Microsoft refunds Xbox Live phishing scam victims

Microsoft Xbox Live users have been hit by a phishing scam on their bank and credit card accounts. Photograph: Microsoft

Microsoft is refunding or sending out warnings to thousands of Xbox Live subscribers who may have had credit card details stolen as the company steps up its investigation into the scam attack.

The US technology company has advised Xbox Live customers to change their passwords after a number of accounts were hijacked as part of a phishing scam on the online gaming service.

It is understood that scammers in China or Russia are suspected of being behind the attack – not the computer-hacking collectives LulzSec or Anonymous. Scammers are believed to have gained access to some XBox Live accounts via an "automated scripted attack" sent by email.

Microsoft has played down the phishing scam in an attempt to distance it from the Sony PlayStation Network attack earlier this year that affected more than 70 million gamers.

The company has denied that Xbox Live had been "hacked or breached", but said a small number of users in the UK had reported unauthorised access to their accounts.

Fewer than a million Xbox Live users are thought to have been affected worldwide. However, Microsoft is continuing its investigation and has not ruled out an increase in the number of phishing emails before Christmas.

Some gamers have been scammed out of "multiple purchases" of £42.50, according to the Sun, which first revealed details of the scam attack on Tuesday. Microsoft is understood to be contacting and refunding those customers.

"We take the security of the Xbox Live service seriously and work to improve it against evolving threats," a Microsoft spokesman said.

"Very occasionally, though, we are contacted by members regarding alleged unauthorised access to their accounts by outside individuals. We can confirm that only a small percentage of Xbox Live customers have been affected here in the UK.

"We work closely with impacted members directly to resolve any unauthorised changes to their accounts and, as always, highly recommend all Xbox Live users follow our account security guidance in order to protect their account details."

Microsoft said there was no evidence that customer information had been released or sold.