Thursday, November 28, 2019

In-game virtual items as a form of criminal money


A few weeks back Vice had an interesting story about Valve, a game maker, putting an end to trade in various in-game items because "worldwide fraud networks" had been using these items to "liquidate" their gains. You can see the blog post from Valve here:
"Why make this change? In the past, most key trades we observed were between legitimate customers. However, worldwide fraud networks have recently shifted to using CS:GO keys to liquidate their gains. At this point, nearly all key purchases that end up being traded or sold on the marketplace are believed to be fraud-sourced."
Having not played a video game since the original Super Mario Bros, this all sounded all very strange to me. But I couldn't resist digging a little deeper. After all, strange media-of-exchange are a major theme here on the Moneyness blog.

Let's set the stage. Anyone who plays Valve games can access something called the Steam Community Market. Players can go to this market to buy and sell in-game items from each other. So for instance, a Counter-Strike: Global Offensive game player may want to buy (or sell) a "skin" which is a texture that can make their gun look fancier. Some skins are apparently quite rare and valuable.

To make a purchase, players will need to have some funds in their Steam Market wallet. Wallets can be funded by credit card or a gift card. The catch is that once funds are on Steam, they cannot be directly transferred to other players. I can't send $100 in Steam balances directly from my Steam wallet to my friend's Steam wallet. Funds can only be used to buy items from other players. Furthermore, there is no way to cash-out of the system. Once money is deposited into Steam, it never leaves.

Now let's get to the fraud stuff, and we'll circle back to Steam later. Say that I'm a fraudster. My shtick is to dial up corner stores, claim that there is a bomb hidden in one of the aisles, and ask for a ransom of $5000 or I will set it off. The store owner has 30 minutes buy five $1000 MoneyPaks, then text me their PIN numbers. Upon which I quickly load the funds into my reloadable Green Dot prepaid debit card, the bomb being a hoax. (I kid you not, this is a true story).

Below is another variation of the scheme, the fraudster claiming to be law enforcement:

There are many versions of these prepaid scams.

In any case, say I pull this threat off fifty times. This leaves me with $250,000 and a pile of prepaid cards. The Green Dot cards aren't linked to my identity, so I needn't worry. But I really want to do something with my money, say buy a house. To do so I will somehow have to get the $250,000 into my bank account, and probably quickly before the money gets frozen. How do I do this safely? Obviously I can't just directly transfer the money from my card to my account. The authorities will connect the dots pretty quick and arrest me. I need to obfuscate the transaction chain.

And that's presumably where Valve's Steam Community Market comes in. If I can send the stolen funds through a market like Steam, maybe I can throw off anyone who comes after me.

First, I go to as many drug stores as I can and use my prepaid cards to buy up Steam gift cards. I'd have to buy around 500 or so $500 cards. And then I upload the $250,000 in card value to a bunch of online Steam accounts that I've created.

Remember, Valve doesn't allow for cash-outs, so the money is effectively frozen in Steam. This is where the items listed on the Steam Market come into play. I now buy $250,000 worth of skins or some other digital knick-knack. These items are now my get-out-of-jail card.

I proceed to sell the items I've stockpiled to other players who desire them for legitimate in-game use. The important thing here is to get actual dollars in return, not Steam dollars. I won't use Steam's in-game market for this, but third-party venues like OPSkins, Bitskins, or Skins.cash. Each of these sites provides an external trading venue where buyers and sellers of in-game items can meet and advertise prices. They also offer a wallet and escrow service to ensure neither buyer nor seller scams the other.

Since I'm in a rush to sell my virtual items, I'll probably lowball my prices on OPSkins, which means I may only get $150,000 for the original $250,000 I've spent. This is a great deal for regular game players. They don't have to fund a Steam account with, say, a $100 credit card transfer. Instead they can buy items from me for $70 on OPSkins and sell them on Steam for $100, saving themselves $30!

I then have OPSkins wire the $150,000 I've earned to my genuine bank account. And now I buy a house. Voila, I've hidden the source of the my money by running it through Steam. Somewhere between converting my prepaid funds into Steam gift cards, and then buying digital items with them, and then selling them, a would-be law enforcement agent will likely lose my scent.

Now that's roughly what I think that Valve is talking about in its blog post when it talks about "fraud networks", add or subtract a few steps. I wouldn't know, I'm just a writer.

What about Valve's response to the fraudsters? From what I gather, one of the most liquid items on the Steam Market are Counter-Strike: Global Offensive (CS:GO) keys. The price of keys is quite stable. Valve sells them at a fixed price, whereas the price of other goods are set by the Steam community, and fluctuate. And so keys have become a sort of currency. By adopting keys as their exit route, fraudsters would have made them even more liquid, and thus better capable of serving as a medium of exchange.  

Valve's defence is to freeze keys. "Starting today, CS:GO container keys purchased in-game can no longer leave the purchasing account," it said. This effectively cuts off any fraudster from existing the system... via the key route. However, there remain many other CS:GO items that folks can buy on Steam and sell on third-party exchanges like OPSkins. And there are other games that provide in-game items, like Dota 2 and Team Fortress 2. One wonders if some other item will become a go-to digital currency for fraudsters now that the CS:GO key route has been terminated. On Reddit, a few players speculate that Dota 2 Arcanas will take the place of CS:GO keys.

Usage of in-game virtual items as a bridge currency of sorts isn't without precedent. When conditions are right, instruments that we don't traditionally use as money, like CS:GO keys, get recruited for that purpose. Usually this occurs because there is some sort of hurdle or friction that prevents mainstream media-of-exchange from functioning, and only an exotic instrument can overcome that speed bump.

Equities are one of the more common exotic media-of-exchange. For instance, to avoid exchange controls Zimbabweans have traded in the inter-listed shares of Old Mutual, lifting them from the Zimbabwe Stock Exchange to London. Argentinians used American Depository Receipts in 2001 to dodge the "corralito". I wrote about both of these here.

More recently, gold was recruited as a payments rail for evading Obama's sanctions.

Heck, even I'm guilty. In Canada, retail foreign exchange conversion fees are ridiculously high thanks in part to our banking oligopoly. So I use Norbert's Gambit to get around the blockade. The gambit involves using dual-listed stocks or ETFs as a bridging asset between U.S. dollars and Canadian dollars. Debit card fraudsters are doing the same when they use CS:GO keys as a go-between asset for cleaning their money.

The desire to engage in trade is voracious. Blockades may be put up, but people will devise all sorts of ingenious monetary solutions for getting around them.

2 comments:

  1. How are the third party trading websites not shut down? If these are being used to liquidate gains, wouldn't it be obvious which amounts are so extreme they should be investigated? Seems if gaming websites are figuring this out, we need more intervention from bigger sources.

    ReplyDelete
    Replies
    1. Part of the complication is that there is a lot of legitimate trade that is being done on these third party trading websites. Also, if you shut them down, the prepaid scammers will just find another route to clean their money, say like selling gift cards directly on message boards.

      Delete