Tim Sweeney's apology email to Yves Guillemot shows a 70-90% fraudulent transaction rate on EGS for The Division 2

SteveWinwood · May 4, 2021

Thanks to strudelkuchen for pointing it out in the documents thread.

---

Dear Yves,

I'm writing to apologize for the shortcomings in our Epic Games store implementation and our Uplay integration.

In the past 48 hours, the rate of fraudulent transactions on Division 2 surpassed 70% and was approaching 90%. Sophisticated hackers were creating Epic accounts, buying Ubisoft games with stolen credit cards, and then selling the linked Uplay accounts faster than we were disabling linked Uplay purchases for fraud.

Fraud rates for other Epic games store titles are under 2% and Fortnite is under 1%. So 70% fraud was an extraordinary situation.

To stop the fraud, we disabled purchasing of Ubisoft games. We will make our best efforts to restore service as quickly as we can. This depends on (1) a real-time system for disabling refunded and fraudulent purchases on Uplay, and (2) anti-fraud improvements in Epic's service. This work will likely take at least 2 weeks to complete.

The fault in this situation is entirely Epic's, and all of the minimum revenue guarantees remain in place to ensure our performance.

I'm sorry for the trouble,

Tim Sweeney

Epic Games

---

via https://app.box.com/s/6b9wmjvr582c95uzma1136exumk6p989/file/806843549406

Kyougar said:
in picture format

The link is down now for me but I've seen it elsewhere. I'm trying to find the text to another related file about the same subject (Exhibit DX-3756) and I'll post it here when I find it.

Dhruvenator · May 4, 2021

Seems like a perfectly reasonable email following what appears to be a terrible breach

Lube Man · May 4, 2021

Tim Sweeney sending a saner email is something I needed to see.

Schlorgan · May 4, 2021

Dhruvenator said:
Seems like a perfectly reasonable email following what appears to be a terrible breach

Yup.

spam musubi · May 4, 2021

The wild part is "approaching 90%". 70%, but getting close to 90 to me sounds like something in the high 80s that they're trying to spin.

Orion117 · May 4, 2021

I remember ubisoft games being disabled on epic. People said it was because mtx integration wasnt working.

Lashley · May 4, 2021

"Sophisticated hackers" 😂

Deleted member 67800 · May 4, 2021

I think the free games will end at epic games.

SteveWinwood · May 4, 2021

spam musubi said:
The wild part is "approaching 90%". 70%, but getting close to 90 to me sounds like something in the high 80s that they're trying to spin.

It does seem like a weird gap. Turns out there are numbers between 70 and 90.

EvilChameleon · May 4, 2021

Love all these emails that are getting dropped. Fun times.

Lowrys · May 4, 2021

spam musubi said:
The wild part is "approaching 90%". 70%, but getting close to 90 to me sounds like something in the high 80s that they're trying to spin.

Could be, or maybe it was 70% at the start of that 48h period and was rising to near 90% when they stopped selling Ubi games.

Joni · May 4, 2021

Just shitty people doing stuff like this, because they're frauding the holder of the original card, the developer and the buyer of the account.

Kyuur · May 4, 2021

Lashley said:
"Sophisticated hackers" 😂

This is a pretty common term to separate an attack from a novel one. What's funny?

Alexandros · May 4, 2021

Lashley said:
"Sophisticated hackers" 😂

MoosGoMoo · May 4, 2021

Lashley said:
"Sophisticated hackers" 😂

What's described in that email is sophisticated. Don't let facts get in the way of snark though.

Schlorgan · May 4, 2021

Kyuur said:
This is a pretty common term to separate an attack from a novel one. What's funny?

It's something Sweeney said. Gotta mock it.

spam musubi · May 4, 2021

Also this, among with everything else we know about the EGS, just goes to show that epic are just not prepared or qualified (yet) to run their own store. They have a very gung ho approach to doing this all and it's clear that they're prioritizing their spending in acquiring exclusives instead of making the store better.

NunezL · May 4, 2021

spam musubi said:
The wild part is "approaching 90%". 70%, but getting close to 90 to me sounds like something in the high 80s that they're trying to spin.

It was probably 70% overall but with a current rate closing in on 90%. It is perfectly possible

Nif · May 4, 2021

So Epic has/had shitty fraud detection.

404LinkNotFound · May 4, 2021

EvilChameleon said:
Love all these emails that are getting dropped. Fun times.

Same. its interesting to see what goes behind the scenes in these large game comapnies businesswise since thier so secretive

ReggieBC · May 4, 2021

Don't see anything wrong with this email

Nintendo · May 4, 2021

That's a good email. Why are people trying to make everything looks bad and funny?

Schlorgan · May 4, 2021

Nintendo said:
That's a good email. Why are people trying to make everything looks bad and funny?

Epic bad Steam good

SteveWinwood · May 4, 2021

ReggieBC said:
Don't see anything wrong with this email

Nintendo said:
That's a good email. Why are people trying to make everything looks bad and funny?

Where did you read that I thought it was a bad email?

sir_crocodile · May 4, 2021

Nintendo said:
That's a good email. Why are people trying to make everything looks bad and funny?

I assume people are probaly thinking about how primitive the EGS front end is and assuming the same about the backend. Need not necessarily be the case, I assume backend security was the number one priority.

Absolute · May 4, 2021

Approaching 90%? Wow. Great email though from Tim. Gotta focus on the positive.

Schlorgan · May 4, 2021

SteveWinwood said:
Where did you read that I thought it was a bad email?

Those posters weren't referring to the OP.

ReggieBC · May 4, 2021

SteveWinwood said:
Where did you read that I thought it was a bad email?

Oh ok, what's your opinion then?

SteveWinwood · May 4, 2021

sir_crocodile said:
I assume people are probaly thinking about how primitive the EGS front end is and assuming the same about the backend. Need not necessarily be the case, I assume backend security was the number one priority.

~~I'm still trying to find exhibit DX-3756 where Tim Sweeney apparently says: "Doesn't help that we don't currently verify email address or have good account security."~~

This was an inaccurate attribution. The person who said this was Scott Adams, someone who works on fraud with Epic. There is more information coming later in the thread.

APizzaPie · May 4, 2021

Reading that email stressed me out. It must have sucked to work on a fix like that under a time crunch.

sir_crocodile · May 4, 2021

SteveWinwood said:
I'm still trying to find exhibit DX-3756 where Tim Sweeney apparently says: "Doesn't help that we don't currently verify email address or have good account security."

:o

Lashley · May 4, 2021

MoosGoMoo said:
What's described in that email is sophisticated. Don't let facts get in the way of snark though.

Kyuur said:
This is a pretty common term to separate an attack from a novel one. What's funny?

All they did was create accounts and do a chargeback, kids can do it.

Don't let facts get in the way of snark though.

Haze · May 4, 2021

EGS is an absolute mess lmao

MJForum Poster · May 4, 2021

I would love to read a postmortem of this issue and how they fixed it. This type of stuff happens all the time when your start connecting various services and user flows built by different teams. Companies spend a ton of trying to catch and prevent fraud in real time

kafiend · May 4, 2021

Reasonable email, but wouldn't have needed to be written if the EGS was robust.

EloquentM · May 4, 2021

Lube Man said:
Tim Sweeney sending a saner email is something I needed to see.

he didn't write that. His lawyers did.

MoosGoMoo · May 4, 2021

Lashley said:
All they did was create accounts and do a chargeback, kids can do it.

Don't let facts get in the way of snark though.

The scale needed to prompt this email obviously implies it was on a large-scale, which no, most kids can't do.

Don't let facts get in the way of snark though.

Kyougar · May 4, 2021

in picture format

Schlorgan · May 4, 2021

MoosGoMoo said:
The scale needed to prompt this email obviously implies it was on a large-scale, which no, most kids can't do.

Don't let facts get in the way of snark though.

Get your logic out of here, there are platform wars to be fought.

boi · May 4, 2021

The real news is the scale of the hack I would say. The email is just what one business person would write to another in this situation to remediate.

SteveWinwood · May 4, 2021

ReggieBC said:
Oh ok, what's your opinion then?

Their security doesn't seem great, to the detriment of their users and their partners.

boi said:
The real news is the scale of the hack I would say. The email is just what one business person would write to another in this case.

There's a reason I made sure to fit in the fraud part in the title.

MoosGoMoo · May 4, 2021

Schlorgan said:
Get your logic out of here, there are platform wars to be fought.

Two CEOs of gigantic companies email each other all the time over a few stolen copies of a game, my bad.

Kyougar · May 4, 2021

SteveWinwood said:
The link is down now for me but I've seen it elsewhere. I'm trying to find the text to another related file about the same subject (Exhibit DX-3756) and I'll post it here when I find it.

This one?

Box

app.box.com

from https://tinyurl.com/epicvapple (it is linked in the document thread :> )

headspawn · May 4, 2021

Neat.

SteveWinwood · May 4, 2021

Kyougar said:
This one?

Box

app.box.com

from https://tinyurl.com/epicvapple (it is linked in the document thread :> )

Thanks so much. The box link never works for me, but that tinyurl link works great. Lots of stuff I'll work on getting into this thread about the specific ubisoft fraud case.

Lashley · May 4, 2021

MoosGoMoo said:
The scale needed to prompt this email obviously implies it was on a large-scale, which no, most kids can't do.

Don't let facts get in the way of snark though.

Lots of people did it, it wasn't a small group ffs

There were reddit posts with guides about it, but yeah, "sophisticated hackers" did it

Don't let facts get in the way of snark though.

SteveWinwood · May 4, 2021

sir_crocodile said:
:o

Just to update you as I found it. It wasn't Tim Sweeney who said it. The exact quote is from a man named Scott Adams who is a fraud professional Epic works with.

sir_crocodile · May 4, 2021

SteveWinwood said:
Just to update you as I found it. It wasn't Tim Sweeney who said it. The exact quote is from a man named Scott Adams who is a fraud professional Epic works with.

Astonishing that they didn't do email verification in the year 2019.

elenarie · May 4, 2021

MJForum Poster said:
I would love to read a postmortem of this issue and how they fixed it. This type of stuff happens all the time when your start connecting various services and user flows built by different teams. Companies spend a ton of trying to catch and prevent fraud in real time

Yea for big projects companies usually hire penetration testing specialists before launch, that focus entirely on finding security holes for whatever the product / service is. But it is a whole different story when you open something to the mercy of the internet. :D

SteveWinwood · May 4, 2021

More screencaps from the email chain about this issue from Epic internally (Read from the bottom up because emails):

The general update of where they were with the issue and some goals:

Tim Sweeney's apology email to Yves Guillemot shows a 70-90% fraudulent transaction rate on EGS for The Division 2

Alt-Account

Prophet of Regret - A King's Landing

<<Tag Here>>

User requested account closure

Attempted to circumvent ban with an alt-account

Prophet of Regret

Attempted to circumvent ban with an alt-account

<<Tag Here>>

Cute Animal Whisperer

Cute Animal Whisperer

<<Tag Here>>

Game Developer