Internet courtship: Why would a hacker buy me poker chips?

Question

Believe me, I never expected to ever write a title like that on a Stack Exchange site either!

Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around spam and viruses. However, yesterday she was startled: she got an email from Facebook thanking her for her purchase of 40 dollars worth of poker chips in the Facebook game TexasHoldEm. She was ultimately sure she had never done a purchase like that, but she was worried she had lost money one way or another.

The email seemed genuine. Logo, text, sender, and links all pointed to genuine Facebook resources. I decided to take a look and followed the link to the 'receipt'. A payment overview at Facebook.com opened and everything was documented as the email had stated: her account had acquired 40 dollars worth of poker chips in the app (game) TexasHoldEm. Surprisingly, though, those chips were paid with a PayPal-account registered to an email address we have never heard of:

[email protected]

This is odd for two reasons: we live in Belgium, but have no relation, friends, family or otherwise, in Germany. Second we know no one by that name either.

At first I thought it may have been an error on that person's side, or that it is simply possible to 'donate' chips to someone else's Facebook account. But this would allow app developers to spam people who had never used their app with free gifts, so this seemed unlikely.

I then checked her account's recent activity, more specifically the 'recent sessions' tab. To my surprise there was indeed an active session in Düsseldorf, Germany. As a panic attack, I immediately ended that session. Unfortunately that also hid the information about that session. For me this meant only one thing: her account must have been hacked, as she hasn't been to Germany and there is no way there could be an active - poker-playing - Facebook instance there.

In light of this, I urged her to immediately change her password. After that, Facebook seems smart enough to know you made the change because you thought something was wrong: it proposed to go through her recent app activity and post and possibly deleting strange behaviour. Indeed, the app TexasHoldEm had been used, and there had been four posts (of the app on her behalf) that she had been playing the game - going back one whole week.

As a conclusion I would think that someone hacked my mother's account, played poker on it and paid for chips him/herself and ... That's it. Maybe I am getting old, but isn't this weird behaviour?

Why would a hacker do this: hack some one's account, buy poker chips with their own PayPal account, and play the game? And how can I better protect myself against such 'attacks'?

The poker chips were for Zynga's Poker game on Facebook. As has been mentioned in the comments, you cannot withdraw won money from this game. This is valuable - and intriguing - information which makes understanding the hacker's motives even harder.

Answer 1

I interpret your question as:

What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips?

It's not that strange if you think about it this way:

As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the card distribution.

Thus, using sock puppets that are valid, active - real - Facebook accounts are the only way to gather more information without being spotted easily by heuristics.

Düsseldorf is where one of the big data centers in Germany is located, so there is a good chance that session was held by a bot on a server, not a real person.

Using two or three such bots on a table that are connected gives them a significant statistical edge to beat the other - real - players.

This (collusion) is probably illegal in most poker games and thus real accounts are used to make detection hard. Also, that's probably not the attacker's real name, their mail address and/or PayPal account.

It is probably the account of another victim of identity theft.

In the light of the other answer, I assume that Facebook handles the legal things when you marked the activities as fraudulent.

---

Update for modified question:

As there seems to be no real money gains involved in this poker game instance, there is another valid reason to use your mom's account:

Because it offers anonymity. If the stolen PayPal account owner tracks the usage down, it'll be your mom as a suspect, not the actual hacker.

Using real, alien Facebook accounts offers another layer of protection with respect to law enforcement.

---

There still remains the question of how the account was taken over. There are questions here that might answer that.

If your mom does do password reuse, you might educate her about the implications and urge her to change all passwords and use different, strong ones for all accounts.

This would be a good time to introduce her to the famous xkcd about diceware and/or a password manager, as David suggested in the comments.

Also, as S.L. Barth suggests in the comments, using two-factor authentication wherever possible is a good call in any case.

Answer 2

To me it seems as if someone is doing fraud from your account.

They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an anonymous prepaid credit card. There are lots of different ways of doing carding (fraud).

I'd contact FB and maybe the police as you might get a loud knock on the door due to fraud being done from your FB account.

Answer 3

OP has clarified that this is Zynga Poker, in which no real money changes hands.

That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this scamp has acquired/purchased a block of PayPal account details and is systematically testing them to see if they work by hacking into Facebook accounts and using those as mules to test whether the PayPal accounts have been frozen.

By verifying these accounts, he can gain a dramatic return on his investment. A thousand untested PayPal accounts culled from a 'data dump' might retail for a just a few dollars whereas a block of ten "proven active" PayPal accounts will sell for as much as $10-15 apiece, or even more if the account contains money and assuming he's logging in from a relatively secure location (such as an internet café), his chances of being captured range from slim to none.

Answer 4

It's also entirely possible that the entire thing is a confidence scam. In this type of scam, someone gives you some money to let people engage in high-risk behavior (e.g. gambling), and the victim plays increasingly high-risk bets until, at some point, the other players at the victim's table (in reality, an assistant or bot ('shills'?) of the con artist) runs the table, taking all of the original money back plus some amount of the victim's own in the process. Usually, this type of scam will go until the victim finally runs out of money or they decide to quit (usually after they've lost far too much money).

Answer 5

The first answer that pops to my head is money laundering. The hacker would just transfer the cash to their facebook account via playing extremely bad. I think, the reason why the 3rd party account needed to be hacked is Germany's gambling legislation. As far as I know, Germany has strict gambling regulations. It's probably forbidden by law to play particularly at Zynga (having no licence), so they needed an account outside Germany to do that. And why would they need to choose exactly Zynga? They thought it would be unnoticeable, because noone actually uses Facebook for gambling. The other factor is that Zynga is the only poker game that has an own contract with PayPal. PayPal usually doesn't allow anyone to use their API for gambling websites - and they needed money exactly to PayPal, because an unverified account is not linked to identity, and they could easily process the money, either buy bitcoins and continue laundering, or just go shopping on various webshops.

Answer 6

So, someone bought a hacked FaceBook account, set up a custom fake PayPal account in the name of the hacked account, gave the hacked account poker chips, and posted ads about their game to FaceBook as that account.

I see two possible reasons to do this.

1) On the face of it, the only entity which benefits from this is Zynga, which gets advertising, and if the victim uses the poker chips and gets hooked, possibly gets another player. It also loses nothing by buying chips from itself.

In the games industry, Zynga is typically rated as close to the bottom of the morality/sleaze scale.

However, there are obviously cheaper, easier ways to achieve this goal, such as just giving random people poker chips in an email blast, or a banner ad. So, I really don't think it's reasonable to try to pin this one on Zynga.

2) That suggests there's another cash flow that we're not taking into account in the first scenario. This suggests "gold farmers". The same people you see saying "Buy WoW gold!" - if there is a market for "twinking" (aka power-leveling, or rapidly leveling up) players, then it makes sense to have a stable of hacked "mules" to automatically play and lose against those players.

One strange part of it, in this scenario, is that you'd expect the hacking to be as subtle as possible, so posting ads about the game to facebook is a risk I'd not have expected them to take. But the game may give free chips for doing so, in which case it is likely worth the extra risk of discovery.

Another strange thing is that the game is apparently trivially hackable. You can hack yourself extra credits and suchlike. Why not do that, rather than buy them?

Answer 7

So let me answer this in two ways: by the addressing the part of the situation that your attention is on (understandably; it's an amusing/interesting little scenario) and then addressing part of the situation where you're/our attention probably should be.

What do I mean by that? Well, what I mean by that is that there are not one but at least two questions here for someone to explore:

1. Why did that hacker do what he or she did with your mom's Facebook account, that (almost certainly stolen) PayPal account, and the playmoney poker game?

2. How did the hacker get your mom's password to begin with?

On the first question, I have to agree with what others have well-said in their answers: there's a good chance it's somebody testing out PayPal accounts to see if they will work or not. Other than that, let me offer a total guess that perhaps someone simply wanted more chips to play with on Zigna poker on Facebook. That sounds like it's almost too absurd a possible motive to lead anybody to break what is almost certainly a plethora of anti-hacking and anti-financial-fraud laws in place across multiple countries. But, well, cyber criminals tend to be like traditional criminals: a few of them are reliably skillful, disciplined, and careful, but many more are often sloppy, impulsive, and overconfident (Of course, a devil's advocate might argue the same is true about a significant minority of security professionals. But that gets us off down a different track.) I find it totally plausible that this could be a case where a brash attacker like that simply came accross your mother's Facebook login credentials, someone else's PayPal account credentials, and decided they wanted some more chips in Zigna poker.

So, in short, the person either wanted to test the activity of a stolen PayPal account, or wanted to get more chips to play with in the poker app without paying $40.

But now we move on to the much more immediately important issue. There are basically three easy ways a bad guy gets someone's password for a prominent web service:

-- He/she finds a set of credentials that have already been exposed by the compromise and dump of another site's password database on the Darknet and tries the same set across many popular internet services. If the user reused the user id and password anywhere else... well, that's why the first rule of choosing a decent password is making it a unique password.

-- He/she got the password from a phishing scam, where the user thinks they are entering their login info into what looks like the actual Facebook login page but is really a very convincing copy at a slightly different URL.

-- He/she manages to get malware installed on a victim's PC that records the victim's password--and quite possibly every password the victim types in--and sends them back to the bad guy.

( On the issue of password database compromises, an attacker can either (a) have simply found a resource on the Darknet where account credentials are sometimes publically released for all the world to see-- and to have stumbled upon some of those known compromised accounts that still happened to work, or (b) more likely the attacker came across the info for those accounts in lists of credentials that he'd or she'd already purchased access to for other, more nefarious purposes. As I intimated above, doing either of those things would be poor op sec/tradecraft on an attacker's part, in my opinion. But a great many hackers make such errors frequently without ever being held to account for them.)

Now, if your mom's password got grabbed by either of those first two methods she would be wise to read some pointers on the selection & management of strong, unique passwords, bone up a little on the basics of what phishing is, and enable two-factor authentication for all the accounts she can. Your basic user security knowledge touch-up that +95 percent of general computer users can benefit from.

If, on the other hand, one of your mom's PCs, her smartphone, or some other device is infected with password-stealing malware, well.......

And since you don't know how the attacker got your mom's password, the prudent, "responsible" thing to do is, of course, to assume that one of her computers (at least one) is infected with malware and act based on that assumption. And since your mom, though at least a little tech savvy, still probably doesn't have enough of a tech comfort level to feel okay about nuking her OS installs from orbit, you, OP, could well find yourself playing a long-distance tech support role.

Ah, the joys of being your family's internal anti-malware tech support. Who doesn't look forward to that? :)