How the NCWest's anti-cheat department works

[Urud-DN]

 

On 20/2/2018 at 10:57 PM, Cyan said:

we do still want you to contact our Customer Support team so we can track your issue and work with you to try to find potential issues

 

On 21/2/2018 at 6:43 PM, Cyan said:

We can't answer every question on what's allowed and what's not allowed

 

On 22/2/2018 at 7:02 PM, Gideon said:

we want to make absolutely certain that innocent players will be affected as little as possible when we take the next step.

 

Sorry, I tried to resist some months, but after this garbage I can't hold it anymore. I'm sorry.

TL:DR: This is a raging post by one of those innocent players who have been banned (and then unbanned) without any evidence. If you think "yeah sure, every guilty person says I'm innocent" and that no one can be banned for no reason, then you can stop reading here.

Long version:

I stopped playing Aion when they introduced the Petra medals, more or less. Since then, I kept loggin' in every 30-40 days (not always with my main account) to check if everything was going well and to only chat with my legion mates (the few who didn't move to other games; with the others we use discord). Last time I logged-in during the Homeward bound event. I found some very kind mails on my main, from my legion mates, who sent me some gift, cookies, and asked me to come back to Aion. I had no intention, but I felt sorry for leaving them, so I decided to post a legion ad to recruit some new players, since the previous ad on the old forum was very successful, with more than 8k views.

But the next day, when I tried to log-in into the forum, I discovered that my account was locked. Here it's how it went:

---

Hi,

today I decided to log-in on the forum, after 5-6 months, but I got the following message:

Due to suspicious activity, this account has been locked.
Please contact support at appeal@ncsoft.com mailto:appeal@ncsoft.com .

Could I have some more detailed info please?

Best regards

Urud

---

Hello,

I would be happy to assist you with your concern. However before we proceed, we would need to verify your account first. Please provide as much of the below information as possible.

• List all possible emails that you would have used on the NC Account.
• Billing information: If activated using a credit/debit card, please provide the last 4 digits of the credit card used ONLY. If activated using PayPal®, please provide the Transaction ID or the Invoice ID associated with the original activation purchase. If you have an Order ID number from a previous purchase on your NC Account, please provide that as well.
• Provide location (City and Country) at the time of account creation.
• What date of birth did you use when you created the account?

If the information you provided is not sufficient, we will be requesting for additional information in order to investigate your issue further.

I look forward to your reply.

Cheers,

Xia
NCSOFT Support Team

---

[...] I listed my other accounts and answered to the other questions, althought I didn't remember almost anything, after 4 years. But in the end, I copy/pasted the receipt of my last NCCoins purchase... and I've been unbanned!

---

We reviewed the case and while the sanction is consistent with our policies, we are offering a Final Warning. Repeated behavior may result in closure without appeal. This includes the presence of software discussed below even if it is not actively used.

Registered users are held responsible for unauthorized access and bad behavior; http://us.ncsoft.com/en/playsmart/ has account protection tips.

Account Name: XXX
Offense: 3rd party software
Sanction: Closure overturned to Final Warning

We prohibit use or possession of software that can be used with a game client, which enables:
automated gameplay - unattended or attended gameplay where decisions are made or actions taken for the user;
exploitation - abuse of bugs or unintended gameplay to gain benefits beyond what it intended for all users; or
software modification - altering the client or altering or monitoring communication between the client and server, including cosmetic changes only visible to the user.

Regards,

Precious
NCSOFT Support Team

---

Hi,

can you tell me please which 3rd software are you talking about? I honestly don't know what you are referring too, so I wouldn't be able to uninstall the software you mentioned. I've been inactive for more than 1 month, so idk which software could trigger this suspicious activity. And I didn't use any 3rd software during my gameplay. In fact, if you can read the log, you'll see that I didn't even kill a single mob or player. I only logged-in to chat with my legion mates. And I paid with a 5-days ban.

Please let me know which software triggered this warning, so I can scan my system before logging-in again.

Thanks

---

We can understand your interest in learning more about our investigation. However, security concerns prevent us from releasing detailed information about our tools or detection methods. The info provided earlier is all we can share with you. Please rest assured that our only goal is to create a safe and fair play environment for the entire community. We appreciate your understanding in this matter.

Regards,

Yiar
NCSOFT Support Team

---

Hello,

you don't have my understanding, sorry. I don't want to know what tool you used or your detection methods. I want to know why you accused me, as I don't want to be accused of cheating. I don't have and I never used 3rd party software to cheat (in fact, the huge amount of cheaters in your game is one of the reason why I don't play it aymore).

I understand that some false positive can happen: years ago I couldn't play Echo of Soul because their anti-cheat filter recognized my gaming mouse as hacking software. But they listed the process that made me unable to launch the game, so I understood the problem.

You, on the other hand, just banned me without any evidence and without providing any info about what you found of suspicious on my PC. If I had some 3rd party software active, you had to ban also my second account, as I used both accounts that day. But only my main account has been tracked for suspicious activity.

And again, I remained for all the time in Pandaemonium, claiming my cards from the Joker, my returning user bundles (the only thing that I didn't do on my second account) and chatting with my legion mates, for all the time. I didn't do any instance, luna included. And I didn't used a single skill that day. What did you find?

If there's something that triggers your attention and you don't make me aware of it, I'd be banned again as soon as I log-in next time.

Cheers

Urud

---

As what we have said previously, we cannot provide any information regarding the investigation made and we can only advise that you refrain from using any third-party program while playing to avoid this kind of issues in the future.

Thank you for understanding.

Regards,

Jack
NCSOFT Support Team

---

and again, you don't have my understanding.

• I used several accounts within few minutes, most of them in dual-boxing. And you only banned 1 of them (the only one who claimed the unbound bundles). If I had some 3rd party software active, your "tools" should have detected many other accounts.
• I remained for 2-3 hours in Pandemonium, all the time, without challenging in duel anyone, without killing a single mob or doing a single instance (not even the luna) and I didn't use a single skill. I only claimed an event bundle and used the legion chat all the day. Read the log.
• Why did you ask if I was the real owner of the account? First or second hand owner doesn't matter: if I'm really a cheater, I should be perma-banned, period.
• You unbanned me after that I sent you the receipt of my last NCcoin purchase. Would you have done the same if I never bought anything from your shop?

No one from my legion mates knew about this accident, and yet I'm posting here with my main account, despite I've been "forgiven", 'cause I'm 100% sure that you were wrong. You are in the US, not in some unforgiven country with a dictatorship, where the government can accuse someone without any evidence and they have to prove to be innocent. If you want to ban someone, you should provide some evidence.

There are players on this forum that have better manners and probably even more experience than your employees. You shouldn't even organize family meetings. I understand that you don't want to ban heavy cheaters because they also give you a lot of money, but banning random players to give to your anti-cheaters department a reason to be alive and save your working position it's not a good way.

I won't be here to play Aion 6.0, Aion 10.0 or any other possible NCSoft game, so I don't care if you ban me again for posting here. A game could change and don't meet anymore your tastes, but when it's the Company that fail, there's not a second chance.

[Aly-DN]

From the initial interaction with Support, it sounds like they thought someone else had been using your account. I had the same thing happen to me when I left just prior to 2.0 and came back for 3.0. My account had been stolen and had been closed due to suspicious activity. (It had been used to bot.) I gave them the information and they reopened the account. So the first part sounds exactly the same. 

The second part is a little fuzzy. 

What I think they think happened is that someone else used your account and used 3rd party with it. (Just the one account and not any of the others.) The account was banned. You write to ask why it was banned. They make sure you are you. (Asking you about your last NCoin purchase is just a way to figure out if you are the real account owner.) They unban the account but inform you that you are responsible for 3rd party even it's used when someone else is using your account. That's why you got the final warning thing.

When someone gets banned, they are told a general category and nothing else. 

I am not saying that any of this is true. It's just my take after playing this game for so freaking long. Dealing with Support is often like reading code.

[Urud-DN]

Thanks for reading that long post and sharing your experience, Aly.

It might be as you say, I didn't think about it. It just seems unlikely that someone stole my account (only for one day - I didn't change the password after that, even now) and exactly the same day that I logged-in after almost 2 months of inactivity. It may be, but I doubt it.

Still, if someone used my account, it would be nice to have some more info from NCWest. For example what process they found and at what time.

[Cheesecake-DN]

Were you on a yahoo account by chance? Lots of accounts got stolen that were on yahoo emails. And if you really weren't third-party-partying, then they could have made a mistake, or someone got on your account and botted (really one of the few they can easily prove third-party on).

But, yeah, Support is shit-tier in this game (and I nearly guarantee you, by the Engrish responses I've gotten, it's outsourced). The only game I had worse in was ArcheAge (though FFXIV's Support was really crappy, too...).

[Urud-DN]

Hmm, no, I'm not using a yahoo email. I remember time ago about that amount of stolen accounts. I use a minor/local email service. But I don't think anyone else used my account. The odds that someone used it exactly the same day that I came back to the game, after some months, and then never again, are quite low. Also, there were several billions of kinah on that account (idk how many I had before, but if someone really stole my account, I don't think that I'd still have them). More likely some false positive. But without any info, it's hard to tell what triggered the warning.

I just don't want to play with this sword of Damocles on my head. I don't feel comfortable. Anyway, ty Cheesecake.