Believe me, I never expected to ever write a title like that on a Stack Exchange site either!

Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around spam and viruses. However, yesterday she was startled: she got an email from Facebook thanking her for her purchase of 40 dollars worth of poker chips in the Facebook game TexasHoldEm. She was ultimately sure she had never done a purchase like that, but she was worried she had lost money one way or another.

The email seemed genuine. Logo, text, sender, and links all pointed to genuine Facebook resources. I decided to take a look and followed the link to the 'receipt'. A payment overview at Facebook.com opened and everything was documented as the email had stated: her account had acquired 40 dollars worth of poker chips in the app (game) TexasHoldEm. Surprisingly, though, those chips were paid with a PayPal-account registered to an email address we have never heard of:

givenName.LastNameNumber@web.de


This is odd for two reasons: we live in Belgium, but have no relation, friends, family or otherwise, in Germany. Second we know no one by that name either.

At first I thought it may have been an error on that person's side, or that it is simply possible to 'donate' chips to someone else's Facebook account. But this would allow app developers to spam people who had never used their app with free gifts, so this seemed unlikely.

I then checked her account's recent activity, more specifically the 'recent sessions' tab. To my surprise there was indeed an active session in Düsseldorf, Germany. As a panic attack, I immediately ended that session. Unfortunately that also hid the information about that session. For me this meant only one thing: her account must have been hacked, as she hasn't been to Germany and there is no way there could be an active - poker-playing - Facebook instance there.

In light of this, I urged her to immediately change her password. After that, Facebook seems smart enough to know you made the change because you thought something was wrong: it proposed to go through her recent app activity and post and possibly deleting strange behaviour. Indeed, the app TexasHoldEm had been used, and there had been four posts (of the app on her behalf) that she had been playing the game - going back one whole week.

As a conclusion I would think that someone hacked my mother's account, played poker on it and paid for chips him/herself and ... That's it. Maybe I am getting old, but isn't this weird behaviour?

Why would a hacker do this: hack some one's account, buy poker chips with their own PayPal account, and play the game? And how can I better protect myself against such 'attacks'?

The poker chips were for Zynga's Poker game on Facebook. As has been mentioned in the comments, you cannot withdraw won money from this game. This is valuable - and intriguing - information which makes understanding the hacker's motives even harder.

I interpret your question as:


  What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips?


It's not that strange if you think about it this way:

As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the card distribution.

Thus, using sock puppets that are valid, active - real - Facebook accounts are the only way to gather more information without being spotted easily by heuristics.

Düsseldorf is where one of the big data centers in Germany is located, so there is a good chance that session was held by a bot on a server, not a real person.

Using two or three such bots on a table that are connected gives them a significant statistical edge to beat the other - real - players.

This (collusion) is probably illegal in most poker games and thus real accounts are used to make detection hard. Also, that's probably not the attacker's real name, their mail address and/or PayPal account.

It is probably the account of another victim of identity theft.

In the light of the other answer, I assume that Facebook handles the legal things when you marked the activities as fraudulent.


Update for modified question:

As there seems to be no real money gains involved in this poker game instance, there is another valid reason to use your mom's account:

Because it offers anonymity. If the stolen PayPal account owner tracks the usage down, it'll be your mom as a suspect, not the actual hacker.

Using real, alien Facebook accounts offers another layer of protection with respect to law enforcement.



There still remains the question of how the account was taken over. There are questions here that might answer that.

If your mom does do password reuse, you might educate her about the implications and urge her to change all passwords and use different, strong ones for all accounts.

This would be a good time to introduce her to the famous xkcd about diceware and/or a password manager, as David suggested in the comments.

Also, as S.L. Barth suggests in the comments, using two-factor authentication wherever possible is a good call in any case.
