I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is impossible to prevent people from modifying the client, so what is a way that I could detect if people have changed the client? Is there some way to verify that the client is legitimate at start up or something? I know I can't completely stop it or detect all changes, but I just want to make it as difficult as possible for people who modify their clients to go undetected and gain an advantage.

2 Answers 2


You are approaching the problem from an entirely wrong perspective.

Whatever is on the client-side is out of your control. Any determined enough person will be able to bypass whatever measures you employ. Instead, have your server control and validate the important data. There's no reason for game money to be controlled by the client unless it is a single-player game and if so, why bother?

  • Sudden changes in location, cursor position, or other variables could just be a result of a bad connection. How do I validate that these variables are not just a result of a bad connection. Dec 18, 2013 at 4:09

You can never fully protect the client from tampering. If you're dealing with in-game money, it's one thing to deal with cheaters. They can unbalance the game and spoil it for everyone. But when you're dealing with actual, paid-for-with-hard-currency real-world U.S. Dollar money, it's another problem entirely.

Your first concern will be risk management. What successful games have done is to make spending money asymmetric. Let's say the game trades in lingonberries (~lB). They set up a server where players can buy ~1,000 lB for $10.00 USD on a credit card or paypal account. In this model, the game lingonberries represent real world value (a penny each.) But if the game allows players to "earn" lingonberries through mining or farming or grinding, they don't want to risk a hacker setting up an earning-bot that sucks up a ~million lB per day. One way to manage this risk is to set the game server to limit the rate at which lB can be earned per account. Perhaps the players are limited to earning no more than ~10 lB per day, and then only under really special circumstances. Otherwise, they can only earn "gold stars", "health points", "manna", or whatever other resources the game deals in. So even when they might have untrustworthy clients, they're limiting their exposure to only $0.10 per day per account.

There's another interesting problem when an in-game currency has real-world worth. They have to restrict and limit everything about them, such as the transfers of lingonberries or items bought with lingonberries between players. If lingonberries can hold value, and if valuables can be transferred between players, they can be bought and sold on eBay. And if they can be turned into cash, they can become a channel for real-world money laundering activities! Plus, lingonberries in the gamer accounts becomes actual liabilities on the company books. That means a game company will have other financial rules to follow, such as escheatment (what to do with the money left in abandoned accounts that still have a balance.)

The MMORPGs have grown so large as to hire actual economists to help run their in-game economies. They deal with issues like inflation, game-bugs that cause deflation, money supplies, and others, all to help maintain a fun game balance while managing risk. The problems in the largest games are incredibly complex. So let's hope your game becomes so popular you run into all these issues! :-)

  • Oh jeez that's a lot to think about... I'm thinking I'll just have to have a good moderating system to start out with and if it gets anywhere I'll do some of that stuff. Dec 18, 2013 at 4:29
  • Sure, because nobody knows how to have fun like an economist. ;-)
    – AviD
    Dec 18, 2013 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.