What Blizzard Doesnt Want You To Know Part 5

From Security Holes
Jump to: navigation, search

Argument #4: Blizzard does not employ fraud specialists or fraud managers, that's just conspiracy talk.



Here's my favorite Blizzard posting from Faizaniel.



Apparently, I am 'trying to make some kind of conspiracy theory about Blizzard recently having a job listing up for a "fraud manager".'



Faizaniel, by the way, is one of Blizzard's Most Valuable Posters (apparently #1 of all MVPs)! His position is described as someone who consistently answers Blizzard questions with accuracy and credibility. MVP's also promote constructive posting, are polite, they tell the truth, and that they're specifically chosen due to their strong knowledge. Interesting..



Anyhow, here's the official Blizzard posting for the job that doesn't exist. =] Fraud Manager at Blizzard Entertainment Location: Irvine, CA (Orange County, California Area) URL: http://www.blizzard.com Type: Full-time Experience: Mid-Senior level Functions: Finance Industries: Computer Games Posted: April 20, 2010



Job Description Blizzard Entertainment has an immediate opening for a fraud manager with a minimum of five years experience in this type of position. Duties will involve investigating credit card accounts in order to detect and stop fraudulent activity while preventing chargebacks and consumer disputes. Additional duties include calling issuing banks and customers for transaction verification, reviewing account referrals for fraudulent activity, and replying to third party inquiries.



Responsibilities Closely monitor fraud attempts and losses. Regularly and proactively analyze fraudulent transactional data to identify previously unknown groups or individuals. Identify trends, standard practices, and modus operandi of fraud groups and individuals. Utilize advanced relational database, link analysis software programs, SQL and access to create and run queries to determine fraud trends, identify fraud rings, and link unidentified transactions and accounts to known fraudulent activity. Monitor investigations and deal directly with law enforcement as necessary Maintain standard reporting metrics and provide non-standard management reporting and metrics as required.



Requirements Minimum of 5 years related experience, preferably within a corporate/private setting focusing on fraud prevention and investigation, Ability to maintain extreme confidentiality, SQL or other relational database query language skills, Excellent organizational, analytical, and written/verbal communication skills, Ability to work independently to achieve results, Basic technical understanding of data and data storage, Basic understanding of credit card processing flow, payment fraud, the travel industry, e-commerce, and the credit card industry, Strong project and time management skills, Proficient internet research, Excel, Word, Outlook, and overall PC skills, Successful completion of a background check



Pluses Degree in criminal justice or a related field Experience in e-commerce Experience utilizing internal fraud tools, system/site administration tools, and CRS or GDS systems Job ID: 933896 Apply on Company Website



(Google cached search still shows it as of this blog post date.)



The job posting was previously on the Blizzard.com Careers page, however it was quickly removed after my Reddit comment on this post regarding the position and what the job entailed. The posting was available on about 10 different (and highly recognized) job boards, and they were all posted at different times & dates. The "Fraud Manager" position was also posted 'new' on June 16, 2010 - however ALL references to this fraud manager position were removed just after my post. It's definitely eyebrow-raising.. I could understand if they expired automatically, but they were posted at different times and the fact that one job posting was pulled after only 2 weeks is highly suspicious. =]



At the time, I thought it would just be interesting to talk about the jobs available at Blizzard, and what that says about the company and internal operations. If I had known Blizzard was going to delete all references to their fraud-related internal investigations team - I would have taken more screenshots.



(FYI: There have also been postings for internal affairs and fraud specialists over the past year or so, in addition to the recent "Fraud Manager" job.)



Here are some other jobs that Blizzard has hired for in the past by the way:



* Facilities Manager & Facilities Coordinator -> hmmm, I guess that means their sites need to be managed (clean up, repairs, construction, etc.) * IT Administrative Assistant -> IT Managers do a lot, and they sometimes need help * Human Resources -> workers compensation, special needs, employee disagreements, personnel/HR related issues (assault, harrassment, etc.) * Senior HR Generalist * Company Nurse -> accidental injuries, general health management, emergency response, paper cuts, etc. * Human Resources Generalist -> more HR related jobs * Recruiter -> the ones who screen you first, first line of defense and IMHO one of the most important jobs in a company to ensure you hire the right people * Specialist, Learning & Organizational Development -> internal training, company advancement, etc. * Internal Affairs Representative -> monitoring the employees for fraud/theft/policy violations * Team Manager, Internal Affairs -> managing, coaching, and approving overtime for the investigation teams



(Sources: Nerd Dungeon, Archive.org)



In the end, the point I'm trying to make is this: Blizzard hires individuals to fill a need in the organization. One of those needs is to prevent, monitor, and investigate fraud within the company. Grn online



Prevention involves implementing security measures and software to prevent fraudulent activities, as well as creating effective internal policies (with follow up enforcement and education.) However, monitoring and investigations (this is their job responsibility) are both POST-incident activities. In order to catch someone in the act (monitoring), you need see the incident occurring and action. If the fraud activity is not caught but there is evidence, then it's fully investigated (reports, logs, paper trails, speaking to users involved, etc.)



So, they are hiring Fraud Specialists whose duties are to investigate fraudulent incidents that have basically already taken place. Therefore, this isn't really a "preventative" position, as that would fall under the scope of InfoSec / IT Security / Applications Development.



Note: When there is a billing accident (e.g. Blizzard bills you twice), that's not corporate fraud - that's just a simple mistake. Once you alert a Billing Representative, they can quickly and easily revert the charges for you. Although some people care calling these billing mistakes "fraud", it's far from it.. the Billing Department fixes these, there's no need for a fraud investigation to take place. When actual fraud occurs there are two things that happen: internal fraud or someone external trying to defraud Blizzard. What's important to note, though, is that the "Fraud Manager" description does not mention working with Credit Card companies, but it does mention dealing "directly with law enforcement" and the utilization of "internal fraud tools and system/site admin tools." All About Private Wow Servers



One other interesting item is that one of the primary skills required for this job is the "Ability to maintain extreme confidentiality." This makes it very difficult to obtain information on the position, but here's a couple Blizzard employees I found that were previously in the Fraud department:



Ian Wynne, Fraud Specialist - Source: http://www.linkedin.com/in/ianwynne



Interesting notes I learned from Ian:



* the "Fraud Specialists" title is kept out of public eye, instead they are called "Billing Representatives" in official announcements & postings. (See "Reputation Management".) * there are multi-millions of yearly loss due to internal fraud. * there's a Global fraud team. (See "Data Breach Notification laws", based by country.)



Andrew Bellinger, Internal Affairs - Source: http://www.linkedin.com/pub/andrew-bellinger/a/209/867



Interesting notes I learned from Andrew:



* moving up quickly within the company, do I see senior management in his future? =] * his job description was later updated to show "Internal Affairs work." Note, that's "internal affairs" not external investigations.



Additional details on Andrew show that his position is called "Internal Affairs, Account Administrator". Take note that he investigates internal employees for infringement of company policies. (Many people are still in complete denial of this, but it's very common practice in both Blizzard and other corporations - they need internal security teams to monitor their own employees for policy violations like theft of property or information.)



Patrick Nagel, Internal Affairs Representative - Source: http://www.linkedin.com/pub/patrick-nagel/20/3b4/986



Interesting notes I learned from Patrick:



* the "Internal Affairs" position involves documentation and maintenance of records about their internal employees. * there are external information leaks, which he also investigates. Grn online * there is large scale exploitation and collusion. This is actually pretty serious, and means that there are massive cover ups and conspiracies taking place within the organization (really though, a conspiracy is just 2 or more people working together to some end.) * also note that large scale exploitation wouldn't mean the occasional player exploited the game.. this is large scale exploitation within the organization (ie, theft of information and exploitation of said information) * there are internal investigations and reports of external impacts due to internal activities (e.g., fraud, theft & selling, etc.)



Stefan Modh, Internal Affairs - Source: http://ie.linkedin.com/in/stefanmodh



Interesting notes I learned from Stefan:



* he's on the Internal Affairs team that monitors Customer Support departments who are responsible for support WoW and SC2 customers. * he works out of the call center in Ireland



Addendum:



- To the Blizzard employees reading this. I'm sorry guys, but as a result of this posting you may see more stringent policies regarding information that you can post publicly. For example, certain job titles can no longer be posted on LinkedIn, etc.



- Even with this overwhelming evidence, it boggles my mind that many people are still convinced that internal security positions within Blizzard do not exist, or they tell others that "internal affairs" means investigating players for hacking, botting, etc. It's normal for businesses to investigate and monitor their own employees, especially if they have access to account or credit card information. Anyone who has worked in a corporate environment knows this. Unfortunately, there's a false belief (complete denial?) that Blizzard employees can do no wrong. Were you aware that most "Blizzard" customer support staff are in fact outsourced to overseas call centers (ClientLogic / Sitel) where they're paid poor wages? Surprisingly, most players are not aware of this.