It's a rich man's virtual world

Financial institutions must heed the online antics of gamers and their virtual realms, where make-believe characters now own imaginary goods and property to the real value of US$2-5 billion

By Stephen Wilson

February 20, 2009

The advent of virtual currencies has been little more than a curiosity in the minds of many – and I include myself among the cynics that didn’t ‘get’ virtual worlds (VW) and online gaming. But I recently discovered that the real money trade in virtual objects – that is, make-believe stuff owned by make-believe characters – is well in excess of US$2 billion per annum. So now it has my attention.

In 2006, celebrity virtual land baron Anshe Chung (the avatar of real-life figure Ms Ailin Graef) became the first real dollar millionaire in Second Life. Frankly, to some of us, this just seemed silly. A new type of cyber land grab had started, but who knew what the future was to hold? It was always going to be hard to separate virtual world hype from reality – especially when the typical champions of virtual reality (VR) tended to speak as though they were really in role all the time. But barely two years later, the reality turned out to be very serious indeed.

I was frankly shocked by the recent report Virtual worlds, Real money from the European Network and Information Security Agency (ENISA); see www.enisa.europa.eu or http://tinyurl.com/VW-RealMoney.

It details how much real money is turning over in (and around) virtual worlds and massively multiplayer online games (MMOGs).

ENISA quotes careful calculations that real money sales of VW objects exceeds US$2 billion per annum. This estimate is conservative, because most ‘Real Money Trades’ (RMTs) are conducted in a black market not sanctioned by the game operators. Typical VW and MMOG end user licence agreements do not confer legal title or property rights in virtual objects (although there are conspicuous exceptions such as Entropia Universe, which from the outset was constructed with a real cash economy).

Other sources reckon that RMTs actually exceed US$5 billion per annum. There’s a multitude of ways for virtual currencies to be converted, bound only by the imagination. Clearly, the opportunities for money laundering are becoming acute, but no good data is available on that as yet.

Up for the game
Some of the companies that operate these games are doing very well. Sulake Corporation owns Habbo Hotel (with more than 100 million users) and was recently valued at US$1.25 billion. Rumoured valuations for Second Life have ranged between US$500 million and US$1 billion. Swedish listed company MindArk owns Entropia Universe and reports annual revenues of US$360 million. Leading Chinese social networking service QQ reported 2007 earnings of US$523 million – nearly four times the revenue of Facebook.

Banking in virtual worlds is regulated in-the-game; to run a virtual bank, you need a virtual banking licence. But these are worth money in the real world. Big money. Entropia Universe in 2007 auctioned five virtual banking licenses for the impressive sum of US$400,000.

In the most significant blurring of worlds, there was (for a time) the Entropia Universe Cash Card with which Project Entropia Dollars could be withdrawn in local currency at many ATMs. In 2007, the card issuer and the small bank that backed the debit scheme ran into apparent regulatory strife, and the ATM network withdrew support. It doesn’t look like any other institution has since stepped in to revive the Entropia ATM card, presumably because the regulatory picture remains so grey.

VR property development has grabbed most headlines, and indeed a great deal of Second Life’s own reporting concerns acreage and land sales, where much of the more legitimate transaction volume occurs. Entropia Universe, it is claimed, has the world’s most expensive piece of virtual real estate – a nightclub called ‘Neverdie’ – reputed to have a potential real world market value of US$1 million.

Enter the criminal element
And now inevitably, organised crime is following the money.

There are some very sophisticated ways to steal from game players in a virtual world, including taking advantage of bugs in the operator software. Yet the easiest way for criminals to exploit VW resources is simply to steal the log-on credentials of players. Identity theft provides the attacker with complete access to a player’s virtual objects and their virtual money.

In fact, the number one risk listed by ENISA is avatar theft.

So what’s being done about this?
At least two of the leading sites offer two factor authentication. The Blizzard authenticator for World of Warcraft is an event-based, one-time password generator. More intriguing is the ‘Gold Card’ kit offered by Entropia Universe – a smartcard and stand-alone reader that displays one-time passwords (see http://www.entropiauniverse.com/en/rich/6399.html).

The card is available to all players for US$20 (including shipping), but is given away free to high worth players who have $500 or more deposited in the game.

I wonder what other functionality MindArk has in mind for its smartcard going forward? It would be the ideal vehicle to resurrect its stalled ATM debit card, and it opens up great co-branded marketing opportunities for financial institutions.

So there are all sorts of reasons for the banking industry to keep a close eye on virtual worlds and online games. They will attract more and more scrutiny around virtual currency exchange and money laundering. And, strategically, they may turn out to be an important ‘sand pit’ in which to experiment with leading edge identity technologies.

Stephen Wilson is a leading international authority on identity management and information security. In early 2004, Stephen established Lockstep Consulting to provide independent security advice and to develop new smartcard solutions to identity theft.