Fraud Detection in Pokémon Go
I play Pokémon Go. (There, I’ve admitted it.) One of the interesting aspects of the game I’ve been watching is how the game’s publisher, Niantic, deals with cheaters.
There are three basic types of cheating in Pokémon Go. The first is botting, where a computer plays the game instead of a person. The second is spoofing, which is faking GPS to convince the game that you’re somewhere you’re not. These two cheats are often used together—and you see the results in the many high-level accounts for sale on the Internet. The third type of cheating is the use of third-party apps like trackers to get extra information about the game.
None of this would matter if everyone played independently. The only reason any player cares about whether other players are cheating is that there is a group aspect of the game: gym battling. Everyone’s enjoyment of that part of the game is affected by cheaters who can pretend to be where they’re not, especially if they have lots of powerful Pokémon that they collected effortlessly.
Niantic has been trying to deal with this problem since the game debuted, mostly by banning accounts when it detects cheating. Its initial strategy was basic—algorithmically detecting impossibly fast travel between physical locations or super-human amounts of playing, and then banning those accounts—with limited success. The limiting factor in all of this is false positives. While Niantic wants to stop cheating, it doesn’t want to block or limit any legitimate players. This makes it a very difficult problem, and contributes to the balance in the attacker/defender arms race.
Recently, Niantic implemented two new anti-cheating measures. The first is machine learning to detect cheaters. About this, we know little. The second is to limit the functionality of cheating accounts rather than ban them outright, making it harder for cheaters to know when they’ve been discovered.
“This is may very well be the beginning of Niantic’s machine learning approach to active bot countering,” user Dronpes writes on The Silph Road subreddit. “If the parameters for a shadowban are constantly adjusted server-side, as they can now easily be, then Niantic’s machine learning engineers can train their detection (classification) algorithms in ever-improving, ever more aggressive ways, and botters will constantly be forced to re-evaluate what factors may be triggering the detection.”
One of the expected future features in the game is trading. Creating a market for rare or powerful Pokémon would add a huge additional financial incentive to cheat. Unless Niantic can effectively prevent botting and spoofing, it’s unlikely to implement that feature.
Cheating detection in virtual reality games is going to be a constant problem as these games become more popular, especially if there are ways to monetize the results of cheating. This means that cheater detection will continue to be a critical component of these games’ success. Anything Niantic learns in Pokémon Go will be useful in whatever games come next.
Mystic, level 39—if you must know.
And, yes, I know the game tracks works by tracking your location. I’m all right with that. As I repeatedly say, Internet privacy is all about trade-offs.
Subscribe to comments on this entry
willmore • November 3, 2017 7:01 AM
As a player of an older Niantic game, I’ve been watching their responses to cheating for quite a while.
The group aspect, as you mention, is where it really becomes interesting. And it only explains part of the motivation to cheat.
Generating higher level accounts and gear (Pokemon in the case of PoGo) has two uses. The first is to generate a strong account that can be used for a disposable purpose–destroying a high level target in an obviously bogus way–or for comercial sale (and in this case gear as well is a commodity).
The latter can be addressed by preventing the goods from changing hands or destroying them once they do. For gear, ‘changing hands’ is easy to detect. For transfer of accounts, it’s much harder. But, if the fraudlent accounts can be detected than imposing limits on them–even if there is an element of randomness to it–can effectively devalue the product enough to deflate the market for the product.
The former use of fradulent accounts is the more damaging in terms of game play. All that a spoofer/botter needs to do is to grind an account up to level 8 and then deploy it to a remote location to take out a strategic target. Once the target is destroyed, there is very little Niantic has shown to be willing to do. Given the interconnected nature of events, it is very difficult to just ‘roll back the database’ to before when the spoofed attack happened. Events have been lost because of this use of spoofing/botting. And it has proven to be a huge impact on player morale.
I don’t know if any degree of AI will help in detering these behaviors. A human and a handful of heuristics can certainly do a good job of it. But the problem is that knowledgable humans are in low supply and companies like Niantic have a low incentive to combat these behaviors.