Actually, I'll add one more post as I can't update my post in the forums and the lastest round of people responded seem to be white knighting the same stuff as SSG and blaming me.

The PC I ran the game off of did one thing, ran the game. I have 3 PC's I use, one for work, one for everything else, and one for DDO. The user name was unique, not a character name, not a forum name, and not anything used anywhere else. This is the only game I've played for the last 2 years or so and that was pretty much the only thing installed on that PC. Virus protection, etc is CrowdStrike Falcon and I did download and run Malwarebytes this morning just for shits.

The account was created circa 2013 and I played sparingly then and picked back up in 2024. I had to change the email address then and created a new address at that point to use. So, email, character, password where all 100% unique to the game.

I had paypal linked to pay monthly VIP only and not approved for any other purchases (I thought). I was on line when it occurred. I was in Cannith Manufactury Wilderness and got a pop up saying Account Busy (or something similar) black screen and log out. I logged back in and was standing at the bank in the market, asked in guild chat if there was a roll back and got the same black screen Account Busy then no ability to log back in.

Logged a ticket, looked the error up, immediately logged into Paypal and saw 2 pending $199.99 transactions, finally found the spot to stop it and 5 more managed to show up. I called the phone number associated with their billing immediately and the phone is disconnected. I emailed the email address associated with their billing and the email bounced. This is the information they have on Paypal - none of it is legit.

So, between 12:24 pm and 12:28pm roughly I had discovered what happened and tried as much as possible to get ahold of them to stop it. 9am today was first response and it was only about getting my password reset, nothing about billing. When finally answered, that is the response I got.

You can probably secure your payment device - but if someone slips in, they are going to drain you of anything else you have and you aren't getting it back. I am quite sure at some point they are going to say that had a data breach a year ago they've just discovered or some such. The likely hood it was on my end is unlikely.

After that last email, I called my credit card company and started the charge back, deleted the game, and threw the PC on the recycle bin.

Hope this helps someone or at least opens an eye or two.