After hackers ran up a bill on my PlayStation account, Sony held it ransom

Sony PS4 Controller
Getting my PlayStation account hacked was terrible, but Sony made it a whole lot worse.

Instead of helping me, Sony decided that I had to pay for the games that my hacker purchased, or face a permanent ban on my account.

It all started Saturday afternoon. I was scrolling through my inbox and noticed some odd emails from PlayStation, all of them at 3:01 AM. There were three $25 payments to my PlayStation wallet, and a purchase for NBA 2K16 and some credits. After checking to make sure my roommate hadn’t drunkenly purchased the game, thinking he’d pay me back later, I noticed even more concerning emails.

While I was sleeping, someone locked me out of my own account.

The first asked me to confirm a change to my PlayStation account’s email. The email wasn’t opened, nor had any odd devices accessed my email account, but another message less than a minute later confirmed the email change. Yep. While I was sleeping, someone locked me out of my own account.

But PlayStation requires you to confirm an email change by clicking a link in an email sent to the old account first, right? Wrong.

As it turns out, hackers have an easy way around this problem. Payment info, or at least a portion of it, is visible in the web interface for a PlayStation account. Once an attacker has your password, they can chat with Sony tech support, explain that they don’t have access to that email anymore, and use the visible info in the account to verify their identity, changing the email on the account to prevent recovery by its rightful owner — in this case, me.

In the meantime, they added a device to my account, a PS Vita. Unlike a PS3 or PS4, a PS Vita can’t be removed from the account by Web, it can only be deactivated from the device itself.

Fortunately, social hacking your way through tech support tends to be a double-edged sword, and I knew I would be able to wrestle my account back by providing the right info. Both consoles that regularly access the account are in my home, so that’s a form of proof, and because Sony doesn’t let users change their user names, no email changes could alter my gamertag.

Following the paper trail

This all happened on a Sunday, so Sony’s phone support wasn’t open, and I was forced to use the text chat. This actually ended up working to my benefit, as we’ll see shortly, but it also raises some problems of its own.

I wasn’t at home when I noticed the hacker’s activities, but I needed to stop the intruder from making any more purchases. I called PayPal support, and an agent there was quick to de-authorize my PlayStation account from making any more pre-approved purchases. Then, I filed a dispute on all three $25 charges.

I don’t own a PS Vita, but it’s stuck on my account

Once I got home, I sat down at a computer and fired up Sony’s chat support. At first, the agent was helpful. The intrusion and email changing were a separate issue from the disputed purchases, so we would deal with them one at a time.

The agent rolled back the account’s email to the previous address (mine), and forced a password reset when I confirmed the change. Then I was a little bewildered as the agent asked: “Now what do you want to do about the purchases?”

“I don’t want NBA 2K16, and I don’t want to add $75 to my PlayStation account,” I said. It sounded simple enough, or so I thought.

The agent passed the buck. They explained that in order to issue a refund, I needed to cancel the dispute with PayPal. Essentially, PayPal had taken the money back from Sony, and I needed to have PayPal release it so Sony could hand it back to me.

So I contacted PayPal. This turned out to be a process in and of itself. Because the dispute was security related, I had to call PayPal support, verify my identity, and then say in no uncertain terms that I was closing the case permanently, and get a guarantee that PayPal wouldn’t reopen it.

I informed the Sony tech support agent once the dispute was canceled. I didn’t get a human response. Instead, I got a copied and pasted statement explaining that Sony doesn’t offer refunds, and the funds would only be returned to my wallet. I asked what would happen if I issued a chargeback at the debit card level, and the agent explained matter-of-factly that my account would be banned until I paid the $75 in fraudulent charges.

After six years as a paying PlayStation customer, my account was now being held hostage, not by a hacker, but by Sony. I had to cover the cost of the metaphorical broken window, or my account was going to be locked. Basically, I had to apologize and pay for a thief.

Why hasn’t Sony learned?

You would think Sony would know how to handle hacking, especially after its multiple massive breaches (this one and this one) in the last five years, but it hasn’t learned. The PlayStation network has been around since 2006, but there’s no two-factor authentication, and visible payment info on the web front-end. This leaves a wide enough security hole for an elephant to walk through. The customer service agent suggested that I only use prepaid cards, but that’s more of a workaround than a real solution.

If I disputed the charges, my account would be banned until I paid the fraudulent charges.

Sony has a history of poor responses to hacking. Back in 2011 when PlayStation Network went down for almost a month, the gaming brand offered affected players one month of PlayStation Plus, which meant you got a few games that were disabled after the month ended if you didn’t become a paying subscriber.

You could argue that the way it treated me is to avoid refunding purchases that people made accidentally (or drunkenly), but even if a few people take advantage of the system for an ill-gotten refund, at least they’ll stick with PlayStation. It also took me several hours of legwork over email, Twitter, and customer support to reach that point, which would be a lot of work to go through just to buy a different game.

We reached out to our press contact at PlayStation for comment, and this was the response:

After reviewing your inquiry, we found there was some miscommunication between our customer service agents on this case and we apologize for the inconvenience this may have caused. We are currently working on issuing a refund to your account, and we are addressing the communication issues.

Please be assured that there was no indication that your account was compromised through the PlayStation Network. We do recommend our users maintain good account security, such as regularly changing their password and creating login credentials that differ from other services they use.

I have to wonder whether I would have reached this point had I not pressed my advantage as a tech journalist. A number of readers have reached out about very similar situations, (one involving the same game less than an hour apart), and only some were lucky enough to receive an actual refund. That’s all despite the fact that PlayStation doesn’t offer refunds as a policy. If my account wasn’t compromised, why bend the rules?

The second half of the statement is a boilerplate response that separates Sony from any sort of liability regarding the incident. Allowing users to select a different login ID from email would help, as would two-factor authentication. These modern security methods aren’t hard to implement, nor are they uncommon in the gaming world.

As for me, I now have to decide whether I buy FIFA 16 on PS4 or PC. Right now, I’m not a big fan of Sony’s attitude or policies. It’s bad enough to be hacked, but it’s even worse to have to pay for the digital damage.

Updated on 4/14/16 by Brad Bourque: Added the official response from PlayStation.

The views expressed here are solely those of the author and do not reflect the beliefs of Digital Trends.

Product Review

Anybody seen my grenades? ‘Battlefield V’ shows up late and unprepared

Battlefield V’s War Stories give us a new perspective on World War II, but the game’s lack of polish across both its campaign and multiplayer modes are almost impossible to ignore.

Owners of ROM sites ordered to pay Nintendo more than $12 million

An federal court judge in Arizona has awarded Nintendo more than $12 million in damages in its lawsuit with the owners of two popular ROM websites. The sites must also be transferred to Nintendo's control.
Home Theater

PlayStation Vue adds more local channels, bringing the total to over 600

PlayStation Vue is Sony's answer to live TV without the need for a cable or satellite TV subscription. To help you understand the service, its plans, and numerous features, we've created this handy guide.

Flickr just expanded Pro tools — but free users may have to delete some photos

If you have more than 1,000 photos on a free Flickr account, you might want to decide which to delete . Flickr announced some changes following an acquisition by SmugMug, including a new way to calculate the free account storage limit.

Platinum that game by learning all there is to know about PS4 trophies

The PlayStation 4 rewards you with trophies for your achievements in various games. Here's what you need to know about PS4 trophies, including how to earn them and the different trophy levels.

The best cheap-but-awesome PS4 game deals under $20

The PlayStation 4 has hit its stride in recent years and is now more affordable than ever. If you have a PS4 or are thinking of buying one, we’ve collected some must-have games. The best part? Each of these is just $20 or less.

‘Final Fantasy XV’ mod remembers the RPG’s canceled DLC and features

A Final Fantasy XV mod pays homage to the content canceled by Square Enix. Episodes Aranea, Luna, and Noctis will no longer happen, while the promised level-building tool and Mod Organizer improvements for the PC version were also shelved.

Black Friday 2018: The best deals so far

Black Friday is the biggest shopping holiday of the year, and it will be here before you know it. If you can't wait until November 23 to start formulating a shopping plan, we've got you covered.

Feeling nostalgic? Here are the 25 best Sega Genesis games

Although the company has since fallen into obscurity, Sega was an indisputable titan throughout the '90s. That said, here are 25 best Sega Genesis games that helped define its fabled decade.

‘PlayerUnknown’s Battlegrounds’ parachutes onto PlayStation 4 on December 7

Following months of speculation, PUBG Corp. has announced that PUBG is coming to PS4 on December 7. The PS4 version includes all three maps and major features, and you can get some PlayStation-themed apparel items by pre-ordering.

Struggling to survive 'Battlefield 5?' Our boot camp will keep you in the fight

Battlefield V's multiplayer component can be overwhelming, but you can succeed against the enemy with a little help. These are the tips and tricks you need to know to win in Battlefield V.

What games were nominated for the The Game Awards 2018? Find out here

The Game Awards returns to Los Angeles for its fifth show this December. Here is everything we know about the event, including its location, where you can watch it, and games that were nominated.

How to Install an SSD in a PlayStation 4 or PS4 Pro

SSDs are much faster than mechanical hard drives, which is what the PlayStation 4 and PlayStation 4 Pro come with. Here, we show you how to replace it with an SSD, which will allow you to boot to the OS faster and load games quicker.

Faction-based PvP, new Vault openings coming to ‘Fallout 76’ after launch

Bethesda is already hard at work on post-launch content for Fallout 76, which launches November 14 on PS4, Xbox One, and PC. Faction-based PvP is in the works, and new vaults will open over time.