Fortnite Battle Royale exposes children to scams that could also endanger parents, warn experts

Malicious actors on the internet are taking advantage of children's fascination with the game

A gamer plays "Fortnite" against Twitch streamer and professional gamer Tyler "Ninja" Blevins during Ninja Vegas '18 at Esports Arena Las Vegas at Luxor Hotel and Casino on April 21, 2018 in Las Vegas, Nevada (Getty)

Fortnite is the biggest game in the world, and has turned millions of its young players into obsessives. But that obsession is being exploited by scammers who try and steal information and money from the children who play it.

A whole host of scams are being used across the internet to try and trick children into giving up the most personal and sensitive information of themselves and their parents. And it is being done by offering them free money and winning them over by chatting to them through headsets.

Fortnite Battle Royale was released around a year ago, as a free-to-download game that is now available for just about every computing platform. It sees players attempt to stay alive for as long as they can, in games that last around 20 minutes, either by killing other players or successfully hiding from them.

Though downloading Fortnite is free, like many other titles it has an entire economy of in-game purchases. Players – or their parents – use real money to buy a currency called V-bucks, which can then be traded for cosmetic options and other upgrades within the game.

It is that virtual currency and the upgrades it allows people to buy that has become such a fertile ground for scammers. And it is the desire to get hold of them that has meant huge numbers of children have been caught up in the hacks.

For the most part, the scams are not very sophisticated: they do not even usually require that people download a file or give up access to their computer. Instead, they will lead children to unsafe websites to try and extract personal information and other valuable data – and never give up the currency they claimed to be offering.

As well as children’s desire for in-game money, they also take advantage of other gaps in the market. There is not yet an Android version of the game, for instance – but a whole host of sites that claim to offer one, and actually just trick children into downloading fake and unsafe apps instead.

Often, they are distributed through YouTube, and searching that site for “Free V-bucks” brings up around 4 million results. The videos usually direct children to another site or app – away from YouTube – with the promise that they will receive free currency.

But once they load up those sites, they are asked for confirmation that they are human, and sent to different and more malicious sites. In fact, they are simply being directed to a whole range of cons – everything from being asked to fill in fake surveys to harvest information, to giving up their login details and exposing the payment details that are associated with accounts.

In some ways, the scams are only the darker side of an already controversial, but legal, development in games: loot boxes and in-app purchases. Those encourage players to spend more money once they’ve bought games – often in ways that resemble gambling – in the hope of improving their performance or appearance within the game.

“That’s where the majority of this comes from: the desire to have something their friends don’t, either because it’s paywalled or you would have to grind to get it,” said Chris Boyd, senior malware analyst at Malwarebytes. “You can either do that or just leapfrog the queue and go buy these.”

That desire to get hold of features and upgrades that would normally require either hard work or spending money means that children will try hard to find cheats or glitches that allow them to get around the issues. And since children are usually so wrapped up in the games, they might switch off the critical thinking required to avoid being taken in by scams.

“Everybody at some point in their life has been engrossed in something: a book, a game of monopoly or a computer game,” said David Emm, principal security researcher at Kaspersky Lab. “It means that you tend to lose track of other things going on around you.

“That could be that you’re out playing football and lose track of time, right through to something like this where the danger is you’re switching off your normal computing senses. You’re not really thinking about what else might happen.”

Ordinarily, there would be systems in place to ensure that people can’t easily be tricked into giving out their information or otherwise taking part in scams. Many antivirus and internet safety programmes will advise users not to continue to the websites or to put their personal information into forms, for instance.

But those protections can often get in the way of the experience of playing the game. And many of the scams present themselves as illicit, meaning that the warnings might be ignored precisely because people believe they are circumventing the normal protections.

YouTube said that the posts sharing the scams are against its rules and that it acts to take them down quickly. It is true that many of the results when searching YouTube have only been posted recently – meaning the true number of people attempting to upload them are far higher than the already huge number available online.

“Our community guidelines prohibit spam, scams and other deceptive practices and we remove these videoes when we are made aware of them,” a YouTube spokesperson said. “We are committed to removing spam quickly, in many cases, preventing it from ever being viewed by users, while also making sure that we do not harm legitimate creators.”

Experts’ advice to parents trying to keep their children safe is much the same as the advice given to everyone else: make sure that you have strong passwords in place, which are different for each website; set up two-factor authentication on services that support it, so you can only log in if you have your phone in your hand; and ensure that you install any security software and add the relevant controls to stop people taking advantage of your devices.

Fortnite also offers a range of other features that parents should be aware of.

It has a voice chat feature, for instance, meaning that scammers can simply encourage children to head to the website by telling them about it – or take advantage of them in even more malicious, unsettling ways. The voice chat can be turned off by heading into the game’s settings.

But experts also note that some advice isn’t even technological at all. It is more about instilling children with an important cynicism that is necessary to use the internet safely: there is no such thing as free money, and if people seem like they might be taking advantage of you then they probably are.

“In these games there’s nothing that is free,” said Jens Monrad, global threat analyst at FireEye. “What I mean by that is that any sort of offer where you can participate and get free digital currencies, either by handing out details about your account or by visiting specific websites, that’s typically fraud.”

That advice is older than the internet or this kinds of scam, of course. But even these scams are very old and have been growing fast with the availability of the internet and online gaming. They have been going on at least as long as Neopets, an online game that began in the 1990s, and lured children in by offering access to upgrades in the game such as “magic paintbrushes”.

“Sure enough they were targeting kids with these fake magic paintbrushes on some sort of online marketplace,” said Mr Boyd. “They’d download it, become infected with malware, and then use the kids as stepping stones to get to the parents.

“They’re not really interested in the kid. The kid is a piece of collateral damage to get to the kids’ parents payment information.”