Fraudulent transactions on the accounts of users of the Xbox Live service spur Microsoft and EA Sports to address the scam

Gamers have been hit by a fresh wave of hacking attacks ? and this time, most worryingly, targeting their accounts on Xbox Live, Microsoft's closed, proprietary and therefore supposedly unhackable online gaming service.

Reports are proliferating of Xbox Live users checking the credit card and bank account statements which they use to pay their Xbox Live subscriptions, and discovering payments which they did not make, generally over a period of months, which were used to buy Microsoft Points (the service's currency which enables users to purchase extra downloadable content, games and in-game objects) which were then cashed in to buy downloadable content from EA Sports ? specifically Ultimate Team Packs for its games FIFA 12, Madden and NBA.

This outbreak of Xbox Live users being scammed has been widely reported as an instance of phishing ? where hackers con people into giving away their account details ? most notably on the front page of the Sun. But anecdotal evidence from games forums makes it clear that these are not simple cases of phishing.

There is no question that phishing scams targeting Xbox Live accounts are rife: their typical modus operandi involves setting up official-looking websites which purport to be giving away free Microsoft Points, but insist on users inputting their details before they do so. But the nature of the scam dictates that people know when they have been phished, and this particular outbreak only came to light when Xbox Live users scrutinised their bank and credit card statements, not when they snapped up free Microsoft Points. So it is clearly a sophisticated and more sinister new form of phishing ? closer to hacking ? in which people's crucial account details have been obtained not from them but from a third party.

It's easy to see why the scammers opted to purchase Ultimate Team Packs from EA Sports using their ill-gotten gains: they present the ideal means of turning virtual money into real money. FIFA Ultimate Team, for example, is a fantasy league-style extension for FIFA 12, in which players seek to build teams made from the world's best players, and player cards are traded more or less like Top Trumps, with real money changing hands. Clearly, EA Sports has no means of tracking such transactions, otherwise it would be easy to identify the scammers. We have asked the company whether it will introduce any such transaction-tracking in the future. Given that the company has actually profited unwittingly from this scam, it clearly has an obligation to embark on a full and frank inquiry into what happened.

There have been allegations on various online gaming forums and blogs which, it must be emphasised, remain completely unproven at this stage, suggesting that Xbox Live user account details may have been obtained from EA Sports' online gaming services, which form an extra layer on top of Xbox Live, since EA Sports charges for some services over and above the Xbox Live subscription. Forum posters have even suggested that Xbox Live's support lines could be one source, with scammers ringing in pretending to be the people they want to scam. But that appears to be the level at which the phishing took place ? one step removed from the people being phished.

Microsoft has issued an official statement, insisting that Xbox Live's security had not been breached (even though there was no credible suggestion that it had). It added: "In this case, a number of Xbox Live members appear to have recently been victim of malicious 'phishing' scams (ie online attempts to acquire personal information such as passwords, user names and credit card details by purporting to be a legitimate company or person). The online safety of Xbox Live members remains of the utmost importance, which is why we consistently take measures to protect Xbox Live against ever-changing threats." It went on to detail a number of ways to guard against phishing, which can be viewed here.

Perhaps ironically, the EA Sports website has a detailed page highlighting how devotees of FIFA Ultimate Team can detect and sidestep phishing attempts. There were also reports in October that gamers were having trouble accessing EA Sports' FIFA 12 servers, although this was thought to be due to technical glitches and bugs in the then newly released game. But it is not beyond the realms of possibility that those problems coincided with a hacking attack.

What can you, Microsoft and EA Sports do?

First, if you have an Xbox Live account, make sure you scrutinise recent statements for the card or bank account which is used to pay your subscription, for any payments for Microsoft Points cashed in as EA Sports downloadable content that you didn't actually make. If you find any irregularities, the number for Microsoft's Xbox Live customer service is 0800 587 1102. Even if you don't find any, changing your password would be a good policy.

It is possible to run an Xbox Live account without giving Microsoft your credit card or bank details ? you can purchase Gold subscriptions and Microsoft Points in shops, which get you cards bearing redeem codes that you can input from your Xbox 360. Microsoft has been criticised in the past for making it too difficult for Xbox Live customers to remove their payment details from the service ? this can only be done with a call to customer service.

Microsoft clearly needs to look at how easy it is for third parties to make fraudulent transactions on its customers' payment accounts, armed only with their Xbox Live login data. And EA Sports needs to take a long, hard look at whether its downloadable content business is putting profit before security ? we wouldn't recommend going anywhere near its Ultimate Team Packs until it has, at the very least, put in place a means of tracking transactions that arise from them. If EA Sports turns out to have been the victim of either large-scale phishing or hacking, it needs to come clean, compensate the unwitting victims and make sure nothing similar happens in the future. Otherwise its website will become the exclusive preserve of criminals.