making "unprofitable" trades using the service to convert "dirty" (and hard to u
MAFIAA statistics (Score:1)
In other news, the entire entertainment industry has lost more money than the GDP of the nations they sell their products to.
Regular G2A customer (Score:2)
Well, I've been a G2A customer for about a year, using it for Windows 8 licenses, antivirus licenses, Steam games, and a few other things.
Their "how do we do this" stuff always seemed a bit fishy but none of the license keys I bought has ever had any issues. I assumed it was legit or it would have been shutdown by now.
But now I see how G2A is able to stay hands off far enough to say it's not their fault, the same way pawn shops avoid being responsible for stolen goods that they end up reselling. I mean
Invalidate the codes (Score:2)
If the charge is cancelled by the bank, just cancel the validity of the code as well.
The only problem is that they probably didn't design their code system to allow this, but that's their own fault.
It's not rocket science.
*Alleged* G2A involvement (Score:3, Informative)
It should be noted that the dev is assuming that the keys were sold on G2A with no proof. The only claimed proof is purely based on coincidental listing timing, but that could be due to several factors.
Also G2A offered to work with the dev, if they could provide examples of the allegedly stolen keys, and agree to revoke the keys (Which will drop teh devs sales figure). Instead the dev chose to write a blog post accusing G2A of criminal activity (Facilitating the sale of stolen goods).
Instead the problem here is that the dev failed to link keys to transactions, such that they could revoke keys that were subject to charge backs. This is the equivalent of accepting a promise to pay for goods, delivering those goods, and then blaming ebay because those goods were sold on to other people after the original seller fails to follow through on teh original payment.
The only failure here is the devs in providing safeguards against credit card fraud. But they sure do like getting a cheap shot in at 3rd parties that they don't like for other reasons.
Re: (Score:2)
The transactions are successful, it's only later when people check their statements that the charges are flagged as fraudulent and charged back. The customer has 30 days after receiving their statement to dispute a transaction. It could take in the worst case 60-90 days before a merchant gets a chargeback.
The problem here is that CC companies simply do not give any protection against fraud. They have no incentive either, the CC company gets their transaction fees AND a chargeback fee AND issue a $50k/month
Re: (Score:2)
The transactions are successful, it's only later when people check their statements that the charges are flagged as fraudulent and charged back. The customer has 30 days after receiving their statement to dispute a transaction. It could take in the worst case 60-90 days before a merchant gets a chargeback.
The problem here is that CC companies simply do not give any protection against fraud. They have no incentive either, the CC company gets their transaction fees AND a chargeback fee AND issue a $50k/month fine to whoever lost the information (because they aren't PCI compliant) AND get to send in their expensive auditors and higher transaction fees to whoever lost the information (highest level of PCI compliance).
The fine is levied by the card brands and goes to the card brands, not the issuing or acquiring banks. Furthermore, the amount of the fine is based on the size of the organization in question and the level of compliance they are required to have based on the transaction volume of the organization.
Re: (Score:2)
That's what I meant by CC companies. VISA, MC etc. They have no incentive to create systems that would prevent fraud. The fine is 50k for the lowest level. I think the fines go up to 500k/month for higher compliance levels.
Can't keys be revoked? (Score:2)
Sounds like these companies need to implement the game code equivalent of CRLs.
Another hypocritical article (Score:2)
TinyBuild lost nothing since nothing was stolen. At least that is what I am repeatedly by people on here when they try to justify not paying people for their work (movies or music).
So which is it? Either TinyBuild lost money because people are using games they haven't paid for or they haven't lost money because nothing was stolen. You can't have it both ways.