Online gamers targeted by email scammers

Dan Hunter recognised a familiar scam when he got an email stating that his account in the game Eve Online had been suspended due to "unusual activity" and that he needed to click on the enclosed link to enter his login data to regain access.

Hunter, an assistant professor of legal studies and business ethics at the Wharton School of Business, knew that this type of hoax, a phishing scam, was usually used to get access to PayPal or online bank accounts. But this was a new one to him: phishers targeting an online gamer's login data.

"The mechanics of this phishing attempt are no more sophisticated than usual," Hunter wrote on Terra Nova, a blog about the economies of virtual worlds that he co-edits, "but I'm struck by the fact that the scammers are now phishing for login details for virtual worlds."

Some online gamers say that scammers have for years been trying to get them to give up their login information so they can leapfrog into higher levels of games without putting in the hard work it usually takes. The attacks, in many cases, came more from game laziness than greed. Annoying? Yes. Something the government should be looking into? Probably not.

But Hunter worries there's more to it this time around. The biggest reason: there's a growing awareness in the game community that the weapons, characters, currencies and other virtual goods in online games can be traded for real-world cash.

"It's more evidence of the value of these virtual assets," Hunter told CNET.co.uk's sister site News.com. "As soon as you have assets that are valuable, that are electronically tradable, then you have the opportunity for really massive fraud because it's worth the scammers' time to try to extract those assets."

Here's how the virtual-to-real-world exchange works: players can buy and sell goods such as battle axes and gold coins in exchange for hard cash on secondary market services like eBay or IGE. Once a buyer and seller have struck a deal and transferred the payment, often via a service like PayPal, they have to meet up in-world to actually exchange the item.

Though no one knows exactly how much the trade in virtual goods is worth, estimates range from $200m to $880m a year, much of it conducted on sites like eBay and IGE. Those involved in the business of online games expect such figures to grow as games like World of Warcraft and Everquest II become more and more popular.

"What you have is this strange grey area where these incredibly valuable assets are available," Hunter said, "and the scammers want to get hold of them because they can turn them into money."

While Hunter is concerned that phishing could become a serious problem for online games and could necessitate government regulation, he did not know of any law-enforcement actions thus far.

Magnus Bergsson, chief marketing officer for CCP Games, the publisher of Eve Online, said he began to notice the increase in phishing attempts about two months ago. He, too, believes scammers are looking for a way to cash in on the virtual markets.

"This is one of the really bad things about in-game items and money trading," he said. "When it echoes outside of the game and turns into real money, bad things happen."

Indeed, many game companies and their players publicly decry trafficking of virtual goods because, they argue, it waters down the games and causes the companies customer service headaches when players complain they've been cheated.

But Sony Online Entertainment recently overcame its longstanding resistance to trading real cash for virtual assets by creating its own marketplace. Sony rationalised the move by saying it could control fraud in its own auction system.

In any case, Hunter predicts that if virtual-world phishing becomes a serious problem and enough valuable goods are stolen, game publishers -- normally squeamish about bringing in the cops -- will have little choice but to turn to the authorities for help.

"The game developers are really conflicted about what they should do about this," Hunter said. "They can try to track it down. But there's going to be a real disconnect between their desire to have it stopped and their desire not to have it regulated."

Truth is, gamemakers don't enforce the rules beyond their virtual domains. They acknowledge that game communities may have to get past their libertarian attitude toward real-world government and ask for law enforcement help in cracking down on the problem.

"If this becomes serious enough," Bergsson said, "we will probably be forced to do something like that."