One of the biggest trends to emerge in video games is the shift from games as standalone products to games as services. Free-to-play games like Epic Games' Fortnite: Battle Royale allow millions of gamers to instantly jump into the game, while providing a massive in-game marketplace for buying cosmetic items, all while delivering regular content updates via a loose subscription-based model for premium Battle Passes.
While Epic Games certainly wasn't the first video game developer to adopt this business model, Fortnite has become the golden goose they hoped it would be, having helped the company reportedly gross $3 billion in profits in 2018, according to TechCrunch.
But as is usually the case, the creation of such a massive online marketplace has led to some unforeseen consequences, namely the creation of a new avenue for criminals to exploit for the purposes of laundering illicit funds through seemingly legitimate online transactions.
Fortnite is a prime candidate for criminal exploitation — it's massively popular and loaded with exclusive in-game assets that are sought after by gamers.
The exploitation of popular in-game marketplaces is nothing new, and there have been well-documented examples of sophisticated criminal operations over the years that have targeted games including World of Warcraft, Second Life, and Diablo 2 just to name a few. But for the purposes of this article, we're going to focus on Fortnite, a game that has increasingly been targeted by criminals looking to launder money, according to Zac Cohen, General Manager at Trulioo.
Trulioo is a global identity and business verification company that works with consumers and business entities to offer real-time verification to assist with international regulatory compliance and online fraud prevention, and they've been tracking a new trend that's emerged, which Cohen calls "micro-laundering."
"Instead of individuals trying to make lump sum transfers or lump sum money payments, we see these thousands and thousands of tiny transfers that look like something that would happen when you have 100 million players on the same system," said Cohen, adding "a significant and growing percentage of that is criminal activity."
"It's a really fascinating but scary occurrence in the marketplace today."
What does micro-laundering look like?
More often than not, micro-laundering operations are built off of the credit card data that is bought and sold on the black market. The past few years have seen a worrisome number of companies report data breaches concerning customer credit card information, and while those companies are typically tight-lipped when it comes to releasing actual numbers, the number of reported incidents involving stolen credit card hit an all-time high in 2017 according to data from the Identity Theft Resource Center.
To run a successful online micro-laundering operation, first need a massive database of stolen credit card credentials which are bought and sold on the dark web. With those stolen credentials, you create accounts on a massively popular platform with a built-in marketplace filled with digital items and in-app currency with perceived value and spend micro-transactions on items and upgrade that has perceived value within the game community — the rarer the item, the easier it is to offload.
"The people involved [in these operations] are so sophisticated and so tech savvy that the second a normal and inherently good technology comes out, it's basically misappropriated for these nefarious reasons quite fast." — Zac Cohen, GM at Trulioo
Then, it's all a matter of finding gamers willing to spend money on juiced accounts or rare in-game items to make it seem like an otherwise legitimate transaction.
"A super common method is you get stolen credit cards and buy the v-Bucks and try and sell that in the game they'll not only sell those items or currency in game, but they'll also go to other off-market marketplaces places like eBay or something along those lines and try to trade and sell that stuff in what appears to be a very legitimate transaction as well," says Cohen.
To add a further layer of obfuscation to the process, Cohen says it's becoming more popular to then quickly convert the laundered funds into cryptocurrencies, which make the whole transaction that much hard to track from front to back.
The issue is not just relegated to Fortnite or other games with prolific in-game marketplaces and it's not specific to stolen credit cards either — another popular method is to convert cash into high-value gift cards that are then sold to unsuspecting people online.
"For example, let's say someone who had an enormous amount of cash from some type of illicit activity. What they'll also do is load up pre-paid debit and credit cards and even gift cards and launder those proceeds essentially through those games," Cohen explains.
How to avoid getting scammed or used by criminals online
When I reached out to Epic Games on this topic, they referred to their terms of service, which, in part, states "gifting or otherwise transferring of accounts or access keys is prohibited."
That still hasn't seemed to deter people from selling their loaded Fortnite accounts on popular sites such as eBay, Kijiji in Canada, or other sites dedicated to buying and selling in-game assets. Given that barely anyone reads those lengthy legal documents when signing up for an online game, it's fair to say that the majority of people actively selling their Fortnite accounts might be unaware that they are violating Epic Games' terms of service. This, in turn, makes it nearly impossible to tell the difference between a genuine gamer looking to recoup some of the sunk cost of investing in Fortnite season over season versus a ghost account that's been loaded up with stolen money and made to look legitimate.
The hardest part is that it's almost impossible to know how prevalent these types of money laundering schemes actually are, given that everything is occurring in the shadows and designed to be invisible from the public and authorities. Epic Games shouldn't be held responsible for bad actors exploiting their marketplace for illicit means, but it does appear that they remain somewhat lackadaisical in their efforts of going after users and sites that flagrantly violate its own terms and services as long as it isn't directly affecting the company's bottom line.
Keep your credit card information as confidential as possible and avoid being duped into buying in-game assets bought with illegally attained money.
So how can you avoid being caught up in a micro-laundering operation? To start, it's more important than ever to be careful when using your credit card online and to keep track of all the transactions processed on your account. Stolen credit card information can be logged and remain dormant for months or years, bought and sold as part of massive logs of data before it is ever used for illicit purposes. If you ever suspect your information might have been exposed as part of a data breach you must be diligent and be sure to update your security information or get your bank or credit card company to issue new card credentials.
If you're in the market to buy in-game assets or accounts, know that you are violating the terms and conditions put in place by Epic Games which means they could potentially terminate the account if it's discovered to have been used as part of some illegal activity. If you're still inclined to buy some rare skins through a third-party seller website, try to be diligent when vetting the legitimacy of any listings you find and look for signs that they may have been created by an automated script of some sort.
Lastly, if you stumble across a deal on eBay or other popular swap-and-sell sites offering gift cards or in-game currencies where the seller's set price is lower than the market value of the card being offered, that should be a red flag. Remember, if the gift card was purchased using illegal money, it's within the scammer's best interest to complete the transaction as fast as possible even if it seems like they're losing money on the deal.
