Feedback: Compromised Account Reimbursement Policy

[Sapience]

As part of our ongoing effort to evolve and improve our policies to better support our customers, we’re very pleased to introduce our updated and expanded Compromised Account Reimbursement policy. We have made some significant improvements to the existing policy based on player feedback, testing, and new tools available to our customer service staff.

You can read the full details in the knowledge base.

[DelgonTheWise]

Looks very nice. Given the huge investment in time in our characters,
loss of them/their items is a big issue. Glad to see it addressed!

[Skigorn]

Awesome!!!

[Fredelas]

I'm very pleased to see this large step forward. My only concern is that for many players, the time frame may be a little short. About half of the cases of compromised accounts I've heard of occurred while players were taking time off from playing the game, sometimes for unavoidable reasons such as military deployments or the arrival of a new baby.

If there are no technical hurdles preventing it, it's my hope that Turbine's customer support representatives would be flexible in circumstances where players do not discover their accounts have been compromised until more than seven days have already passed.

[Khafar]

Thank you! It's most appreciated, and should help lower the passion on this issue a great deal.

I'm guessing the 7-day limit is a function of how you do your database backups? That's probably the greatest remaining weakness I see... lots and lots of people can and will go for more than a week without logging in (or perhaps even having access to a suitable computer). I've done so several times in just the last year: once for vacation, twice for business trips, and once because I was taking a month or so break from LOTRO while I played some other games. If I'd been hacked during any of those times, I'd be stuck with the rather unsatisfying "standard package" for player compensation.

Khafar

[Raath]

Good stuff Turbine!

[Danaca]

"With the release of Update 2 we will be making changes to certain hard to acquire items, such as raid gear, that will prevent them from being sold to vendors. "

Thank you. This is a big step forward.

[crazyfoxx]

Bravo!!

That is all I wanted. The policy posted. Not for me, but for friends whose accounts have been compromised.

That was allot easier than deleting or closing my posts which asked for that policy, wasn't it?

Again, Bravo! and thanks. I will save the new page and hope it does not disappear, of course if it does I am sure this thread will vanish as well.

Edit. On a personal note, I could care less if my account were compromised as long as my account is not closed, not due to the policy but due to the fact I dont bother with having massive wealth nor non craft-able items and as long as my characters are intact (not deleted) I can earn back any lost gold in a matter of hours, and re-craft items (except the legacies on the LIs). Well, maybe not care less, I wouldn't like it as it would be a setback to my helping others and crafting stuff for them.

[Ascus2]

Kudos ... sounds great.

Makes me fear a little less about getting my account compromised, but just a little. Still going through all my steps.

[demby]

Thank you. I'm very glad to see this announcement. I appreciate that Turbine is listening and working to revise systems and policies to address player concerns about this issue.

[Asba2]

A huge step in the right direction so thank you Turbine.

The 7 day window in which to act takes away from the step and the direction. Seems to me to be arbitrary and unacceptable. Consider how many of your own staff are away from the game for various reasons for longer than a week.

Should someone who cannot long in weekly be considered not worth helping if their account is compromised? Personally I think not.

[Khafar]

The 7 day window in which to act takes away from the step and the direction. Seems to me to be arbitrary and unacceptable.

It's almost certainly not "arbitrary", but based on how they structure their database backups. Perhaps they can work on that independently and then extend this timeframe in the future.

If it were a month instead of a week, I think it would probably handle 98% of the cases out there. There was nothing I could have done about my vacation or business trip absences (1-2 weeks each), but there was plenty I could have done about my break from LOTRO - just logging in once a week would have been sufficient to prevent a loss.

Khafar

[jdahan80]

Glad to hear about this.

It would be nice to have the following options available to me:

1. Restrict my account login via specific IP addresses
2. When logging in from an alternative IP address, I would have to confirm my identity (i.e. security questions, unique link emails to my email account).
3. Notification of logins and/or failed login attempts.
4. Ability to lock account being able to decon/give/sell/auction or otherwise remove an item from my character/storage without authorization.

[Yula_the_Mighty]

The 7 day window in which to act takes away from the step and the direction. Seems to me to be arbitrary and unacceptable. Consider how many of your own staff are away from the game for various reasons for longer than a week.

It is not arbitrary. It has to do with their backup rotation. Turbine may not do it this way. A standard policy is:

1) Daily backup. Seven sets of media labeled MTWHFSS.
2) Weekly backup. Four sets of media for week 1 - 4.
3) Monthly backup. The number of media set varies
4) There can be others like quarterly, six month, annual.

After seven days, the back up is overwritten. Certainly it could be longer. There is a cost for extra media sets. Cost for storing the media. Cost for periodic replacement of the media. The media only lasts a certain number of days. A backup only lasts for a certain number of days before it becomes unreadable. For very long backups. Typically you make two copies. Put them in two different places. Periodically you copy them to a new pair of media.

More than once I've asked for archival media to be mounted. Or a restoration of something that was deleted a long time ago. Gotten either:

1) We are so sorry. Both media copies are bad.

2) We are so sorry. We do not have the media. Can not find it. Our current equipment can not read that media.

3) Its format is not compatible with our current servers. We no longer have one of the old machines laying around. We can read the back up. We can not write it to a normal disk drive.

4) We do not support this application format any more. This is a big problem with SQL database backups. The SQL engine we got currently can not properly read the records.

5) This backup is designed for an old character database layout. We are going to have to build a database server running the old lay out. Restore the character. Run the script to convert to the current layout. Export this character. Import the character into the live database.

[LesleyPhillips]

It is good to know.

Thinking on the talk of Balckarrow of Silverload...

[Laire]

Fantastic.

While the 7-day policy can be unfortunate in some cases, like business trips preventing character access, I can see why it would not be possible to do so, due to backups.

[quigonwindu]

Nice to see Turbine listening to the players.... this would've come in handy for me 4 months ago

[Deusdictum]

Best part of the knowledge base article:

Related Topics:
...
How do I hide my helmet in LOTRO? How do I show my helmet in LOTRO?

[virtualray]

Thank you for making the effort to improve this. I was hacked last fall while traveling for 3 weeks. I need to be able to trust that what I am working on in game or buying in the store can't just be be wiped out with no recovery available. In my case 7 days would not have been long enough. It is very important that you do this right and have the ability to recover a character completely at some point. It will help a lot being able to recover items that can't be replaced like quest rewards. I also like that you did it in a way that you can continue to play while the case is resolved. Thanks for you work on this.

[phaelan2]

Looks like I just missed the boat -- my account was compromised this past week and most of my characters robbed blind (no gold, empty bags, empty bank). For one with a lot of characters on multiple servers, this is a big hit.

Oh, well, like I told my daughter afterward, it's just pixels and time. No real money lost or cost to finances or family.

I submitted tickets for each character, received notification that the matter is being looked into, and am now awaiting the results.

[jayspeed]

Bravo Turbine. It's great to see you continue to listen to your players and impliment new systems based on feedback. I know I'll feel better knowing I have some protection incase something bad happens. But the players shouldn't stop protecting their accounts. Don't use easy to guess passwords or share account info with others just because there's a new restoration policy in place.

[joyrex]

It is nice to see an actual policy for this occurance, however a 7 day window seems fairly short. I understand that due to backup rotations, data retention policies, etc., that there has to be some kind of limit, but for casual players with lifetime accounts, or people with free accounts that don't pay a monthly fee, we may not log in every week. Taking a month long break and then logging in to find all your hard work flushed into a vendor is very upsetting. Several of my friend had this exact thing happen to them, and all it does is lead those people to simply not play the game anymore.
While account break-ins can be the user's fault (bad passwords, social engineering, etc.), sometimes they can be no fault of the user.

It would really seem to be in Turbine's best interest to extend the window to something like 30 days, or maybe have some sort of alerting system when someone logs in from an IP address that is unfamiliar or some other way of checking if you are the right person or not.

The "standard" recovery policy also seems kind of up to the admins whim, and sometimes you lose hours and hours of work, and a lot of gold and items, and you get offered like 5g and some arbitrary items that hardly make up for what is lost.

I like the direction that this policy is going, but I feel it falls rather short.

[anne2826]

why wasn't this implemented in the game on day one? my husband's account was comprised a few months back and there was nothing that could have been done about it. actually a few were hacked into around the same time. its too late for him i guess. no real security in a game till now??? its going on four years this summer should have been four years ago. oh well i guess you can't have it both ways. i know its a lot of hours of work to implement things so i guess that time has come! love the game wouldn't go anywhere else. thanks for what you do now and what your adding to the game!

[RJFerret]

Wow, kudos Turbine!

In addition, despite all the naysayers, I'm delighted that the window is greater than 24 hours (the most likely time to discover such a thing).

I'm delighted that there is no apparent charge/cost, nor do I have to buy some form of pre-hack insurance or item/dongle/key.

I'm delighted that A Scroll of Character Inventory Restoration isn't a store item.

What were the other "looking a gift horse in the mouth" issues? ;-)

Brilliant!



"Sometimes survival comes down to not being hit. Actually, most times." -the chicken skill, Bob and Weave

[micahsherrill42]

glad to see some effort made here. unfortunately too late for many of us. lost a few kinmates because of hacking and i was cleaned out on nine toons and had two deleted. the customer service response was to continually close my tickets and i was never able to speak with anyone about the problem. a friend called turbine on my behalf and was instructed by the head of customer service to resubmit my tickets and everything would be restored. however, i got nothing but closed tickets repeatedly. it was very disappointing to be ignored. being a victim of this kind of thing is extremely frustrating.