Account was compromised while hacked - now permabanned, no explanation HELP

Support Customer Support
1 
 Let me preface by saying that I've had my Blizzard account since the early days, and started playing WoW in 2005 and at the time of this compromise I had an active subscription along with many other games I played regularly. 

 So I was logging into the blizzard app almost daily for 2 months Nov-Dec'20 after renewing my WoW subscription so I could focus on playing classic. Then All of a sudden, January 1st I am met with  “Your Blizzard Account is banned [Get Help: BLZBNTTAS00000006 ]” when trying to login to the Battlenet App, very strange. I immediately check my email linked to the account, and it appears that this email was hacked into... So it takes me about a week  but I manage to get back the email linked to my blizzard account!

 Now I check to see if I can figure out what happened to my Blizzard account that led to the ban, and after a bit of investigating I find an email requesting a password change, and another email on January 1st titled "Issue ID #77423886 - Your Support ticket status has changed to 'Need Info'" asking for further account verification in the form of picture ID next to an up-to-date newspaper. 

 But even more strangely was that there was no email outlining why the account was banned. (which I am currently being told I should have gotten from the GMs who are refusing to look further into my ticket...)

 Anyhow, I spent January putting in multiple tickets to try to get account back as I conclude that it was very likely someone tried to hijack my account for whatever reason and it was locked as a result. Not a big deal... 
 I even send in my info accompanied by my picture ID next to the newspaper they requested, and it seems like blizzard locked the account after it was compromised, but are now not unlocking it because they are saying it violated the policies (*couldn't find an email explanation, remember).

“Thank you for your correspondence. After a thorough final review of the action taken against this World of Warcraft game license, we have arrived at the same conclusion. The action will not be reversed or changed under any circumstances”

 I have posted on the Battlenet CS forum and they told me, being it may be WoW related (the compromise seems to be linked to that game), to make another ticket from the account with ticket numbers + references to what happened from my end but I still don't really have an explanation of what policies the account violated while compromised. I was just met with:

"I understand you have some concerns about the state of your World of Warcraft account. I imagine you’re feeling a bit confused or even frustrated, so I’ll do my best to explain what happened to your account.

First thing I wanted to explain is that if we every find an account in violation of our Code of Conduct or Terms of Use, we will send out and email explaining the reasoning for these actions. That does contain all of the details we have on why the action was applied. If you have not checked your email yet, please do!

After investigating this account action, due to this penalty having already been upheld prior, any further requests on this topic will not be reviewed."

No clue where to go from here, and NOTE I am posting this on a friends account because I am unable to login. I have many games and as I said, have had this account since the very beginning. There’s no number to call or anyone to talk to real-time about this it just seems like every ticket I open to get help will be turned down and I will never get my account back for something I didn’t do.

Thanks

1 Like
2

It’s not uncommon for an account to be banned while hacked. People hack accounts to do bad things.

You can reopen your original ticket reporting the hack to add the info that the account was banned while hacked and they will normally lift the ban.

They are not likely to lift the ban if they have reason to believe the account was not actually hacked such as the before and after ip addresses used by the account being the same.

5 Likes
3

Thanks for the reply.

That’s what I am saying/thinking to. I’ve had friends who have had that happen to them and it was an easy process with the ban being uplifted. But this seems like a special case and I haven’t gotten an explanation. I thought it would be as easy as checking the logs as you suggested.

4

There has not been a working telephone number for some time now, and the live chat option is only open for a slender window of time when it is available. Tickets are the only means to communicating with the staff. Granted things are moving a little slower than anyone would like, but that is out of everyone’s hands due to the pandemic and people working from home. The good news is that account issues such as these do have a bit of priority in the queue.

That said, yes. Please open another ticket. The best way to go about it is to cut all of the extraneous chatter out. Your account had been compromised, and while compromised, it was banned/locked down. If you’ve got your e-mail account secure and hopefully your Battle.net and WoW accounts secure and authenticator applied, then please make note of that as well. All of the copy-paste from previous tickets isn’t necessary (you could post your ticket numbers but that is all I’d have for reference sake). Too much information can make it murky and confusing, and that’s when we see a lot of people get stuck.

6 Likes
5

Never really got this, but yah, I understand OP that to others the process was much more simplified, heck I had it happen to me in Burning Crusade at the start of it (before getting authenticator). Hopefully in the future Bliz will open up the phone lines again.

The company I work for is in a similar scenario as Bliz, and we just found out last Friday that we are NEVER going back to work, which sucks since I am down the street and got a home near work.

I am going to probably move out of CA now since I don’t have to go to the office anymore. California is a mess. I was thinking Wyoming, or Idaho. Wonder if Bliz is in a scenario like my company.

6

From what I’ve gathered from our Blues, there is some things limited by the work from home order? The security of home offices obviously are nowhere near what it would be working from the Blizzard offices, so they can’t just dial in for live chat availability or deep-delving into accounts and tickets just because they’re home and bored. Now with it looking to being a more long-term thing than most anyone could have ever anticipated, who knows how it will go on from here, but that’s just been what I’ve kind of seen hinted at.

Of course I beg correction from anyone else, but that’s at least what I’ve picked up on from what I’ve seen posted over the past year or so.

7

This is what I think is the case as well. Blizzard normally requires everyone to be on campus, logged in under their own ID, on Blizzard’s computers, with all the tracking and logging in place. It is heavily fire walled. Home is obviously not going to be as secure or easy to monitor - and if they did open up monitoring then chances of someone unsavory getting to it, go up. I think they prefer to keep some functions locked to campus and not open to the internet at all. Customer information being one of those things. Of course, it also protects Blizzard data.

EDIT linking to the original post the OP made (also via a friend’s account)

Please be aware that account sharing is not allowed.

You may want to post your ticket numbers so that a Blizzard staff member can look up your actual account. If not, the name of a character and server on your account will help them find it.

4 Likes
8

Thanks, here are some ticket infos.

During the compromise: Issue ID: #77423886

Me trying to get account back after getting email secure: Issue ID: #77904844
Tickets denying unban: Issue ID #78197144
Issue ID: #78209791
Issue ID #78214963

9

When Blizzard looked into your report that the account had been compromised, did they reply indicating that they did indeed see that it had been accessed by a third party?

Hopefully you’ve also found the cause of your compromise, otherwise you’re putting your friend’s account at risk now too.

5 Likes
10

One word that could have saved you from this:

“Authenticator”

11

Just to clarify - there are no GMs on this forum and tickets cannot be addressed this way. Perhaps one of our Blues may pop in with a suggestion or something if they see an anomaly, but they have nothing to do with the ticketing system. For that, you will have to just wait on your latest ticket filed.

12

Great. As was already said, there are no GMs here, but the Forum Support Agents (blues) can now check (if one is around) to see that everything was submitted properly and give you advice as to any possible further steps.

4 Likes
13

That is the weird part, after thorough investigation I couldn’t find this email they speak of outlining the reason for the ban. Maybe what happened is someone hacked into the account, used it to do something malicious and against the policies, got insta-banned, tried to re-activate account thus explaining why the email was hacked and the first ticket asking for further ID security (picture of ID next to newspaper they could not produce)

14

Thing is if the account was comprimised you should have it back by now. That should be pretty easy for them to see. Someone using a different IP to connect to your account and them doing Nasty things with it.

Of course if you hired someone to power level you or something else they would see the different IP but not seeing them do nasty things is a clear clue they got invited to your account.

If you got told it will not be reviewed any further then you are out of luck sorry to say. No one here can change that.

15

Not necessarily. It’s been many a time people have come here because they were hacked, then when all was secured and it should have been unlocked - it wasn’t. Sometimes it takes that last ticket to ensure the account is properly unlocked.

You’re tossing out quite a bit of conjecture that isn’t really reflective of the issue. The account was locked/banned because it was compromised from what’s been said, and none of our SFAs have chimed in to say any different (as they usually will if a poster is being less than truthful about the issue).

It’s just a matter of getting in that ‘last’ ticket to clarify that they are the account holder, the account has been secured and any other proof positive required to show that they are in full control of their account.

8 Likes
16

I am not sure what resources they had to day with Texas being under snow, ice, and no power in many places. Might not have been able to check the ticket system for status?

4 Likes
17

I know Vrak was around earlier in the day hitting other threads when this one was first posted? But you do have a good point. I’ve got some friends down there who’re really having a rough time of it. Even still, no matter me usually being the self-professed pessimistic jerk, it does seem to veer more towards a post regarding a hacked account rather than a cheating ban as the person a few posts up was leaning towards. I just figure when someone is posting an outright falsehood, our Blues will usually set the record straight if it were cheating over a more cut and dry compromised account.

1 Like
18

The OP asked over in the Desktop TS forum 2 days ago and I explained all the same stuff about how bans can happen to compromised accounts, and to put in a ticket with the old ticket numbers to help them trace the issue. Then to come here if that did not work. So I am feeling a bit responsible for the lack of clarification.

I think all they need is a status - is the ticket properly submitted and it is a just a wait for the CS folks to get to it - or does the ticket need to be changed.

3 Likes
19

I’m around and did try to look into this one a bit but it seems that this started well over a month ago, so what information I have right now is not as clear as I’d like it to be able to provide some advice. With the power issues in and around Texas plus being a holiday, there aren’t a lot of folks around or able to access some things.

It doesn’t look like a simple compromise, if it were our staff would be able to overturn it with little fuss. I can’t make any promises, but I’ll see what I can find out but I’ll likely only be able to say… submit an appeal request.

10 Likes
20

I’m not sure if you are still around, Stelly, as you or your friend with the closed account, but I have an update.

From what we’ve been able to tell the account does appear that it could have been compromised, including the email address associated with the account.

My advice is to secure your email address or provide a new address that we can use to update the Battle.net account. When submitting a ticket you’ll want to attach another ID (the previous documentation automatically deletes to abide by privacy and personal information laws).

9 Likes