Criminals are using stolen credit cards to buy Fortnite “V-bucks” then sell it “in-bulk” on the dark net to wash the proceeds- and the company doesn’t seem to be doing much about it, say cybersecurity experts cited in The Independent.
According to Benjamin Preminger, a senior intelligence analyst at Sixgill:
“Criminals are executing carding fraud and getting money in and out of the Fortnite system with relative impunity…Threat actors are scoffing at Epic Games’ weak security measures, saying that the company doesn’t seem to care about players defrauding the system and purchasing discounted V-bucks… This directly touches on the ability of threat actors to launder money through the game.”
Sixgill and The Independent conducted a collaborative investigation into the criminal use of Fortnite V-bucks.
Fortnite, a widely available and free Hunger Games-style video game, is one of the most popular in the world.
Over 200 million children, teens, and adults play the game across the globe, and Fornite reportedly earned its creators, Epic Games, over $3 billion dollars in revenues in 2018.
Players can purchase the digitally generated V-bucks or earn them by successfully completing missions, and those V-bucks can then be used to purchase digital costumes, weapons and other items used to build shelters in the game and fend off attacks by other players and zombies characters.
While the extent of V-buck black markets is difficult to estimate, Sixgill and The Independent found that mentions of Fortnite on the Dark Web have risen to coincide with the game’s success.
They found that over $250 000 in Fortnite items were transacted on eBay last year in a 60-day period.
Black markets for “bulk” V-bucks were also found being negotiated in Chinese, Russian, Spanish, Arabic, and English on the Dark Web, “a hidden section of the internet only accessible using specialized software.”
The researchers also found smaller amounts of V-bucks being sold on the open web via ads on Twitter and Instagram.
According to The Independent:
“Separate research by IT security firm Zerofox found 53,000 different instances of online scams relating to Fortnite between early September and early October. An estimated 86 percent of the scam incidents were shared via social media platforms like Facebook, Instagram, and Twitter.”
Epic Games reportedly did not respond to The Independent’s request for comment.
Part of the company’s alleged indifference may result from the fact that both the digital V-buck and the digital “goods” purchased with it can be created at a very low cost to Epic Games.
While digital-world losses may never be precipitous enough to motivate a huge security push at Epic Games, Sixgill’s Preminger still believes there is much the company could do to reduce these crimes:
“While completely stopping such criminal activity is extremely difficult, several steps could be taken to mitigate the phenomenon, including monitoring the transfer of high-value goods in the game, identifying players with large stockpiles of V-bucks, and sharing data with relevant law enforcement agencies.”