After hackers ran up a bill on my PlayStation account, Sony held it ransom

Sony PS4 Controller
Getting my PlayStation account hacked was terrible, but Sony made it a whole lot worse.

Instead of helping me, Sony decided that I had to pay for the games that my hacker purchased, or face a permanent ban on my account.

It all started Saturday afternoon. I was scrolling through my inbox and noticed some odd emails from PlayStation, all of them at 3:01 AM. There were three $25 payments to my PlayStation wallet, and a purchase for NBA 2K16 and some credits. After checking to make sure my roommate hadn’t drunkenly purchased the game, thinking he’d pay me back later, I noticed even more concerning emails.

While I was sleeping, someone locked me out of my own account.

The first asked me to confirm a change to my PlayStation account’s email. The email wasn’t opened, nor had any odd devices accessed my email account, but another message less than a minute later confirmed the email change. Yep. While I was sleeping, someone locked me out of my own account.

But PlayStation requires you to confirm an email change by clicking a link in an email sent to the old account first, right? Wrong.

As it turns out, hackers have an easy way around this problem. Payment info, or at least a portion of it, is visible in the web interface for a PlayStation account. Once an attacker has your password, they can chat with Sony tech support, explain that they don’t have access to that email anymore, and use the visible info in the account to verify their identity, changing the email on the account to prevent recovery by its rightful owner — in this case, me.

In the meantime, they added a device to my account, a PS Vita. Unlike a PS3 or PS4, a PS Vita can’t be removed from the account by Web, it can only be deactivated from the device itself.

Fortunately, social hacking your way through tech support tends to be a double-edged sword, and I knew I would be able to wrestle my account back by providing the right info. Both consoles that regularly access the account are in my home, so that’s a form of proof, and because Sony doesn’t let users change their user names, no email changes could alter my gamertag.

Following the paper trail

This all happened on a Sunday, so Sony’s phone support wasn’t open, and I was forced to use the text chat. This actually ended up working to my benefit, as we’ll see shortly, but it also raises some problems of its own.

I wasn’t at home when I noticed the hacker’s activities, but I needed to stop the intruder from making any more purchases. I called PayPal support, and an agent there was quick to de-authorize my PlayStation account from making any more pre-approved purchases. Then, I filed a dispute on all three $25 charges.

Sony-Login-0001
I don’t own a PS Vita, but it’s stuck on my account

Once I got home, I sat down at a computer and fired up Sony’s chat support. At first, the agent was helpful. The intrusion and email changing were a separate issue from the disputed purchases, so we would deal with them one at a time.

The agent rolled back the account’s email to the previous address (mine), and forced a password reset when I confirmed the change. Then I was a little bewildered as the agent asked: “Now what do you want to do about the purchases?”

“I don’t want NBA 2K16, and I don’t want to add $75 to my PlayStation account,” I said. It sounded simple enough, or so I thought.

The agent passed the buck. They explained that in order to issue a refund, I needed to cancel the dispute with PayPal. Essentially, PayPal had taken the money back from Sony, and I needed to have PayPal release it so Sony could hand it back to me.

So I contacted PayPal. This turned out to be a process in and of itself. Because the dispute was security related, I had to call PayPal support, verify my identity, and then say in no uncertain terms that I was closing the case permanently, and get a guarantee that PayPal wouldn’t reopen it.

I informed the Sony tech support agent once the dispute was canceled. I didn’t get a human response. Instead, I got a copied and pasted statement explaining that Sony doesn’t offer refunds, and the funds would only be returned to my wallet. I asked what would happen if I issued a chargeback at the debit card level, and the agent explained matter-of-factly that my account would be banned until I paid the $75 in fraudulent charges.

After six years as a paying PlayStation customer, my account was now being held hostage, not by a hacker, but by Sony. I had to cover the cost of the metaphorical broken window, or my account was going to be locked. Basically, I had to apologize and pay for a thief.

Why hasn’t Sony learned?

You would think Sony would know how to handle hacking, especially after its multiple massive breaches (this one and this one) in the last five years, but it hasn’t learned. The PlayStation network has been around since 2006, but there’s no two-factor authentication, and visible payment info on the web front-end. This leaves a wide enough security hole for an elephant to walk through. The customer service agent suggested that I only use prepaid cards, but that’s more of a workaround than a real solution.

If I disputed the charges, my account would be banned until I paid the fraudulent charges.

Sony has a history of poor responses to hacking. Back in 2011 when PlayStation Network went down for almost a month, the gaming brand offered affected players one month of PlayStation Plus, which meant you got a few games that were disabled after the month ended if you didn’t become a paying subscriber.

You could argue that the way it treated me is to avoid refunding purchases that people made accidentally (or drunkenly), but even if a few people take advantage of the system for an ill-gotten refund, at least they’ll stick with PlayStation. It also took me several hours of legwork over email, Twitter, and customer support to reach that point, which would be a lot of work to go through just to buy a different game.

We reached out to our press contact at PlayStation for comment, and this was the response:

After reviewing your inquiry, we found there was some miscommunication between our customer service agents on this case and we apologize for the inconvenience this may have caused. We are currently working on issuing a refund to your account, and we are addressing the communication issues.

Please be assured that there was no indication that your account was compromised through the PlayStation Network. We do recommend our users maintain good account security, such as regularly changing their password and creating login credentials that differ from other services they use.

I have to wonder whether I would have reached this point had I not pressed my advantage as a tech journalist. A number of readers have reached out about very similar situations, (one involving the same game less than an hour apart), and only some were lucky enough to receive an actual refund. That’s all despite the fact that PlayStation doesn’t offer refunds as a policy. If my account wasn’t compromised, why bend the rules?

The second half of the statement is a boilerplate response that separates Sony from any sort of liability regarding the incident. Allowing users to select a different login ID from email would help, as would two-factor authentication. These modern security methods aren’t hard to implement, nor are they uncommon in the gaming world.

As for me, I now have to decide whether I buy FIFA 16 on PS4 or PC. Right now, I’m not a big fan of Sony’s attitude or policies. It’s bad enough to be hacked, but it’s even worse to have to pay for the digital damage.

Updated on 4/14/16 by Brad Bourque: Added the official response from PlayStation.

The views expressed here are solely those of the author and do not reflect the beliefs of Digital Trends.

Mobile

Instagram tool accidentally exposes user passwords. Were you affected?

Instagram's Download Your Data tool accidentally exposed the passwords of a small number of users. Here is the explanation on what happened, and how to find out which Instagram accounts were compromised.
Mobile

Use multiple phone numbers on one device with Verizon’s ‘My Numbers’ app

For those who have separate phone numbers and devices for your work and personal lives, Verizon wants to help you get more organized. With its new "My Numbers" app, you can use up to four additional phone numbers on a single smartphone.
Computing

Latest SMS breach could allow hackers access to your online accounts

A new security breach that exposed more than 26 million text messages could be a huge nightmare for users relying on two-factor authentication. Many of the SMS on the database contained security codes and account reset links.
Apple

iPhone users are finding themselves randomly locked out of their Apple ID

According to posts on Reddit and Twitter, it looks like users on Reddit and Twitter having some issues with their Apple accounts. Specifically, it seems as though users are getting randomly locked out of their Apple IDs.
Gaming

‘Final Fantasy XIV: Shadowbringers’ to launch next summer with gunblades, Viera

Square Enix revealed that Final Fantasy XIV: Shadowbringers will be released in summer 2019. The third expansion of the MMORPG will include new story content, dungeons, and raids, in addition to gunblades and the Viera.
Gaming

The Fix PUBG campaign is over: What’s next for ‘PlayerUnknown’s Battlegrounds’?

The PlayerUnknown's Battlegrounds development team declared that the Fix PUBG campaign was over. Here are the results of the three-month campaign, as well as the future plans for the multiplayer Battle Royale shooter.
Emerging Tech

Awesome Tech You Can’t Buy Yet: A.I. selfie drones, ‘invisible’ wireless chargers

Check out our roundup of the best new crowdfunding projects and product announcements that hit the web this week. You may not be able to buy this stuff yet, but it sure is fun to gawk!
Deals

Cyber Monday 2018: When it takes place and where to find the best deals

Cyber Monday is still a ways off, but it's never too early to start planning ahead. With so many different deals to choose from during one of the biggest shopping holidays of the year, going in with a little know-how makes all the…
Gaming

Get an Xbox One S or PlayStation 4 for just $200 at GameStop starting Sunday

GameStop is currently running an early Black Friday sale that offers an Xbox One S or a PlayStation 4 slim model for just $200 apiece. Both consoles come with a free game, and other games are also on sale.
Gaming

Original ‘Diablo’ developer calls out Blizzard for disrespecting its employees

In a Twitch rant, an original creator of Diablo has said that Blizzard is more interested in caring for its shareholders and the elite one percent of the company than looking after its workers.
Gaming

These are the coolest games you can play on your Google Chrome browser right now

Not only is Google Chrome a fantastic web browser, it's also a versatile gaming platform that you can access from just about anywhere. Here are a few of our favorite titles for the platform.
Gaming

PlayStation 5 release date in 2020 confirmed? PSVR 2 also on the way

A Redditor who correctly claimed that Sony will be skipping E3 2019 revealed several details about the PlayStation 5 and the PSVR 2. The PlayStation 5 release date will be in 2020, while the PSVR 2 will ditch the breaker box.
Gaming

Triple nuke strike crashes ‘Fallout 76’ server, leaves unanswered questions

The group of Fallout 76 players who summoned the Scorchbeast Queen by dropping a nuke on a fissure site took the next step, launching three nukes on a single target. They did not find out what happens next, as the game's server crashed.
Deals

All the best Target Black Friday deals for 2018

The mega-retailer opens its doors to the most competitive shoppers at 6 p.m. on Thursday, November 22, and signs indicate that the retailer means business this year. We've sifted through all of the deals, from consumer electronics to small…