Money launderers have targeted the cyberworlds of online video games since they first came into existence. Their use of virtual currencies, both convertible and nonconvertible, and the anonymity provided to players has fostered an environment susceptible to criminal activity.

While the games themselves were created for the purpose of entertainment, what attracts launderers to the world of gaming, rather than financial institutions or casinos, is the little to almost nonexistent anti-money laundering (AML) regulations governing their sector. For over a decade, the world of online video games has been unregulated with scarce customer identification and due diligence, almost no monitoring of financial activities and no rules concerning suspicious activity reports (SARs) or other means of reporting.¹

In December 2012, Ken Lawson and Cameron Carstens published an article in ACAMS Today titled Virtual Worlds: The New Frontier, in which they detail how money can be laundered through the popular online game Second Life. What makes the game unique is that its virtual currency—known as Linden Dollars—is convertible, meaning that it can be exchanged with other real currencies.² Since the publication of the article, some progress has been made to mitigate potential dangers of the currency’s criminal use (i.e., the recognition of the Linden Dollar as a virtual currency in 2013) and stronger know your customer (KYC) regulations put in place in July of 2019 by the Financial Crimes Enforcement Network (FinCEN). ^3,4

The story is quite different when one examines nonconvertible virtual currencies in online video games. Since it has become harder to launder illegal proceeds through Second Life and other games that adopt convertible virtual currencies, criminals have flocked to games like Fortnite and its similar spawns for the anonymity it provides its players and for the ease to implement their schemes undetected.

Are nonconvertible virtual currencies truly as they seem?

The Financial Action Task Force (FATF) defines a nonconvertible virtual currency as “intended to be specific to a particular virtual domain or world…and under the rules governing its use, cannot be exchanged for fiat currency.”⁵ Such virtual currencies can be used to buy in-game objects or territories which cannot be sold or exchanged for any other type of currency.

However, there seems to be a debate as to whether a nonconvertible virtual currency can truly remain nonconvertible. FATF has acknowledged this issue in its report Virtual Currencies: Key Definitions and Potential AML/CFT Risks, stating that, “…it is possible that an unofficial, secondary black market may arise that provides an opportunity to exchange the ‘nonconvertible’ virtual currency for fiat currency or another virtual currency.” It goes on to state that the, “Development of a robust secondary black market in a particular ‘nonconvertible’ virtual currency may, as a practical matter, effectively transform it into a convertible virtual currency,” thus defining nonconvertible virtual currencies as “not necessarily static.”⁶

A Money Laundering Cyber Haven

Earlier this year, in a report titled Carding and the Digital Gaming Industry  by the cyber-intelligence security firm Sixgill, it was shown that the popular online game Fortnite is turning into a money laundering haven. Boasting over 125 million players with monthly revenues in the hundreds of millions of dollars, Fortnite is a last-man-standing battle royale game that pits players in an arena as either teams, duos or solo, with up to 100 players per match.⁷ The game’s digital currency is called V-Bucks and is used to buy in-game weapons, skins and accessories to either aid or make the player standout during the matches.

Signing up to play Fortnite is very easy. All one has to do is download the free game on a tablet, smartphone, gaming console or on a PC from Fortnite’s official website. The next step requires the player to sign up either through their Facebook or Google account, or by inputting their name, nickname, email address and a password they create. Once the terms of service are agreed upon, the player can finally play the game. If the player wants to purchase V-Bucks, they will need to link their account to a credit card or to their PayPal account.

Criminals sign up to Fortnite, create a profile and use the proceeds of their illegal activities, or stolen credit cards, to purchase as many V-Bucks or accessories as they can; then they sell their account at a discounted rate to a second actor/victim, receiving clean money in return.⁸ The accounts are often sold on public online secondary markets such as eBay and G2G.com or over dark/deep web forums—the “secondary black markets” described by FATF. Many are also publicized over social media platforms such as Twitter or Instagram.⁹ The payments are processed through PayPal or bitcoin and the package comes with the login and password of the email address used to create the Fortnite account. Agents at Sixgill have identified operations being conducted all over the world in Russian, Chinese, Arabic, Spanish and English.¹⁰

“Epic Games (the company responsible for the creation of Fortnite) doesn’t seem to clamp down in any serious way on criminal activity surrounding Fortnite, money laundering or otherwise,” said Benjamin Preminger, a senior intelligence analyst at Sixgill.¹¹ Epic Games has responded by saying that it takes these issues very seriously and urges players to protect their accounts and not share their account information with others. However, this does not address the money laundering issues that have been presented but merely the troubles concerning fraud. Preminger states that the company could take further steps to mitigate the problem including, “monitoring the transfer of high-value goods in the game, identifying players with large stockpiles of V-bucks, and sharing data with relevant law enforcement agencies.”¹²

In late 2018, over a period of 60 days, the top 50 Fortnite items on eBay had earned over $250.000 dollars.¹³

Old Methods

This method of laundering money is nothing new. Back in 2013, the cybersecurity expert Jean-Loup Richet published a study titled Laundering Money Online: A Review of Cybercriminal Methods  for the United Nations Office on Drugs and Crime detailing innovative money laundering schemes in online games. The study chose then popular massive multiplayer online role-playing game World of Warcraft as its example. Much like the Fortnite scheme, it was shown that a criminal could easily sign-up to the game for free and use stolen money to buy great amounts of the game’s currency, simply known as gold. Criminals could then sell it to a second actor met in game or on other online platforms for cryptocurrency.¹⁴

Richet believes that microtransactions are being conducted to not raise suspicion from the game’s developers. “Microtransactions are interesting in that they don't attract a lot of attention, because it's not like receiving a wire transfer for 100,000 dollars,” Richet said, “it's five dollars plus five dollars plus five dollars. It doesn't set off alarms like a large wire transfer. It might be easier to cover the traces of money that way."¹⁵

However, in his study Richet was unable to quantify the amounts that were being laundered with the methods he laid out. In an interview in 2018, Richet stated that he believed that it is too much of a niche method. "There are much easier ways of laundering money," Richet said. "Most of them are petty criminals—maybe it represents a lot of money as an industry, but the individual operations are small."¹⁶ Sixgill’s 2019 study has shown that that is not the case.

Has anything changed?

Sixgill’s report was released in January of this year. When searching Fortnite on eBay today, a staggering 1,742 results appear with sellers selling accounts, skins and V-Bucks for bids as low as $3 dollars to bids as high as $900 dollars. The highest price for a collection of V-Bucks coupled with a skin was $513,17 dollars. A search on Google yields further alarming results with forums and websites dedicated to the practice. A Facebook group titled, “Fortnite Accounts – Buy Sell Trade Public Group” has 3,726 members.

This goes against Epic Games’ policies. In their end-user license agreement, it is clearly stated that “you may not transfer, sell, gift, exchange, trade, lease, sublicense or rent Game Currency or Content except within the Software.”¹⁷ While many sellers are simply gamers trying to make a quick buck, it is very hard to distinguish them from the money launderers and criminals.

Epic Games was contacted to inquire about what was being done to mitigate this problem but no answers were provided.

Fortnite is not the only game of its kind. Games like PlayerUnknown’s Battlegrounds (PUBG) and Apex Legends resemble Fortnite in having their own virtual currencies that work similarly to V-bucks. A quick check on eBay today shows 1,158 listings for Apex Legends while only a handful for PUBG. It is not known if similar money laundering schemes are being carried out for those games.

In Need of a Wake-Up Call

While the lack of procedures and controls from the gaming companies regarding KYC and the monitoring of transactions facilitate criminal activity within the games, there are other factors that must be taken into account.

First, there is the lack of controls from authorities. “It's innovative and it's kind of safe paradoxically because there are not a lot of officials investigating these cases," Richet said. “There are some places where government officials, like Europol or Interpol, are more likely to be [monitoring]. But in the case of online games, there are no anti-money laundering policies or algorithms to detect or prevent strange behavior [beyond the developer's own efforts]."¹⁸

While most AML regulations regarding virtual currencies focus on the convertible kind, there needs to be awareness from the authorities that the nonconvertible type is equally at risk of being used for nefarious purposes and should be treated similarly to its counterpart. One big problem pertaining to this question is the exact definition of a virtual currency. Due to their novelty, many nations and authorities have established different meanings and rules related to virtual currencies.

The European Central Bank considers nonconvertible virtual currencies, or closed virtual currency schemes, as having “no link to the real economy (e.g., massive multiplayer online games and virtual currencies which can be used only in those games).”¹⁹ FinCEN does not recognize virtual currencies as being “real” currencies but instead identifies administrators and exchangers of convertible virtual currencies as “money services businesses” subject to regulations. ²⁰ On the other hand, Switzerland views virtual currencies simply as assets and its latest regulations focus primarily on blockchain businesses.²¹

Authorities give different meanings to virtual currencies, leading to diverse regulations. One can notice when studying the different definitions given by each country and authority that nonconvertible currencies are often ignored or given little significance with FATF’s warning overlooked. It is no surprise that Europol and Interpol are looking elsewhere. There needs to be more reports similar to Sixgill’s or Richet’s as a wake-up call for regulators and authorities to the criminal activities happening behind the cyberworlds of online video games.

Stefano Siggia, senior compliance assistant, Banca Monte Paschi Belgio S.A., Brussels, Belgium, stefano.siggia@montepaschi.be

1. Kevin Sullivan, “Virtual Money Laundering and Fraud: Second Life and Other Online Sites Targeted by Criminals,” BankInfoSecurity, April 3, 2008, https://www.bankinfosecurity.com/virtual-money-laundering-fraud-a-809
2. Ken Lawson and Cameron Carstens, “Virtual Worlds: The New Frontier,” ACAMS Today, December 4, 2012, https://www.acamstoday.org/virtual-worlds-the-new-frontier/
3. “Virtual world Second Life to enforce anti-money laundering regs,” ItNews, July 2, 2019, https://www.itnews.com.au/news/virtual-world-second-life-to-enforce-anti-money-laundering-regs-527558
4. “Terms of Service,” Tillia Inc., August 1, 2019, https://www.tilia-inc.com/legal/tos/
5. “Virtual Currencies: Key Definitions and Potential AML/CFT Risks,” Financial Action Task Force, June 2014, https://www.fatf-gafi.org/media/fatf/documents/reports/Virtual-currency-key-definitions-and-potential-aml-cft-risks.pdf
6. Ibid.
7. Brian Crecente, “Dark Web Creating ‘Thriving Criminal Eco-System’ Around Game,” Variety, January 15, 2019, https://variety.com/2019/gaming/news/fortnite-money-laundering-1203108363/
8. “Carding and the Digital Game Industry,” SixGill, January 10, 2019, https://info.cybersixgill.com/digital_gaming_tp
9. Aaron Mamiit, “Fortnite V-Bucks Being Used by Criminals for Money Laundering on Dark Web,” Digital Trends, January 19, 2019, https://www.digitaltrends.com/gaming/fortnite-v-bucks-used-for-money-laundering/
10. Louis Casiano, “’Fortnite’ has become a money-laundering paradise,” New York Post, January 18, 2019, https://nypost.com/2019/01/18/fortnite-has-become-a-money-laundering-paradise/
11. Anthony Cuthbertson, “How children playing Fortnite are helping to fuel organised crime,” The Independent, January 13, 2019, https://www.independent.co.uk/news/fortnite-v-bucks-discount-price-money-dark-web-money-laundering-crime-a8717941.html
12. “’Fortnite’ has become a money-laundering paradise,” New York Post, January 18, 2019, https://nypost.com/2019/01/18/fortnite-has-become-a-money-laundering-paradise/
13. “Carding and the Digital Game Industry,” SixGill, January 10, 2019, https://info.cybersixgill.com/digital_gaming_tp
14. Steven Messner, “How microtransactions and in-game currencies can be used to launder money,” PC Gamer, April 13, 2018, https://www.pcgamer.com/how-microtransactions-and-in-game-currencies-can-be-used-to-launder-money/
15. Ibid.
16. Ibid.
17. “Fortnite End User License Agreement,” Epic Games, https://www.epicgames.com/fortnite/en-US/eula
18. Steven Messner, “How microtransactions and in-game currencies can be used to launder money,” PC Gamer, April 13, 2018, https://www.pcgamer.com/how-microtransactions-and-in-game-currencies-can-be-used-to-launder-money/
19. “Virtual currencies – EU legal overview,” Lexology, March 22, 2019, https://www.lexology.com/library/detail.aspx?g=ad30479b-26b5-4a20-94f3-71a3b1856889
20. “Virtual currencies and central banks monetary policy: challenges ahead,” European Parliament, July 2018, http://www.europarl.europa.eu/RegData/etudes/IDAN/2018/619009/IPOL_IDA(2018)619009_EN.pdf
21. “Digital Currencies: International Actions and Regulations,” Perkins Coie, September 2019, https://www.perkinscoie.com/en/news-insights/digital-currencies-international-actions-and-regulations.html#Switzerland