Hacker News Reader

Comment by xupybd | Hacker News Reader

I just attempted to sign up with Epic. Only my email address had already been signed up. I used the password reset and took over the account. No games just setup with a strange name and in Thailand. Now I can’t buy games because of the country. I can’t change country. Support wants a photo of my passport, that’s not happening, to change country.

I found an article showing many email addresses had been signed up in the same way. Epic was not validating email addresses.

They’ve lost my business.

View on HN

Yeah, I had the same issue, with the same name on the account. Somebody I know also had this issue, and after a few rounds of back and forth with support they managed to get the bogus account deleted, and I think their plan was to then create a new account. I was going to try logging in with my Google Account (which is the same email) but who knows if that will work or not. I think it is easier to just wait a year for exclusivity to expire. There's plenty of games out there to play.

Yeah I like competition in the market and would like to help Epic out but the way they're handling this is so poor.

Satisfactory is the game I wanted to buy but it's not worth it for me to send a photo of my passport to anyone. They fail to validate email addresses then I'm supposed to trust them with data that identifies me and could be used to steal my identity, no thanks.

I just discovered that I am effected by this. I might have been interested in checking out epic games store. I am utterly disinterested in uploading a passport/id or other personal data to prove I'm not from Thailand.

Seeing as the accounts seem to share the same fake name. Ican Icanaw I suggest purging all such accounts and making people actually confirm email addresses before using them as identifiers like adults.

This is a junior high level mistake. So basic and so bad I no longer think anyone should trust Epic to have access to credit card info.

Can you just delete the fake account and create a new one on your email address?

I had to do that when someone created a samsung account in my name and I couldn't change the country/language of it.

What is the incentive for people to pretend they own those email addresses?

No idea the only feasible possibility I've come up is to damage Epics customer relations. I don't know maybe it was just some idiot with a list of emails and script but no real game plan.

Here is the an article discussing others with the same issue https://twinfinite.net/2019/03/psa-epic-store-doesnt-validat...

Here is the last email I got from Epic:

Jan E. March 15, 2019, 11:39 +1300 | Conversation ID: #9950515 Hi (Player's Name),

Thanks for the information!

I know how important it is for you to update and change your country to your Epic account. No worries, I got your back and I'll do my very best to assist you with your request. Additionally, I know how frustrating it can be. Please know that here at Epic Games, we are serious about the player's security and we assure you that your email address is secured as long as you keep the password updated or enable 2FA.

In order to change the country on your account I will need you to reply with an image of one of the following items with your name and address visible:

Passport Personal identification *Recent rent or mortgage statement

Any other personal information should be blacked out.

I'll be looking forward to hearing from you soon.

Canned response hell. So helpful it isn't.

"No worries, I got your back - here's a canned response!"

That is by a considerable margin the most patronising, "how are you fellow kids" canned response I've ever seen.

Are you required to prove your Country on sign up? I think not. So why all of the rigmarole to change it? I'm guess for legal reasons.

It's because games can be cheaper in countries where the economy is weaker. $60 in USA is a standard price, but that's outrageous in Thailand, and here Epic might charge the equivalent of $30. They do not want people shopping around for the cheapest country to purchase games from.

A passport is somewhat ridiculous, as is the lack of initial email verification, of course.

Probably either Denial of Service or hoping a way to make money off it became available later.

Epic can report huge user growth numbers in the hot and growing Asian market to their investors.

Ah, the Twitch model -- where half of its users are spambots and the other half are viewbots.

Edit: I am effected by this issue. I am of course not dumb enough to add a credit card to the account.

If they allow you to log on in via a third party authentication like log in via google account or log in via facebook etc I foresee a flow like this.

Create a bunch of fake accounts attached to various emails.

For each account periodically check to see if a new method of payment is attached to the account. When one is immediately buy a bunch of gifts for other users that will be sold through some side channel like facebook/whatsapp/what have you. Example make a post on any sort of forum say message me to buy a copy of $40 game only $10 for the first 5 users to message me. For each user that pays buy a game and send the legit code for the game. This trust will keep you from being taken down immediately or perhaps even at all if the user doesn't notice the losses.

This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. Virtually no services allow more than one account with the same email address its the unique key that defines the account.

As soon as they create the account the first thing they do is buy a game because most new users installed so they could buy a game from epic. They check whatever box is required to save their method of payment.

You now have an account that can be accessed via oauth via the users preferred provider and the hackers chosen password + victims email address with a saved payment method the hacker cannot access directly but can spend and monetize via side channel.

> This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account.

For that to work the service would have to allow a login with email/password without verification, and then also allow oauth login to the same account.

They obviously allow account creation without verifying that user controls the email address in the first place so the second isn't much of a stretch. They are grossly incompetent.

Same here. Some guy in Thailand. Weird!

There are loads of people that got hit by this https://twitter.com/catahstrophic/status/1098657650575732736

This is why I use specific throwaway emails for tasks like this. Has the nice effect to keep spam confined and trackable to the service you registered to.

While it's probably not relevant anymore since you don't want deal with them, if you are in Europe, you should be able to require that they fix the information due to GDPR. Refusal to fix information must be based on law and I while IANAL, I don't think there's a law that would require them to request passport copy to fix the country. https://tietosuoja.fi/en/if-you-want-to-have-your-data-recti...

Interestingly enough I sent a Request For Correction to a company which manages a conference in Berlin.

Their response was, in summary, "thanks for your request, we need a full copy of your passport, driving licence and a recent utility bill to correct your records".

I can open a bank account with less information!

Usually this is abusive, and can be fought. Yet many companies are using this as a roadblock to slow down data requests.

Reply on news.ycombinator.com