Microsoft Refunds Money Lost in Xbox Live Phishing Scam, Promises Better Customer Service

Microsoft went on to say that “While we do not ordinarily comment on specific cases, Microsoft can confirm that the account in question has been reinstated to its rightful owner and all unauthorized charges are being refunded in full.” The victim in question said she had lost $300 from her PayPal account to the thieves as her complaint was being mishandled.

The company repeated its assurances “that there has been no breach to the security of our Xbox LIVE service,” which is fine to hear but it misses the larger point that customers really care about: there still is a way whereby someone’s account gets broken into and plundered for Microsoft points or downloadable content, which is then sold on auction sites.

It’s a delicate message, but in order to be phished, the information used to break into the account typically comes from a third party, like a compromised web site where the victim uses the same login and password. Microsoft doesn’t want to blame the victim, and neither do we. But it would be as good a time as any to remind folks to change their passwords, and perhaps use something that is unique to Xbox Live, so that a phisher who uncovers your email address and password because of another site’s bad security can’t use the same login and password on Xbox Live. Really, it’s a good policy to have a unique password for any site that stores your credit card information. It’s a pain in the ass, but it’s the only way to be sure.