Indie Dev TinyBuild Lost $450K to Fraudulent Sales Facilitated by G2A.com
Indie developer TinyBuild, the studio behind Punch Club, Party Hard and SpeedRunners, had thousands of their game codes stolen through fraudulent credit card purchases, which then wound up on G2A.com, a site that allows people to resell game codes.
The basic idea behind G2A is straightforward and pretty harmless: with the amount of game codes sold through Steam, the Humble Store/Bundle, and more, the site gives consumers a place to sell unwanted game codes. However, in doing so, G2A has created a huge black market for game codes sales.
As TinyBuild described in their blog post on the matter, the common practice for scammers is to “get ahold of a database of stolen credit cards on the darkweb. Go to a bundle/3rd party key reseller and buy a ton of game keys. Put them up onto G2A and sell them at half the retail price.” This allows scammers to make thousands of dollars while preventing any profit from reaching the game developers because, once the stolen credit cards are processed, the payments will be denied. The developer won’t receive any money, but they will already have given out the keys.
The source of these fraudulent codes was the online store that TinyBuild ran themselves. They wrote:
The shop collapsed when we started to get hit by chargebacks. I’d start seeing thousands of transactions, and our payment provider would shut us down within days. Moments later you’d see G2A being populated by cheap keys of games we had just sold on our shop.
TinyBuild ran the numbers on how many keys were sold on G2A and how much revenue that was lost for them as a result.