Credit Card Scam Screws Natural Selection Devs Out of $30K
Moral of this story: Only buy videogame keys from legitimate sources.
Credit card scams are a headache, not only for customers, but also the merchants who were unfortunate enough to charge the credit card in the first place. Credit card scam victims can simply (or maybe not so simply) ask their banks to issue chargebacks, forcing merchants to eat the costs. For videogame publishers, who've been on the receiving end of a chargeback, eating the costs of a chargeback, though painful, aren't too devastating. However, for an indie developer that isn't working on a budget of millions of dollars, chargebacks can be a bit of a problem.
Unknown Worlds Entertainment, the developers behind Natural Selection 2, was out $30,000 after it was discovered that 1,341 Steam keys of the game were purchased illegally with stolen credit cards. The real credit card owners, seeing the fraudulent charges, issued chargebacks for the keys.
Apparently, someone had used the stolen credit cards to purchase these keys off the Unknown Worlds store and then sold them to third parties at a discount. For now, Unknown Worlds has closed its store, though Natural Selection 2 keys are still purchasable via Steam.
Unknown Worlds has stated that any users who were apart of the scam should contact them for a refund, though it seems unlikely that the developer would refund money to users who didn't buy from a legitimate source in the first place.

NS2 is a great game, a labor of love. It's so heartbreaking to see this happen to devs that really don't deserve it. Do it to EA.
NS2 is a great game, a labor of love. It's so heartbreaking to see this happen to devs that really don't deserve it. Do it to EA.
Chargebacks cost money, the charge is passed on from the payment processor to the seller, this fee can be anywhere from $15 to $30 depending on the institution that the chargeback originates from, amount of chargebacks and the payment processor being used.
So multiply 1341 by $25 (which, sadly, is a very realistic figure for a chargeback fee) and you get ~$33k in chargeback fees alone. Then factor in the server costs for serving these customers then the support costs, believe it or not users need lots of support for the simplest of things, and you are easily at the $30k figure of LOSSES.
I know some people like to live in a fairytale world where developers all work for free and a digital product is not worth anything but believe it or not support costs lots of money, it takes money to server customers in the first place, it costs a hell of a lot of time and money to get the product out there in the first place. Chagebacks are an unnecessary cost that is incurred on top of the refund so they do cost the company.
1341 chargebacks would be enough to sink most small companies so it is not just a simple case of kill the accounts. Things in the real world cost money, setting up an account costs money, providing support to those that cannot evenfigure out what is right in front of them costs much more money than most realise, killing an account costs money but most of all the chargebacks themselves cost a hell of a lot of money.
It would be a very easy case to make that a majority (admittedly not all or most but definitely a majority) of these 1341 users would have bought from steam if that were the only option. So on top of the actual monetary losses incurred from the whole chargeback process and supporting non paying customers they have lost out on probably ~1k in sales.
Every little thing costs money in business and this is one of those non-debatable huge losses for this company, I just wish them the best and hope that things like this do not happen very frequently in the future and that they don't get hit like this again.
Which is exactly why they have a huge number of chargebacks. Customers hate chargebacks as much as vendors, so the fact that they've been forced to do so is probably a sign that the developer isn't behaving properly. They're lucky they aren't also being hit with BBB complaints and small claims lawsuits, which would hurt even worse.
Sadly this isn't true.
This is a sign that the credit card companies are out of control. They charge outrageous fees (5% + a base fee), make it a breach of contract to ask for a customer's info or ID (really), and then the merchant is still on the hook for any charge-backs or fraud. Even if you win a charge-back you still get hit with a huge $25-$35 fee. Charge-backs should be harder. There are people who use charge-backs when they're not happy with something and the charge-back still goes through no matter how illegitimate the charge-back is. I truly feel for the devs.
Sorry, but you are way off base. The charge-backs are from people with stolen credit-cards who didn't buy the game themselves.
A customer who bought an illegitimate steam key from an unscrupulous source has no right to a refund from the game developer who didn't sell them anything; I feel a bit bad for the end-buyers who's keys are getting canceled, but their issue is with the reseller they bought from, not the developer.
The only thing the devs may have done wrong is likely hosting a store with poor botting checks and/or poor fraud detection. Sadly, this is going to make it harder for indy devs to sell their own product; hopefully the CC companies can be negotiated with, but I doubt it.
It's because the little guy is the easiest target. EA can afford huge amounts of security and suffer a few chargebacks without it being a big deal. It's like cars. Cars that are not worth much are more likely to be broken into because they'll lack advanced security features. A BMW has all sorts of security features, but the owner paid a lot for that car. A honda civic is less likely to have all those features, so it becomes an easier and more lucrative target.
This is just more proof that you should not host a billing application unless your qualified to do so. If there weren't some loophole in their security or authentication process, then they wouldn't have had 1300 fraudulent sales.
Honestly for the cost to setup your own web store, if the game is already on Steam, just link to Steam from your website. The cut that Valve takes is well worth the security they put you behind for small developers.
I feel bad for these guys but this is a lesson learned the hard way and a reminder that if you aren't qualified to setup a secure website for online purchases with multiple authentication steps, have a payment provider do it for you.