In regards to the issue with the rash of account "hacking" that took place two weeks ago, we thought it prudent to post some information regarding the incident.
The scam was done by creating a web page, identical to the login page on the forums. The scammer then distributed the link via in-game channels. Even though the site was obviously not a Funcom link it looked sufficiently similar to a Funcom page to trick people into entering their username and password. To clear up any future confusion on this issue we have now stopped the use of AO username and password on the AO forums. Even though the old system was secure we felt that it caused confusion that allowed the scammer to get player's passwords, this is no longer the case.
The site has now been taken down and the perpetrators have been banned from the game. We are also returning accounts to players who had them stolen. All that is needed is the CD key that you set up the account with, or the first 4 and last 4 digits of the credit card currently paying for the account. If you email support with this information, you can have your account returned to you, usually within 24 hours.
It is important to point out that this was not a breach of Funcom's server security. It was simply a scam to get people to voluntarily give up their info. If players had noticed the URL of the forum page they would have seen that it didn't even go to our website. No credit card information was compromised because of a security hack.
Likewise, it is highly unlikely that any credit card numbers were compromised because our account system does not even show the user his full credit card number, at any time. Essentially, only items and credits were at jeopardy.
Unfortunately we cannot reimburse the items or credits because of policy. Reiterating the reasoning for this policy seems to be appropriate. The logs cannot only track the trading of items and credits, between players, and cannot log intent. Without the policy it would be just as easy for players to try and exploit the system by trading stuff to a dummy account and then claiming they were hacked, essentially doubling up on their items and credits. Because of this we have the blanket policy in place that to prevent exploiters from using us to dupe items for them.
We can, however, attempt to track down deleted items, which are mostly just NO DROPS. The hitch here is that the logs do not go back more than a few days so there is a high probability that by the time you have regained your account, it is too late to restore them.
Some players have incorrectly surmised that Funcom is somehow responsible for the loss of the items or has an obligation to reimburse them, site the example of how credit card companies reimburse monies stolen via credit card theft. This is an inaccurate analogy that simply does not apply. It is apples and oranges, in fact.
A more appropriate analogy would be if you walked into a bank and someone claiming to be an employee asked you for your safety deposit key and you gave it to him. Then he proceeds to steal everything from the box. The bank is not responsible for you carelessly giving your key away simply because the person said he was an employee. It is an unfortunate situation but one of your own creation.
I hope this clears things up a bit. The incident was indeed an unfortunate one and we do sympathize with players who were misled and ultimately hurt by the actions of a given few. With the new forum password system in place there should be no more instances of this type of scam arising, and all players should be able to regain control of the lost accounts by emailing us.
Thank you for your understanding and remember, never give out your password to anyone.
