Identity theft feeds $1bn gaming black market

Almost a quarter of a million fake accounts created in South Korea alone

A plague of identity theft is afflicting South Korea's online gamers, as reported cases soar to almost a quarter of a million. 

Many of the stolen identities are being used in gaming 'farms' in China as part of a $1bn a year black market in cash and items from online games, according to local media reports. 

Online games are hugely popular in highly-wired South Korea. The country has well-funded professional video gaming leagues, and TV channels devoted to games.

More than three million people play Lineage and Lineage 2, the games most affected by the recent spate of identify theft. 

Lineage developer NCsoft Corporation also operates popular games like City of Heroes and Guild Wars in Europe and the US, and will launch Auto Assault later this year. 

There are no reports that any of these games are affected by the Korean ID thefts. NCsoft reported revenues of $346m and pre-tax profits of $86m last year.

Although there are cases of existing Lineage accounts being hijacked, the victims in the vast majority of recent cases do not even play the game. Instead, their real-world identities have been used to sign up without their knowledge.

NCsoft has set up a website to help Koreans check whether they are victims. "I looked at NCsoft's website and was very surprised. I saw that my father and my girlfriend had their [identification] numbers stolen," Andrew Kim, a 22 year-old student at Seoul National University, told vnunet.com.

"I have contacted [NCSoft] but now we are afraid that the [criminals] got their identity and so much information. Maybe they can use that to cause some other problem."

Organisations running online gaming 'farms', particularly in China, have been blamed for the identity thefts.

Farms involve ranks of low-paid staff working 14-hour shifts performing repetitive tasks in online games in order to generate 'gold' and other valuable items. These items are then sold to players overseas.

A Korean ID number is required to sign up to play Lineage in Korea. This has made it difficult for 'farmers' to set up accounts for their workers, hence the spate of ID thefts.

NCsoft claims that it is not responsible for the initial leak of identification numbers that were used for the fake registrations.

"It appears that Korea's major portal sites or online communities were hacked and that the subscriber information was leaked in bulk," an NCsoft spokesman told local media. NCsoft has not named the websites that it claims were hacked.

South Korea's 13-digit personal identification numbers include fields indicating gender and place and date of birth. The Lineage ID thefts have led to calls for the system to be overhauled so that the numbers no longer reveal personal information. 

NCsoft has been criticised for using the official ID numbers for its games. The company does this to make it easy for anyone to sign up and try the games for free for a few days before they begin paying.

NCsoft said that it is rushing into service a new system which will send a text message to a mobile phone to confirm a new account.

While this will still use personal identification numbers, it will force criminal registrants to use a separate mobile phone account for each fake name they sign up.

Korea has harsh penalties for ID theft. In 2004, an 18 year-old student received an 18-month prison sentence after using another person's identification number to sign up for an online game, the Korea Herald reported. 

Apart from the use of identification numbers to create new accounts, existing gaming accounts are also sometimes stolen.

Commonly seen methods include viruses designed specifically to steal Lineage user names and passwords, and key-logging software illicitly installed on PCs in Korea's numerous 'PC Rooms' or internet cafés.

Korea's Cyber Terror Response Center, a special division of the national police force, reported that it handled more than 88,000 cases of cyber-crime in 2005.