Account locked because of suspicious gifting?

[Booster Terrik]

Hi Guys,

I just got an email in which CIG told me my account was locked due to suspicious gifting behaviour. 

Quote

Greetings,

Your account has been temporarily locked due to suspicious activity involving some of the gifts that have been received by this account.

During the investigation, your account will remain inactive.

Thank you for your cooperation.

Best Regards

Bellows
Roberts Space Industries

Then they send me an email with the following text and a Ticket hyperlink which of course I cannot follow because my account is locked 🙄

Quote

##- Please type your reply above this line -##

Thank you for contacting the RSI Player Relations!

We've received your request (#xxxxxx) and an agent will get back to you as soon as possible.

While you wait, feel free to check out some of the helpful information on our RSI Knowledge Base :

• Updates and Info
• New Players – Getting Started
• I can’t login – what should I do?

Sincerely,
The RSI Player Relations Team
 

Your Inquiry:

Has anyone experienced this before? Last trade I did was on June 11th when I got a Freelancer MIS from someone.

I doubt CIG is cracking down on the grey market or more people would have come forward already.....

[Basard]

This is certainly interesting. Keep us updated with how things develop.

[Danakar Endeel]

Hmmm, if you bought something on the grey market it might have been a ship from a hacked account that the owner has now marked as stolen and the reason why CIG is now investigating. Or the original owner is a scammer who initially sold it to you and now wants it back by claiming his account was hacked (while keeping your money).

At any rate, if you still have emails or other communications with sellers regarding your grey market purchases best to keep them handy just in case. Especially if it turns out the particular 'suspicious purchase' can be proven that it was a legit sale and the actual owner now tries to scam you. Ofcourse if it was indeed sold from a hacked account then you may have lost your money.

By the way, as far as I know you should still be able to respond to tickets by replying to the email they send to you.

As far as personal experience goes: at one point back in October 2014 there was a guy selling tons of stuff in the ship sale forum here including Aurora Starters with LTI at cost. But after buying one it felt really fishy because he kept offering more and more stuff so me and other people from Imperium who also bought stuff started talking about it and we decided to contact CIG just in case. CS (Julie) was very helpful and did indeed find out that those ships came from accounts that were hacked and told us that unfortunately they had to remove the ships and return them to their original owners. That was before the 2-factor authentication thingy. Luckily at the time PayPal was still very supporting regarding refunds for stolen virtual goods and worked together with CIG on this. As a result I was able to get my money back.

Please keep us informed! I don't deal on the grey market at all anymore but it's always good to know if a particular individual on the grey market is up to no good.

 

[Booster Terrik]

I bought the Freelancer on Marktplaats (the dutch Ebay site) and I have the guys name and bank account number plus a whole conversation on Marktplaats messages so I can prove I was acting in good faith. We'll see what CIG says I guess 😅 I'll keep you guys informed !

[Chimaera]

@Booster Terrik there's been a recent rash of scams. Either there's been successful phishing attacks, or people have decided to try to sell off stuff, then claim their account is hacked, and you're out the money. It's a rough thing to deal with, especially given how unfriendly paypal is toward e-purchases. Have to be very cautious when dealing with people...as do "stores" when they middleman for people.

[Switch]

I actually received this about two months ago, I sent in a concierge ticket asking what I can do to assist them and didn't get a reply, as well my account was never actually locked. Pretty sure its scam. Can always send in a ticket to CIG to be safe.

[Chimaera]

@Switch that's actually a common phishing tactic, but I think Booster's account was ACTUALLY locked (as in he couldn't get into it). 

[Rain2reign]

I would first make sure if the email you received is legitimate.

1. Make sure the corresponding email is from Cloud Imperium Games ie. <no-reply@cloudimperiumgames.com>.
2. Login on RSI and see if your account is actually locked. In the event that it isn't report it to CIG.

 

[Booster Terrik]

2 hours ago, Rain2reign said:

I would first make sure if the email you received is legitimate.

1. Make sure the corresponding email is from Cloud Imperium Games ie. <no-reply@cloudimperiumgames.com>.
2. Login on RSI and see if your account is actually locked. In the event that it isn't report it to CIG.

 

Yeah those are the 1st things I checked and both answers are yes 😥 I replied to their email to see what was going on but they haven't answered yet.

[Sleezy]

On 8/21/2018 at 11:13 AM, Booster Terrik said:

Hi Guys,

I just got an email in which CIG told me my account was locked due to suspicious gifting behaviour. 

Then they send me an email with the following text and a Ticket hyperlink which of course I cannot follow because my account is locked 🙄

Has anyone experienced this before? Last trade I did was on June 11th when I got a Freelancer MIS from someone.

I doubt CIG is cracking down on the grey market or more people would have come forward already.....

Same here,  locked out last night, received exact same message. I was able to log in and reply to the ticket and explained that i bought the gifts via grey market and listed site, but then this morning was unable to log in anymore.

[Chimaera]

Did you log in via the website or did you follow a link from an email?

[Sleezy]

Clicked the ticket number hyper link immediately after receiving the email. My reply showed my spectrum and profile pic and was on support site not main rsi page.  Went to bed and this morning tried following link again to see if it had been updated but could no longer access account.  Tried to log in to game and RSI website to no avail. So I sent a reply to the email from Bellows from support team with same info and requesting time frame for investigation.

[Drum]

Rule of thumb where money is involved and emails arrive is to ignore the email and log onto the site where the money is and see what is going on.
If there IS something going on you will get flagged with the appropriate messages.
If there IS NOT anything going on – someone tried to gather your password using a phishing email.

Best to then let the account know of the phishing attempt and change password (if you think you have been compromised), the usual nervous nelly stuff.
I am always getting Important Alerts from banks I do not belong to, so even when they do guess the right bank now and again, I ignore the message and go to check the account.

Stay alert. - DRUM out

[Chimaera]

Never click hyperlinks in email. You may have been phished.

 

[Sleezy]

I didn't log in.  The link took me to support page and auto logged me in.

 Email came from support@cloudimperiumgames.com

[Rain2reign]

@Sleezy

It can be that the hyperlink itself was disguised. Meaning even if the email and supposed hyperlink match, the phishing is already done/embedded in what you might call the true link. There are a few easy ways to track that. One of them is to hover over the link (don't click the link!!) and you will see the TRUE link. Another one method is to view the real page/mail source. In example in MS Outlook web interface right-click the email and click view page source/info. Scroll around and maybe use the search function to find the email or hyperlinks and whatnot. I used to receive like a 100 Blizzard WoW related phishing attempts a few years back, even though i never activated WoW on my Blizzard account. Tracked down the true link and emails, reported it and never received them again.

The fact that you were auto-logged in after just clicking the link is already suspicious. Anno nu, or in English, nowadays it's already a sign that somethings wrong. Any company (CIG incl.) that do make use of this has either very low standards or never really cared. It's easy to setup a proper login page with permissions... I highly recommend to visit this support page https://support.robertsspaceindustries.com/hc/en-us/articles/115013171387-My-account-was-hacked- , give it a good read so you know what kind of questions you might expect and what kind of info you can give them straightaway. Afterwards press "Submit a request button" at the top of the page if you cannot sign-in to your RSI account and contact support.

Oh and ... :

1. Password - Change your password immediately!
2. 2FA - activate 2FA on your account if you haven't already. Even if people manage to get your account, they would still need the codes. Of course if someone really wants you they will find a way, but 90% of this kind of attempts is just "Oh 2FA? lets move on to the next..." and not worth the extra effort. If you already did? Then reset your 2FA recovery codes, better safe than sorry as your account might've already been compromised.

[Sleezy]

I appreciate everyone's posts and helpfulness. I am pretty sure that it was legit.

#1 I have 2 step authentication. So I would have gotten notice if someone tried logging in.

 

#2 if I hit account recovery option it sends me email with my user name, so my user name and email are still associated to an account.  However if I hit reset password it says account doesnt exist or has not been activated. Seems like they really do have it temporarily deactivated. 

#3 This is the link address to the hyperlink. https://support.robertsspaceindustries.com/hc/requests/xXxX

XXxX is actual ticket number not x's

[Booster Terrik]

can you PM me who you bought ships from in the past year? It could be that one of them also dealt with me which might tell us the source of our problems ...

[Booster Terrik]

Looks like the problems are indeed with my june 11th gift via marktplaats. They are investigating 2 stolen accounts from which items were gifted. Kinda stupid of a thief to use his regular bank account for receiving money for stolen account items though and then selling them on a sellers account with a 6 year selling history😕 I have the guys real name, his bank account number and I know in which city he lives (which is only 30km away 😈). In that city there is only 1 person with that name, if he is a criminal he's not the smartest one 😉

I could post the RSI handles of the accounts that he sold me ships from here but I am not sure if that is allowed or wise?

[Bench70]

Booster Terrik just yesterday i receive same mail as you from bellows and first i was thinking eas a spam but then i had my account locked

1 minute ago, Bench70 said:

Booster Terrik just yesterday i receive same mail as you from bellows and first i was thinking eas a spam but then i had my account locked

I sent many mail to help support but till now i only know they want investigate about some ship someone gift me.( i buy on ebay)

[Sleezy]

@Bench70 They will get back to u. I received a response this morning from Bellows. It only took a couple days for response but said that investigation takes a few weeks and would contact me with outcome including something to show PayPal to help in refunding process.

[Bench70]

46 minutes ago, Sleezy said:

@Bench70 They will get back to u. I received a response this morning from Bellows. It only took a couple days for response but said that investigation takes a few weeks and would contact me with outcome including something to show PayPal to help in refunding process.

Thanks. I receive same message. But now i cannot reach my account for probably some weeks. He say there is a problem with two or three gift ship but refuse to tell me what happened abd who. I am Space Marshal concierge level spent over 7000 eur with about 30 ship ( many of them buy on ebay to have only lti ship) and i cannot use my account because someone scum me. It s like if police has suspicius with you about something that you don t know and first of all put you in jail limiting your liberty because it say want to check something. Sorry for my english, i hope could understand ehat i want say. It s really frustating. I have to trust in CGI but they not.

[Bench70]

4 minutes ago, Bench70 said:

Thanks. I receive same message. But now i cannot reach my account for probably some weeks. He say there is a problem with two or three gift ship but refuse to tell me what happened abd who. I am Space Marshal concierge level spent over 7000 eur with about 30 ship ( many of them buy on ebay to have only lti ship) and i cannot use my account because someone scum me. It s like if police has suspicius with you about something that you don t know and first of all put you in jail limiting your liberty because it say want to check something. Sorry for my english, i hope could understand ehat i want say. It s really frustating. I have to trust in CGI but they not.

I am backer from 2013 and every day for five year i use my account in some ways also only to view my hangar. Mean something for someone. I trust before now i thinking a refund

[Chimaera]

@Bench70 I wouldn’t take it so personally. The risk of grey market and ebay is that someone is dishonest and scams you. That is not the fault of CIG, and by doing their investigating, they are trying to make sure that the people who do the scamming are punished. Try to be patient, and next time around, maybe aim for very trustworthy sellers on sites that do checks/moderate/proactively kick scammers.  We got rid of four accounts in the last few days because of suspicious/scam activity, but there is very little we can do beyond ask sellers to provide some proof of ownership of account and paypal status. Even with that, people still will scam. It sucks, but it isn’t because of CIG.

[Bench70]

7 minutes ago, Chimaera said:

@Bench70 I wouldn’t take it so personally. The risk of grey market and ebay is that someone is dishonest and scams you. That is not the fault of CIG, and by doing their investigating, they are trying to make sure that the people who do the scamming are punished. Try to be patient, and next time around, maybe aim for very trustworthy sellers on sites that do checks/moderate/proactively kick scammers.  We got rid of four accounts in the last few days because of suspicious/scam activity, but there is very little we can do beyond ask sellers to provide some proof of ownership of account and paypal status. Even with that, people still will scam. It sucks, but it isn’t because of CIG.

Thanks for kindly reply but when it speaks about money is every time personal.  I am afraid because there is something wrong. I was scum with maybe 3 "gifted" ship. Why lock all the account and limit my freedom instead just if it s legally possible, just hide that 3 ship till everything is finished?