In this article:
Have you played Fortnite yet? If you haven't, you probably know someone who has, as the game's popularity has exploded over the past year, attracting celebrities, professional athletes and gamers of all ages. Unfortunately, Fortnite's mass appeal is attracting hackers and scammers, too—and exposing security vulnerabilities that can put users at risk.
Part of the game's attraction is that it's free and available to players across multiple video game consoles, PCs and mobile phones. The Hunger Games-like world of Fortnite allows players to showcase their creativity while playing. However, scammers are also getting creative. That, combined with a recent security breach, means players and parents need to be vigilant to help reduce the risk of identity theft and fraud.
In January 2019, Fortnite creator Epic Games acknowledged security researchers from Check Point Software had discovered a major cybersecurity vulnerability in the popular game. The flaw may have enabled hackers to access player accounts, where they could possibly covertly steal login credentials and gain access to stored credit card information as well as in-game friends and contacts.
Fortnite creator Epic Games has not commented on whether any player accounts were compromised as a result of this security flaw. Scams have also created problems for players. Last year, Epic Games warned about the most common Fornite scam on its Twitter account for players: "Say NO to scams! Beware of scam sites offering free or discounted V-Bucks."
How Big Is Fortnite?
Fortnite: Battle Royale has more than 80 million players worldwide monthly and some 200 million registered players, according to Epic Games. A live-streamed game last year set a new Twitch record for individual online streams, with over 600,000 people watching. The game featured rappers Drake and Travis Scott, Pittsburgh Steelers wide receiver JuJu Smith-Schuster and one of the game's popular players, Tyler "Ninja" Blevins.
Professional athletes are using the popular Fortnite dances in their own game celebrations, and Boston Red Sox pitcher David Price missed a start because he had carpal tunnel syndrome from playing too much Fortnite.
Nielsen's SuperData Research, that specializes in video games, reported that Fortnite earned $2.4 billion in annual revenue in 2018. That is more digital revenue in 2018 than any game in history.
A Common Fortnite Scam: YouTube Free V-Bucks
That kind of money and the addictive nature of the game has drawn criminal elements to the Fortnite universe. New players mean new opportunities for fraudsters who promise something free to help elevate your game. In Fortnite there are V-bucks, the virtual money that players can use to buy new gear.
While recently playing the game with my son and wanting to help advance our "Battle Pass" standing, I did a search for "free V-bucks." I found results promising we would win huge amounts of Fornite V-bucks. My son suggested I check out those third-party videos on YouTube, and what came back were more than 4.6 million various videos promising players to get free V-bucks by following their instructions or tips. Most send you to a website where you share an obscure code from your game account; in some cases, that allows scammers to gain access to your payment information either on your smartphone or game console. The third-party sites also have plenty of ads (which can lead you to download malware on your computer) or follow up with an email, which is really a phishing attempt or to download their app that can have spyware.
I know because I watched plenty of the videos hoping to find one I thought was legitimate but was too nervous to click on anything. Ironically, one video demo of how to get free V-bucks has the username shown as "VIRUSS999." While that username may be an easy sign of a fake, other ways to spot a scam video are to look at the number of likes and dislikes a video has received, and whether or not the poster is verified by YouTube with a check symbol next to their name.
Android Fornite App Scam
Another scam that has been affecting Fortnite players are fake apps in the Google Play store. Before the game was available on Android devices, security researchers at Zscaler found a bunch of Android apps posing as the official Fortnite app for Android. When players download the fake version of the game on their phones they ended up downloading spyware and adware that ends up being a real-life cyberattack. Many of these fake apps ask users to rate and review it with prewritten comments that make it look like the app is legitimate. In one case, Zscaler found an app that had over 5,000 downloads with more than 4,000 five-star reviews.
You should make sure to check your iOS and Android privacy settings to see if you're allowing third-party app downloads from untrusted sites. If you do, you may want to change that setting or delete those apps. You should only get apps from the official Apple and Android stores.
Don't Get Scammed or Hacked While Playing Video Games
You need to understand that even while playing games, sharing too much information online can allow scammers to gain access to your stored credit card number and perhaps even steal your identity. Here are some video game tips to help you avoid scams:
1. Don't Overshare Information
Avoid sharing details such as your real name, address or your account password as scammers will try to become friends with anyone in order to steal information. Only follow friends or people you know and don't accept the random stranger friend request.
2. Don't Use Your Game Password on Other Sites
Using a different password for a game site limits the risk if the site is compromised at any time. Make sure sites asking for your game password are legitimate either through a verification check mark on YouTube or has an official affiliation with the game website and developer.
3. Use Two-Factor Authentication
You're able to add this to most video games and consoles now and it gives you an added layer of security. Two-factor authentication requires you to provide a second piece of proof to verify your identity, usually, a code sent to your mobile device or email. While it takes a little extra time to set up and log in, enabling the feature in a device or on the game console is worth it.
4. Don't Let Friends or Family Share Your Account
Password sharing or account sharing is a surefire way to increase the odds of having your account hacked, have your information stolen, or lose money. As tempting or peer-pressure packed as it may be, don't give in.
5. Use a Throwaway Credit Card
Use a virtual credit card or one that is not your everyday card tied to your bank account. This will help you minimize your risk if your credit or debit card number is part of a data breach.
6. Don't Talk to Strangers
As old-school as it sounds, if some random person asks for details such as name, birthdate, Social Security number, or even about hobbies and interests through a game or text, don't respond. If they ask for money, don't give it to them no matter the reason.
If other players start harassing you or ask for money you should report that player to the Epic Games player support page.
What to Do If You Think Your Identity Was Stolen
If you think you or someone in your family has become a victim of identity theft you should report it to the support page for the game and to the game system so they are aware. If any of your information is compromised, change your password immediately and consider getting a new credit or debit card. You'll want to keep an eye on accounts and even your credit report (you can check your Experian credit report for free) to make sure no fraudulent charges or new accounts show up.
Here are more actions you can take to help protect your data:
- Add a free fraud alert to your Experian credit report that warns lenders you may have been a fraud victim. This notifies any potential lender to take additional steps to verify your identity before providing any new line of credit in your name. The new nationwide law extends an initial fraud alert from 90 days to 12 months for free.
- Go over your free Experian credit report to make sure that there are not any unwanted accounts opened in your name or using your personal information.
- File an identity theft report with your local police department through the non-emergency number and explain you are the victim of identity theft. They can tell you what information you need to provide.
- If you discover that you are indeed a victim of identity theft, notify Experian to resolve fraudulent activity by speaking with Experian consumer assistance associates.
- Add a seven-year fraud victim alert to your credit report after you have confirmed you are an identity theft victim and have obtained a police report. This notifies future creditors that you have been a victim of fraud, and extra steps need to be taken to verify your identity.
Here are additional resources to protect you and your kids from identity theft: