Are Criminals Playing Games with Us?

We all like to kill a goblin or two online, but most people would agree multiplayer games are not the place for real-world crime. With lockdowns continuing around the globe and people staying at home, it is no wonder that the popularity of online gaming has skyrocketed. And as in-game economies flourish, it has not taken criminals long to discover the appeal of virtual worlds.

Flourishing Business

The full scale of online gaming is difficult to determine, given the vast array of games available, but it is clear that interest has increased rapidly over the past few months. Verizon CEO Hans Vestberg reported that gaming internet traffic increased by 75% in the week between 15 March, when the US began announcing home lockdown restrictions, and 19 March. Twitch, the most popular video game streaming platform, saw their average activity double in April, with 1.49 billion gaming hours watched. Steam, a leading video game distribution platform, hit a peak of 20 million concurrent online users across all games on 16 March, then immediately broke that record six days later with 21 million users, and again one day later with 22 million users online.

Epic Games, the developer of Fortnite, has used this period to test out the functionality of large-scale events happening in-game, rather than in-person. Marshmello, Travis Scott, and Diplo all recently held concerts within Fortnite, performing live with their avatar synced to match the songs. Marshmello’s set drew 10.7 million attendees, while Travis Scott’s two-day tour had a staggering 27.7 million attendees. Following his performances, Travis Scott launched new merchandise both in-game and in reality – fans wanting his complete collection in Fortnite would be spending 3,600 V-Bucks, or almost $35.

While most casual gamers will likely stick to trading items in-game, either between players or with the official stores, this Fortnite exchange rate between V-Bucks and US Dollars shows how some in-game items are in demand among buyers and have a quantifiable real-world value.

Another online game which has become increasingly popular is Animal Crossing: New Horizons (AC:NH). AC:NH has been something of a phenomenon since its release on 20 March 2020. In March, Nintendo sold more units of the Switch console (the only platform that runs AC:NH) in one month than any other platform in a decade. AC:NH has already, within two months of its release, outsold every previous Animal Crossing game’s total sales. Companies have chosen to hold meetings in the game when they wanted a break from Zoom. Professors have simulated classrooms for students to take exams.

While at first sight AC:NH is a simple game wherein the player designs an island and interacts with their animal neighbours, it boasts a sophisticated economy and involves frequent interactions between players. Celebrities have even dropped into islands created by their fans to conduct in-game transactions. Online message boards have popped up to facilitate AC:NH transactions, as well as equivalents to an in-game Amazon in order to purchase luxury items from other players. This has also expanded to include the purchasing of popular but rare islanders – Raymond the cat, for example, is consistently the most sought-after character, with people offering all sorts of trades to secure him, including fiat currency. Similarly, characters who have appeared previously, such as Marshal the squirrel, can go for up to $100 on eBay.

The Darker Side

While this and other games bring joy to home-bound players, some virtual worlds also have a darker side to them. Like many other successful industries, as they continue to attract gamers and their money, the criminal opportunities they offer become ever more apparent.

Traditionally, concerns about crime in online games centred around their use as platforms of communication or self-expression. Those range from depicting swastikas to sexual behaviour involving children – or, more complicated still, adults roleplaying as children – to conversations between terror suspects in game chats.

With increasing frequency, however, news reports of criminal exploitation of online games have a financial flair to them. In the last month alone, headlines around the world featured an eclectic collection of game-related financial wrongdoing:

• Theft of personal data. In early May, a hacker gained control over the internal support panel of the online game Roblox, which enabled them to access users’ personal information and distribute its in-game currency, Robux. In this instance, it is reported that the perpetrator sought recognition rather than financial benefit, but personal data is a valuable commodity in the criminal world. A case in point is the ongoing dispute between a Fortnite player and Epic Games over a 2019 data breach that has now been sent to arbitration. In another development, the police of Dubai warned of poor data protection practices in certain free-to-play games.
   
• Game-related gambling and corruption. Also in May this year, it was reported that five men were charged in Australia over match-fixing related to an e-sports tournament. While allegations of game-related corruption are unusual but not unheard of, the worlds of online games and gambling – the latter of which is heavily regulated or even prohibited in some jurisdictions – have overlapped for quite some time. Governments of countries including the UK, US, Australia, Belgium, France and the Netherlands have considered whether purchase of ‘loot boxes’, a random assemblage of in-game artifacts of varying value, qualifies as gambling and so triggers attendant regulation.
   
• Use of stolen cards. As we discussed in an earlier publication, there are documented instances of cybercriminals purchasing in-game items using stolen bank card details and reselling them on third-party marketplaces. This affects multiple games including Fortnite, various free-to-play mobile apps and – most recently – Counter-Strike: Global Offensive, whose developer Valve disabled the option of reselling in-game items after observing that ‘nearly all key purchases that end up being traded or sold on the [game’s official] marketplace are believed to be fraud-sourced’.

What all of this tells us is not that games have turned into crime-infested virtual dens, but simply that, like in many other industries, criminal risks are not marginal or uncommon. They need to be acknowledged and addressed.

Responses to those risks differ sector-by-sector. Financial and certain other businesses are subject to anti-money laundering regulation. Other sectors, like social media companies, are lightly regulated but nonetheless expected to take down harmful content in a narrowly defined range of circumstances.

Game developers too should be a reliable partner for law enforcement agencies, if not by virtue of regulation then as part of good corporate citizenship. That said, they have the financial wherewithal of neither banks nor tech giants, and the risks games pose appear to be of lesser magnitude.

With that in mind, it is essential for governments to clarify what is expected of game developers as best practice, and then work in partnership to mitigate criminal risks – a game that is only now beginning.

The views expressed in this Commentary are the authors', and do not represent those of RUSI or any other institution.