A game account can hold years of progress, rare items and a stored card. All of it trades for real money, which makes game platforms one of the most attacked logins on the internet, and their free rewards one of the most farmed.
What bots do to games
- Steal accounts. Leaked passwords are stuffed into the login; stolen accounts are stripped of items or sold whole.
- Create accounts by the thousand. Free-to-play sign-up rewards, referral bonuses and starter items are farmed and sold.
- Farm currency and items. Scripted clients and web APIs automate the grind.
- Test cards in the store. Small in-game purchases are a classic way to check stolen cards.
The signs
- Login failures in waves, across many accounts, each tried once or twice.
- New accounts in bursts from the same device or subnet, claiming the same reward.
- Accounts that log in, trade everything away and go quiet.
- Store purchases that fail, many cards per device.
Where to ask
Bot Protection judges the web side of a game: the account site, the launcher's web login, the store and the trading pages.
- Login: answer
bot_highas a wrong password; askbotfor a second factor. - Sign-up: create the account but hold its rewards until the email or phone is verified when the class is
bot. See stopping fake sign-ups. - Trades and the store: refuse
bot_high; add a delay or a confirmation forbot.
A player with months of real play and purchases is a person; report it as feedback and those accounts stop being questioned.