Epic Games Store Account Fraud Raises Email Verification Concerns

Epic Games Store Account Fraud Raises Email Verification Concerns

The Epic Games Store is now three months old, and while it has made progress improving its feature-set in certain areas, like refunds and regional pricing, it looks as if other areas are glaringly underdeveloped. It turns out that account security seems to be one of them. Reports are coming in that Epic accounts tied to valid emails are being created fraudulently, yet users don’t seem to be receiving verification emails upon account creation. It’s unclear where Epic’s security has failed.
    A Reddit thread posted recently by the user “-dov-” is claiming that fraudulent Epic Games Store accounts had been created tied to two different of their email addresses. The user was confused, because they had no verification emails from when these accounts were created. Nonetheless, they were able to reset the passwords on the accounts and disable them.

Just to confirm their suspicions, however, -dov- also went ahead and created a brand new Epic Games Store account with a different email. Apparently, no verification email was sent to the new email address either. For all intents and purposes, it seems as though the Epic Games Store doesn’t have email verification for new accounts.

There are clearly some immediate security concerns that arise from -dov-‘s experiences, with several other users having shared similar stories in the comments of the Reddit thread. It’s difficult to understand what these fraudulent account creators were attempting to do, but the fact that they were doing it with others’ email addresses implies a serious issue, and that a lack of email verification is the problem.

That said, though the issue has been further complicated by the fact that many other users reported that they did, in fact, receive verification emails upon creation of their Epic Games Store accounts. The Epic Games Store also features two-factor authentication security including a Fortnite reward for activating it, though it isn’t enabled by default. This shows that Epic Games does have an understanding of account security, but that there may be an oversight or bug involved in the process.

Epic Games has yet to comment on the security issue, likely because it’s investigating it before offering an official comment. No matter its findings, all parties can likely agree that security can be improved. And for a new storefront like the Epic Games Store, security should be a top priority.

Source: Reddit