Browsers & Accounts · How Accounts Get Stolen · Lesson 5 of 5

Challenge: Jordan's Stolen Game Account

Help a gamer friend whose account was taken with two-step turned on.

"But I had two-step on"

Your friend Jordan calls you, upset. Their game account was taken last night. The thief changed the display name, traded away rare items and sent strange links to Jordan's friends list.

"I don't get it," Jordan says. "I had two-step turned on. I never got a code. Nobody could have guessed my password."

You ask a few questions. Two days ago, someone in a Discord server shared a "free skin generator". Jordan downloaded it on the gaming PC and ran it. A window flashed, then nothing happened. Jordan figured it was broken and deleted it.

Jordan's browser on that PC was signed in to the game site, their email and a few other accounts. Jordan stays signed in everywhere so games and chats open faster.

Where to start

Jordan wants to sit down at the gaming PC right now and change every password. "The faster the better, right?"

Speed does matter. But you remember what you learned about info-stealers. One may still be running on that PC, and anything typed there could be copied too. A brand new password typed on an infected computer can be stolen within minutes.

Jordan's email was also signed in on that PC. The game account's reset links go to that email. Jordan's phone has never had the skin generator on it, and it is signed in to the same email.

A helpful stranger

Jordan posts about the hack in a gaming forum. Within minutes, a user with a shield logo sends a private message.

"I'm a recovery specialist. I have a contact inside the game company. Send $40 in gift cards and your login details and I'll have your account back in an hour. Lots of people have used me. Don't wait, or your items will be gone for good."

Jordan is tempted. The official recovery form on the game's website says a review may take a few days.

Closing it out

Jordan has now secured their email from the phone, put back their own recovery details, reset passwords and signed out all sessions. They also filed the official recovery form and got a reply that the account is under review.

Two things are left. The gaming PC still has whatever the skin generator left behind. Deleting the file did not undo what it did when it ran.

Jordan also asks what to tell the friends who got the strange links from the hacked account.