An extensive List of suggestions regarding the account security problem and how to prevent phishing.
Accounts being fished and clans being stolen has been a serious concern for a while now, even the devs themselves acknowledged that.
Hell, the top post on this subs front page right now is about a long-time user being phished MULTIPLE TIMES.
And Supercell should care about this, I recon there are quite a few users who will never spend a single cent on this game because they fear losing their accounts.
Here are some suggestions to improve account safety and account recovery:
1. Two-factor authentication for supercell ID. Pretty self-explanatory, really. I guess most people here have used it in one form or another.
2. A 'log out from all devices' button. Enables players to make sure nobody else is accessing their accounts from another device (in cases of lost devices, shared devices etc.).
3. Grouping multiple Supercell-IDs to a master ID.
Grouping multiple accounts together, possibly with a shared method of two-factor-authentication or a master password for account management could drastically cut down successful phishing attempts since any phisher would have to know EVERY account linked to a master ID, not just the one he is targeting.
Example: a phisher tries to recover a TH14 account. He manages to guess the answers to the security questions, but doesn't know how many and what kind of accounts are linked to the master ID, something the actual owner would know without a doubt.
Players could easily keep a single account out of clans, give it an entirely different name and make phishing attempts a lot more obvious to support.
4. Automatic email notofication whenever a support ticket is opened for an account linked to that email. As far as we know, phishing involves a lot of brute-forcing to get answers to security questions right. Letting a player know that support tickets have been opened regarding his account could be an advanced warning and give him a link in the email to let support know that the actual owner is still in control of the account and the 'retrieving' attempt is just a phishing attempt.
5. Forms instead of single questions. Right now, questions related to the account are asked one after another. That means a phisher trying to brute-force the right answers always knows which question he got wrong and which answers were right. If all questions are asked via a form or at once before getting any kind of feedback, a phisher would never know what he guessed wrong and brute-forcing would become exponentially more difficult.
Make it a couple of specific questions (devices that account was used from, creation date, clan, time of inactivity etc.) and some open ones where players can answer how active they were, how and how much they usually attacked etc. Anything they can think of that support can verify. Let users add proof of in-game purchases and payment methods as well, and suddenly identifying phishing attempts should be very easy, while not making it any harder to rightfully retrieve lost accounts.
6. Better internal communication. I guess nobody in the community knows how support works exactly, where it's out-sourced to and how much Supercell can influence it so this is a pretty vague point, but some improvements could surely be made.
The easiest would be to keep a log of support requests regarding each account. If a support employee gets a request to retrieve account ABC and sees that there have been 28 attempts at retrieving that account in the last week, it shouldn't be too hard to identify it as a phishing attempt.
7. Opt-out of account recovery. If Supercell, for some reason, decides not to do anything about the security situation, the least they could do is to give users the option to opt out of any recovery process to at least avoid the risk of support helping phishers with stealing their account.
8. A recovery-code. Let users create a recovery code for the future that would allow them to get access to their account and let them change the ID the account is linked to without going through support. This would put the responsibility on the user keeping their recovery-code safe and unknown to others.
If you have any additional suggestions or find flaws in the ones listed, please comment! Maybe we can help to improve the situation. Tagging u/Darian_CoC too, so hopefully this post doesn't get lost.
(Not all of the suggestions are unique, some have been posted on here already. This is supposed to be a long list of ideas that could help, not a list of "my" ideas.)
Posted May 11, 2022, 1:46 PM UTC · edited
Honestly they’re log in system is quite possibly the most ridiculously primitive i’ve seen in any game. It would be infinitely better if it had a email and password system like every other game out there, it baffles me how stupid this studio is.
It's not that they're stupid. They just don't care. Just like the majority of people in this sub. I've had a couple of flame wars with acct thieves in this very sub and no one here chimed in with shit.
They will feign outrage but when phishers/thieves rear their ugly heads in this sub the outraged people are always nowhere to be found.
Why do phishers even want accounts to begin with?
To sell them.
I havnt been able to log into my primary on my phone for a few days now, because it keep telling me that the verification code is wrong even though its the exact one they emailed me its stupid as hell, luckily my main is accessible on my other device but I'm worried if I get logged out of it on my other device too
I have no security complaints about the log-in system at all. In fact, I think it's the best possible solution they could have implemented.
Reason: supercell is NOT a security company...they don't know dick about security and they don't want to have to know dick about security. The system they created puts the responsibility of security onto the user's own email...which makes the user responsible for security, and this is a great thing. It takes something that supercell has no expertise in (security) and it hands it over directly to someone who does have expertise in security (an email provider).
The problem isn't the log-in mechanics, and the problem isn't the security of the underlying email account that user's use for their Supercell IDs... the problem is that Supercell support can be easily fooled into reassigning a new email account to a supercell ID after getting talked into it by a thief.
If they instead brought the security of it in house, then we'd also be dealing with their incompetency with handling security, and I don't want that problem also. To fix the account theft epidemic, they don't need to handle how village log-in works, they need to QUIT FUCKING HANDING LEGITIMATE PLAYER ACCOUNTS OVER TO THIEVES. That's a PROCESS PROBLEM...and many of the suggestions listed at the top level post are designed specifically to mitigate Supercell's process problems.
Their*