1. How to tell if my account has been compromised?
- If you have your credit card or Paypal linked to your Xbox account and you recieve a bunch of emails from Microsoft thanking you for purchasing Microsoft Points
- If you notice your Microsoft Points balance has been drained out and you go to billing.microsoft.com and see that they have been used on things you have not purchased, typically FIFA DLC
- A large amount of Microsoft Points were purchased using your credit card of Paypal
- You go to live.xbox.com/en-US/Profile/Protection and notice that you have been signed into consoles you do not remember
- You notice achievements for games you've never played, typically FIFA games
- Your gamertag, friends list, or profile has been changed
- If you have difficulty logging into your account
2. What to do after your account has been compromised?
- Do not download any of the content the hacker purchased to your Xbox
- Remove any payment info you have linked to your XBL account here: live.xbox.com/en-US/ManagePaymentOptions (Tip: To turn off auto-renewal without calling phone support, set your state to Illinois)
- Change your password and security question to something completely different then what you had before here: account.live.com
- Go to Xbox 360 Profile Protection and sign out of all your consoles here: live.xbox.com/en-US/Profile/Protection
- Call Xbox Phone Support (their twitter, chat, and email support can't help) and tell them your account has been compromised (and if you have any other subscriptions, like COD ELITE, mention it), you can find their number here: support.xbox.com/en-US/contact-us Make sure you have your Windows Live ID and our Console ID and serial number readily available (found in your console settings)
- Contact Paypal and/or your credit card company and have them refund any charges
- For more info on what to do, visit here: xbox.com/en-US/Live/Account-Security/What-To-Do
3. What now?
- You won't be able to sign into any Xbox 360 on the compromised account for the extent of the investigation. You can still play offline on your account, but you'll lose any offline achievements on your account following the investigation, since you'll have to re-download your profile.
- It'll take them at least 15 days, typically 25 days, and possibly more depending on the complexity of your issue (whether it was hacked from a different country, whether your content licenses were migrated, etc.)
- In a couple of days, they'll email you a 1-month XBL Gold code to make up for lost time. You can use this on your existing account or make a new XBL account
- During the investigation period, you can call Xbox Support to check up on it (nagging them might help speed up the investigation)
- Once your investigation has been resolved, they'll call you. You'll usually be refunded any money charged and any Microsoft Points the hacker used within the next 1-2 payment days
- Microsoft usually doesn't remove any content the hackers purchase, so you'll get to keep that at least.
- Microsoft is also unable to remove any achievements related to your hacking.
- If you had a lot of personal info stored on your Windows Live ID, consider buying Identity Protection services
- If after 25 days your investigation still has not been resolved, you can file a complaint with the Better Business Bureau here: bbb.org This may help speed up the investigation; if you do file a report, make sure to mention it the next time you call Xbox Support
4. How to protect your account?
- Make sure your password for your Xbox account is unique (not used on any other sites) and is at least 8 characters, and contain upper case letters, lower case letters, numbers, and non-alphanumerical characters, and within the password, you have at least one word
- Don't login using your Windows Live ID on public computers and networks
- Beware of phishing emails and sites
- Don't link your Paypal or credit card to your XBL account (if you want to pay with them, briefly link them to your XBL account, buy whatever you need, and unlink them) and DEFINITELY do not pay with debit cards since they're harder to dispute charges
- Buy prepaid Microsoft Points instead, and only activate them right before you're about to spend them, so hackers can't steal anything
- Enable automatic HTTPS for your live account here: account.live.com/ManageSSL
- Make sure your computer is virus free, if you don't an antivirus, these are some good free alternatives (only install 1): avast!, Avira, AVG, or Microsoft Security Essentials
- Xbox has a pretty thorough checklist here: xbox.com/en-US/Live/Account-Security/Security-Checklist
A few last notes: Most XBL accounts are hacked for buying FIFA DLC which can traded and therefore sold for cash. Most account compromises come from either social engineering, or really lucky brute-forcing. And a little terminology thing, your XBL account isn't "hacked", which is someone using loopholes in the network infrastructure to gain access to individual XBL accounts. At this point, this seems highly unlikely. However, there are still many unknowns to the current XBL "hacking" situation.
The PSN outage in spring was due to a hack. Your PSN account may have been compromised by a outside intruder. Sony shut down PSN for months in order to protect any further intrusion. For more information about different kinds of Xbox Account Theft, visit here: xbox.com/en-US/Live/Account-Security/Stolen-Account
Update: Eurogamer and Analoghype have some pretty good explanations for the account hackings. Looks like because of a design flaw on the Xbox website, it can be easily bruteforced and combined with social engineering to harvest potential Window Live ID email addresses, that's how the hackings are going down.
Edited by MrPiggles, 08 April 2012 - 11:56 PM.