The online newspaper revealed the scale of the money laundering operations when it looked into online black markets selling V-bucks – the game’s form of virtual currency used to buy outfits, weapons, or other items available through in-app purchase.
According to the report, criminals use stolen credit card details to purchase V-bucks from the official Fortnite store. They then resell the virtual cash at a discounted rate online, effectively legitimizing the ill-gotten gains in the process.
The discounted V-bucks are sold in bulk on the dark web, as well as in smaller quantities on the open internet through advertisements on Instagram and Twitter, the investigation found using research from the cyber security firm Sixgill.
By posing as potential customers, Sixgill agents uncovered Fortnite money laundering operations around the globe being conducted in Chinese, Russian, Spanish, Arabic, and English.
“Criminals are executing carding fraud and getting money in and out of the Fortnite system with relative impunity,” Benjamin Preminger, a senior intelligence analyst at Sixgill, told the newspaper.
With more than 200 million players globally, Fortnite generated US$3 billion in profit last year for its developer Epic Games.
The multiplayer battle royale game is available on every major gaming platform and is free to play upfront. Its sole source of revenue comes from non-essential in-game purchases, including various animated dance moves that are at the center of a series of copyright lawsuits.
While individual transactions cost only a few dollars, they cumulatively pull in an estimated $300 million a month.
In 2018, separate research by IT security firm Zerofox found over 53,000 instances of Fortnite-related fraud in a one month period. Of those scams, 86 percent were shared via social media platforms like Facebook, Twitter, and Instagram.
The Independent says it’s unclear how much profit criminals make though V-buck money laundering schemes, though Sixgill found Fortnite items grossed more than $250,000 on eBay in a 60 day period.
“Threat actors [a malicious person or entity] are scoffing at Epic Games’ weak security measures, saying that the company doesn’t seem to care about players defrauding the system and purchasing discounted V-bucks,” Preminger told the newspaper.
“This directly touches on the ability of threat actors to launder money through the game.”
Fortnite isn’t the first free-to-play game whose digital currency has purportedly been used to launder money from stolen credit cards. In July 2018, software developer Kromtech released a report that found credit card thieves were exploiting in-app purchases in games like Clash of Clans and Marvel Contest of Champions.
“While completely stopping such criminal activity is extremely difficult, several steps could be taken to mitigate the phenomenon,” Preminger told the Independent, such as monitoring the transfer of high-value goods, identifying players with large stockpiles of in-game currency, and sharing data with relevant law enforcement.
