Have you seen my Avatar?
This is the last picture of my avatar, before I called Microsoft on November 21, 2011. He was wearing an Assassin’s Creed Desmond Hoodie and holding a Windows Phone 7. Have you seen him? I miss him. He’s needed in my man cave – to assist in killing time, hook-blading over roof tops, piloting tanks, tracking criminals as the Dark Knight and playing games of yester-year (NBA Jams). While he is no longer in the clutches of an evil hacker, he is being detained by Microsoft pending a security review.
On November 21, 2011, he was avnapped. Avnapped you say? Think avatar and kidnapping… I define avnapped as what happens when your virtual online identity is taken against your will and held for an indeterminate amount of time. It can encompass both the time where nefarious acts are done and also the time where the virtual online identity is restored. This isn’t identity theft – that is something much different, stealing credit card numbers and opening bank accounts versus the spending of virtual currency and posting undesired things on your Facebook wall.
As for avnapped, feel free to use it in a sentence with your friends. You’ll sound very cool. Watch it catch on on Twitter by using the #avnapped tag. You’re welcome, have a good day. 
For those of you who came along for the FIFA XBox hack account, please read on or just take my simple advice: change your password to your bank accounts and other important accounts (like XBox) often , DO NOT use those same passwords on other sites, and use another equally complex password for your secret question. I’m a software engineer by trade so I consider myself to be quite diligent with my online security practices. This experience taught me a lot more about password management.
Update - 1/10/12
Another call to Microsoft delivered some disconcerting news. Since November, my entire case was never escalated to the Unauthorized Access team. I respectfully delivered my malcontent to the customer service agent. I had a choice – either forfeit the MS Point losses or start the whole process over again. I said screw it and took the loss. Within the time it took to turn my XBox on, my account was unlocked and my avatar was back. I am still jaded. Microsoft – you failed this customer. Your whole resolution process failed. At least six customer service representatives touched my account through this process and no one figured this out?!?! Shame on you!
Update – 2/13/12
About a week or two after the last encounter, I was at work and got a text message that my login details had changed. Immediately I log back onto the site and set my credentials, changing my password but not my secret question. I get a text message informing me that my login details had changed, but then shortly later, I get another one saying they had changed again. I went to login and my account was locked. Thinking it was an auto-lock (from changing too many times), I went home and logged onto the XBox and recovered my gamertag. I poured over all the areas where I could have gotten hacked and came down to one option, either it was indeed a true compromise at Microsoft or it was one of my friends. I removed a bunch of friends that I didn’t know that well or hadn’t played with in months. About a half hour later, I get an email from the Microsoft security team saying they had completed their investigation and refunded my MS Points. While I’m glad everything got resolved, the whole thing was a horrible experience.
I listened to Major Nelson’s podcast this past weekend and heard Alex Garden talk about XBox Live security. I swear he read my website because he covered almost every point and piece of advice that I offered. If you haven’t heard the podcast, check it out and also read the open letter.
