Tell HN: Microsoft locks migrated Minecraft accounts, requires phone to unlock | Hacker News Reader

Tell HN: Microsoft locks migrated Minecraft accounts, requires phone to unlock

238 pointshn2019125 comments

Earlier this year I migrated each of my children's Minecraft accounts to Microsoft accounts as Microsoft no longer allows launching Minecraft with a Minecraft account.

About a month after doing the migration while signing in to one of the Microsoft accounts I was presented with a message from Microsoft that the account was locked due to activity on the account that 'violated their terms of service' despite no one using the account since the earlier migration.

The only way to unlock the account is to provide a phone number in order to receive a confirmation code. There is no email option provided to receive a confirmation code, and the only way to contact support directly is by signing in to the account (can't be done while the account is locked).

Prior to the migration from Minecraft to Microsoft I never had any issues with using any of our Minecraft accounts.

Whoever at Microsoft thought this was a good idea is causing them to lose business.

View on HN

Can Minecraft be played without giving MS a Phone#? - https://news.ycombinator.com/item?id=30617884 - March 2022 (33 comments)

Mojang to Require a Microsoft Account to Play Minecraft - https://news.ycombinator.com/item?id=30515742 - March 2022 (143 comments)

Last call to voluntarily migrate Java accounts - https://news.ycombinator.com/item?id=30278313 - Feb 2022 (105 comments)

I have a 13 year old minecraft account. I've been unable to migrate it because I don't have the transaction ID. I don't have the email (I wasn't very good at managing an inbox when I was 14), and the bank that it was bought with no longer exists, even if they had more than 7 years of records retention. I told support I can provide government IDs for myself and my father (the name on the card, presumably), but I got told, basically, to get stuffed. TID or bust.

My only guess on what to do next is to try to find someone with an inside at Mojang to workaround the user-hostile process, but I've had no luck. If anyone knows how to workaround this, I'd appreciate it.

If it makes you feel better, having the transaction ID wouldn't help. I'm in a similar situation except I do have the original PayPal transaction ID, and when I provided it I was told: "Sorry, our system for looking up transaction IDs is currently unavailable. You'll need to provide alternative proof of ownership. No, the original email address associated with the account isn't good enough. No, we won't tell you what is good enough."

Tried again a year later and got exactly the same response.

Mojang's system does not like PayPal transaction IDs and they have issues looking them up. Keep trying over and over, email them from the original email associated. Eventually you'll find an agent who will ignore the Transaction ID entirely and give your account back unless it has a high value in which case you're out of luck.

I thought government ID would be a silver bullet. We have a relatively unique family name, and my father should be an exact first+last match on the transaction, and my ID first name is an exact match for my account name. Should I just open a support ticket every week until I win the support lottery? Sounds like a recipe for irritating the wrong person and getting it manually locked. lol.

My Pinterest account got locked for no reason. I found a video which said "just bug the shit out of them", so every day I put in an appeal which was rejected every single time for about 3 weeks and then someone said "fuck it" and unlocked it.

On the flip side, I had a bank account with Square (now Block) and their support took me to a dead end, so I called one of their executives on his cellphone and politely explained the problem to him. That got my account fully terminated with no recourse.

Well, part of the problem is that they deny that my email address is the correct one, even though I still have the PayPal receipt with that address sitting in my archive.

I've dealt with their support team literal hundreds of times. That sounds about right for them. Could it have been possible that you purchased the game on another email, and used the PayPal email to simply pay for the game? Usually they fail to confirm the trans. ID if it's PayPal, but other than that they should be accurate on the original email, so if they say it's wrong, it's probably wrong. Did you get any emails from Mojang to that email in the past, about password resets, unauthorized migration etc?

> No, we won't tell you what is good enough.

that's like from a surreal comedy. That's how megacorps look down on humans.

If it's any consolation, Microsoft support for their business / enterprise / cloud services are equally as useless.

I've had Azure support point the finger at the sole 3rd party vendor for one of their services only to have it pointed back at them. This didn't get solved until I put everyone and their managers in the same email.

You see, Karens know how to gets results...

You probably don’t want to reward them with extra income, but if it can at least get to the username change screen with your current account you could change your username, wait 30 days, and then buy a new account with your old username.

My user name is a common real-life first name with no numbers or symbols. So, since username transfers to a specific new account are not possible, I would almost certainly lose the name to a sniper with a script. I know there's a whole industry around that practice.

Not that i approve/excuse it, but it could also be why you must jump through so many hoops to get access to the account. There's a big black market on "OG" minecraft nicknames.

I get the impression that the process isn't special for me, particularly given everyone else's own personal horrors, as detailed in this thread.

Indeed. Mojang's support is hostile to users with rare usernames. I've seen it first hand and have lots of stories about it. Mojang's support system is honestly one of the worst support teams I've dealt with.

Befriend someone at Mojang or get a job there lol

That seems like the only reasonable option these days.

Got a reasonable problem with a small business, or even a bank? Just go to the nearest branch and talk with a reasonable person.

Got a minor issue with a tech company? Godspeed and good luck, better find someone able to escalate the problem internally, while possibly breaking some rules.

If only dealing with a bank were that easy. Maybe if you give them an easy one.

Smaller businesses definitely are more receptive and seem to take more responsibility, maybe because when you have less customers, each one is more important. That said, they also have less resources to actually rectify certain kinds of problems. So it’s not always that simple, either.

Sleeping with employees seems to work to solve issues with tech companies:

https://www.dailydot.com/irl/kittylixo-onlyfans-instagram-em...

Should make for an interesting cover letter, probably help you get through HR.

This reminds me of when LoL migrated accounts when I wasn't playing. Somehow it matched me up to a lvl 5 OCE account I made years ago to play a couple of games with the friend that had the same name and the original account with lots of rare skins and which I spent a lot on over the years is just gone. I filed support tickets years ago and never got any response at all. Nothing, just a black hole.

I completely gave up on Riot after that. I'm not playing any of their games now and I don't see myself going back to them, which is kinda sad, because I met my wife in LoL so there were some fond memories.

So for all the people out there who design these account transitions, please remember, you can permanently lose customers from stuff like this. Oh, I probably have a Mojang account somewhere, too, but I lost it ages ago and I won't go back there, either, at this point.

Is small claims court a successful venue for remediation?

Do they not have an arbitration clause?

They cant force you to arbitration while claiming you are not their client.

I was in a similar situation as well. Based on my conversation with the support staff, it seems like they are not allowed to access customer information without the transaction ID. At least unmigrated Minecraft account still works, despite them saying they wouldn't be accessible after March.

Similar story here. Old Minecraft account bought it because Java nice cross platform, could not merge account for some reason (don't remember which but support wasn't able to solve).

As a parent this is one of my pet peeves as so many services for kids assume/require a phone number.

I’m sure it has nothing to do with me getting so much phone spam as to turn off my ringer.

Microsoft has been a real jerk with the Minecraft acquisition. It would be so much better for users had notch never sold. They are increasing prices, making it harder to start, removing mod functionality, and basically just all bad stuff.

As much as I hate to defend Microsoft (and moving Minecraft to MS accounts is annoying and stupid), this isn't true:

> They are increasing prices

Same price as ever: https://www.minecraft.net/en-us/store/minecraft-java-edition

> making it harder to start

Not sure what this is supposed to mean?

> removing mod functionality

The opposite of reality, for example they started releasing java mappings last year

> and basically just all bad stuff

Minecraft is more popular than ever, and other than the MS account stuff recent updates to the game have been positively received. Other conspiracy theories like "Microsoft will get rid of Java Edition and make bedrock the only version!" have not come to pass.

> They are increasing prices

What I meant is that there are now micro transactions to buy cosmetic things. And ads in game, in windows, on Xbox, and everywhere to buy them.

Minecraft was a one time purchase and now it’s a service revenue stream. So as a gamer and a parent, the price is much higher.

Not to mention having different versions that don’t work together so there’s Java edition and bedrock that are different purchases. I also have multiple kids and Minecraft doesn’t let you share profiles so after hearing the kids argue over which skin to use I broke down and bought multiple accounts.

Microsoft made Minecraft a less fun game so they would make more money. The game made billions of dollars and that wasn’t enough. They wanted extra billions.

Minecraft: Java Edition has none of these flaws and is the superior experience in basically every way. Unfortunately, the cost you pay for that is that the game only works on "normal" computers, no console/mobile support.

If you specifically mean Bedrock Edition has problems, I agree with you, but it's been that way for a long time.

It's been 7+ years since Microsoft bought Minecraft, I'm honestly surprised it took this long for them to do this customer hostile stuff. We had a good 5 years before they started ruining it.

"Embrace, extend, extinguish"

I....don't see how that applies here.

I was setting up an account for my child and it insisted on knowing their first job as one of the security questions. I normally put PIN-type responses to these and record them somewhere, but it said that wasn’t a valid answer. So many of these systems just aren’t very well thought out.

Whats worse is if you want to find a VOIP app to have a dedicated number for these one off requirements you risk eventually not being allowed to use it due to VOIP number or whatever.

Waiting for them to get rid of traditional Minecraft so they can monetize everything and lock it into Windows.

> Microsoft that the account was locked due to activity on the account that 'violated their terms of service'

What I dislike here most is that the explanation is probably a lie. If someone violated the rules then how providing a phone number can fix this? You are allowed to violate the rules if you leave a phone number?

I remember a similar case. I registered email at outlook.com and after I tried to log in from slightly different IP (because my ISP uses dynamic addresses) there was a message that there was a "suspicious" activity, someone might be trying to log into my account and I must provide and confirm a phone number to access my account. I don't understand though how this can help if someone indeed had stolen my password. They could just provide their number and get access to an account.

Also, Microsoft promised that they won't store my phone number. This is also strange. What's the point of asking for a phone number if you aren't going to store it? I think this also was a lie, and in fact they were storing something like a hash of a phone number and thought that this can be considered as "not storing a phone number".

So basically what I don't like is the deceiving language that they use instead of being frank: we want to know your identity. They behave just like those Indian scammers who persuade people to buy gift cards.

They want a phone number to make sure you're not a spammer taking over the account.

Then the message about someone else trying to get access to an account would be a lie. Also it is unclear how a phone number can prove that I am not a spammer. I think that just looking at a number of emails sent would be a better metric.

A spammer probably has many throwaway phone numbers to use, since they are likely to care much less about companies harvesting data anyway.

Just a developer (for Excel). I don't work on Minecraft or anything related but I'm happy to (try and) escalate this internally in Minecraft and/or identity through the internal channels. You can email me at bgruenbaum@microsoft.com

The point to be made to your colleagues is that requiring people to provide a phone number in order to unlock a Microsoft account is driving those people away from other Microsoft products, such as Excel. So effectively, the poor account management practices at Microsoft are putting your job at risk.

The community has been complaining about this for months, if they don't know that this is a ubiquitous issue, they have their head in the sand.

I'm not OP, but I think I can speak for them when I say that you're a life saver! I too faced this issue a week ago, but for sake of convenience I just gave my number to them. Seriously, thank you.

You're doing the Lord's work.

This also happened to me (twice) with ms accounts used only to log into Skype. And I just migrated my Minecraft account 2 days ago, let's see how that plays out...

This just sounds to me like a "technically, you don't have to provide a phone number to create an account. Of course we will just lock it afterwards, but _technically_ it's not required..."

This is true, I've seen the same. In general,their takeover of MC has wrapped a lot of unwanted red tape around access to our minecraft playing.

For anyone who knows history, this is the least surprising outcome :-)

Agreed. And after years of enjoying and relaxing in Minecraft, when they started this new account politics in violation of our (original player base) agreement with Mojang; I quit playing Minecraft.

As someone who had a lot of old accounts with some pretty OG names, this whole migration process has been a right headache 'cause now I have a ton of burner Microsoft accounts ('cause each MS account can only have on MC account) and each one needed verifying.

What's even more lovely about that process is that you have to be very certain you want your MS account's name associated with your Minecraft username. Your MS account's name is automatically used as your Xbox live name. The setting to hide your Xbox live name is only available on Xboxes.

If you want, you could sell your accounts, as the market's gotten bigger and prices are better for names now (unlike in 2016 when names were $50 each). What names do you have, out of curiosity?

They already got your money when you bought the game for your kids. They don't care whether or not you ever play it again, and in fact their server costs are probably lower if you don't.

How do you know they got his money though? Minecraft was released in 2011 and Microsoft bought it a few years later. To me it seems like Microsoft want people to buy their Minecraft spinoff, so they are making it harder to play the original game.

Pretty much. I bought the game ~10 years ago and didn't want to migrate to a Microsoft account, but I have no recourse. They don't care. So I can't play anymore even if I wanted to.

There's an in-game marketplace where you can buy a number of cosmetic upgrades and such with "Minecoins", which are sold similarly to other in-game currencies. Looks like $20 for 3500 coins.

But I thought this forced migration was for Java Edition, and that Minecoins were only for Bedrock Edition.

Minecoins? Jesus Christ. Glad I’m only on Java.

It's a datapack and map marketplace

For now.

monkaS

That was quick

https://www.msn.com/en-gb/money/other/java-and-bedrock-editi...

microsoft purchased minecraft to get an "in" with things kids were actually doing, not just for money. They do care if people, especially kids, continue to play.

Due to Microsoft's disgusting behavior regarding forced migrations for children, Minecraft is no longer played in my household. That's really sad, too, since it was one of very few games my entire family enjoyed. It's also the game I have the most hours in.

Good job, Microsoft.

switch to minetest.

it's Free Software. you can host your own family server just by running the game on one machine and have everyone else connect to that. my son does it all on his own, and he invites his classmates to come over and play with him locally. there are also some family friendly public servers.

Minetest is probably one of the best Foss Minecraft alternatives out there. It's incredibly stable, it works on pretty much ever piece of hardware, and to top it all off, it's ridiculously easy to mod it with Lua.

Same. Roblox won out in our household. It doesn’t help that multiplayer is so much harder with minecraft

Microsoft is involved in forced migration of children?

My kids have minecraft and it's a fucking nightmare. We lost one aged account because of login issues, and similar to the OP here, one tablet is now locked out with seemingly no way of recovery: I tried calling, emailing, signing up to xbox, but basically: fuck off, you've lost the 25 quid and all your worlds.

Twitter did the same and got penalised, it's just the way people behave now under the guise of "security" - I'd raise this with whoever the competent (ha!) DPA is wherever you are and see what they say

How did they get penalized?

https://www.bleepingcomputer.com/news/technology/ftc-fines-t...

That isn’t the same thing unless Microsoft is using the phone number to target ads.

Who says that they don't? Microsoft has heavily invested in advertising since Windows 10.

Keep in mind that Twitter does the exact same thing (locking accounts and requiring phone numbers to unlock) since a while ago and recently got caught "accidentally" using those numbers for tracking reasons. Facebook also got caught doing the same some time ago.

They all do it under the guise of security, Google, Microsoft, Twitter etc

They certainly aren't using it to verify I am who I am....

I had them lock a MS account I made for a 2nd/alt account (Something I bought years ago to help when I made plugins and game content)..

Account got immediately locked the second I tried to use the launcher for "suspicious activity, give mobile number NOW to regain access".

I tried fighting it for a month, Mojang buried their head in the sand. I've even seen youtubers with multiple millions of subscribers get hit by this bullshit, with no help from Mojang.

They already have the email address I associated with the Minecraft account to begin, that should be good enough...

Mirrors the general issue with Xbox x Microsoft x Windows integration. It's never not a disaster.

Amazing to me that account management is such an unsolved problem for MS.

It's also why I'm extremely reluctant to buy MS games you have to install and log in to using the Xbox/MS Games ecosystem.

First, Microsoft bought Mojang.

Then, they developed new Minecraft games that do not support Linux, unlike the original.

Finally, they require a Microsoft account to play.

Well, guess what: I am not using Windows, and I am certainly not going to use a Microsoft account.

Product managers at Microsoft can go all fuck themselves with a voxel torch.

Up until 1.18.30, you could play Bedrock edition on Linux using mcpelauncher. Sadly, with 1.18.30 MS switched MCPE over to their RenderDragon engine, and the mcpelauncher community has yet to find a stable workaround.

I lost my account from 2010 in the migration, because they require the transaction ID of the original purchase. The support person told me that the transaction ID was a key to the account.

I don't understand requiring a transaction ID to migrate. Is that really a necessity?

I almost certainly don't have the transaction ID (I haven't yet tried to migrate), but I also certainly do not expect that they can require that I supply for a successful migration.

Requiring this is akin to stealing something I bought. Are people okay with Microsoft stealing from them? I'm certainly not.

This sounds like fruitful ground for a class action suit, if true.

It's possible that the TOS message is boilerplate that they put up when they haven't created (and localized) an appropriate message for the real reason (or they don't want to reveal the real reason).

To me it sounds like maybe they detected a successful credential stuffing attack against the accounts and locked them. That said, it sounds like their recovery process leaves a lot to be desired.

I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the username was secret, as it was random and not used anywhere else).

Locking accounts for "security reasons" and requiring a phone number is a common tactic to harvest phone numbers for "growth & engagement" reasons. Twitter does that since a while ago and recently got caught "accidentally" using those numbers for tracking reasons.

The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number - if the account was actually breached, the attacker will trivially bypass the restriction by just providing a phone number they control and take over the account anyway.

>The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number

From a security standpoint, the point of requiring a phone number is to increase the expense of the request -- like a captcha.

(Not to say that there is a real security purpose in this specific case.)

Yeah, allowing someone to enter an arbitrary phone number is actually worse security than sending the confirmation code to the email address associated with the account.

This is not a triggered action as Microsoft locks the account immediately and reliably.

This isn't a recovery process as Microsft doesn't ask you to reset credentials and claims to not keep the phone number associated with the account.

This is some sort of incredibily user hostile anti bot technique.

> they detected a successful credential stuffing attack against the accounts and locked them

And how providing a phone number can help Microsoft to distinguish a real owner from an attacker?

Is there an open Minecraft clone? Because this is getting kind of ridiculous…

I'm sure there are plenty of cracked launchers around, and there is no ethical issue with using those if you already paid for the software once.

Those don’t work in the app stores (at least, not without jailbreaks, which is another exercise…)

TLauncher is very good.

Minecraft is the closed clone of the open Infiniminer IIRC. There are a ton of clones, but for a lot of people it's the social aspects.

Putting my kids account on 'Xbox Games' (we don't have an Xbox, nor ever will I expect) for whatever bs reason we had to do that was a complete mess.

Right. I should have clarified further, an open/free clone that is available in the app stores and supports multiplayer.

minetest is FOSS and multiplayer. with desktop and mobile apps.

There are numerous. https://www.minetest.net/ is pretty popular.

actually, yes

I don't think this will be that useful, but for what it's worth, I had the exact same issue. My kid's account is marked as a child account, and linked to my adult account (which was a nightmare in itself, but that's another story).

I don't know what I did, but I did eventually manage to get it unlocked. I basically went through every possible permutation of links, which is why I don't remember what worked. It was something to do with unlocking it from the parent account, after _re-linking_ it to my account.

Sorry I can't help more than that, but at least you know it's possible now ... somehow ;)

P.S. The "security" of allowing a child to link their account to anyone who asks them to enter their email address is hilariously terrifying.

Ye, companies are terrible with accounts. Found out I had made an Apple account in 2010 by getting an email that the security questions had been changed to Chinese. Reset the password to go delete the account but was not allowed to sign in without responding to the (Chinese) security questions. Tried contacting support and asked them to delete the account, from the email registered with them, noting that no one has used the account in 10 years and it was created in Sweden so it was obviously hacked. They said they are not allowed to do that, and the only option is to login with the security questions or book a time for a phonecall where I can prove my identity so they can reset the security questions..

> or book a time for a phonecall where I can prove my identity so they can reset the security questions

I do not see the problem with this, when it comes to account deletion you want to be very careful and this sounds to me like a very reasonable offer.

I don't see how Apple can verify identity to reset security unless they verified identity to setup the account, and as far as I remember, Apple doesn't require an identity verification to setup accounts.

If the identifier is an email address, it should be relatively easy to disown an account if you control the email address.

I had a similar issue. I called them, and they allowed me to delete the account if I provided ownership of the email. I'd recommend calling them, takes a while but it works.

>The only way to unlock the account is to provide a phone number in order to receive a confirmation code.

You can use any phone number you have access to. It doesn't need to be a unique phone number for each child.

And Microsoft could send the confirmation code to the email address already associated with the account, but they would rather create a reason to siphon more data from people.

Has anyone come up with a disposable mobile number service, similar to how you can get a temporary email address for signing up to junk?

They exist, but this is likely a very bad idea. Most services that I've found, once you use a mobile number with them they never really remove it and the next thing you know, they are sending some stranger SMS messages to change your password per their "secure" 2FA requirements.

I can confirm this is a bad idea. Many many services permanently use it as some kind of fall back recovery, even after the phone number is removed and recycled and no other one is added.

MS blocks most of the disposable number services.

> About a month after doing the migration while signing in to one of the Microsoft accounts I was presented with a message from Microsoft that the account was locked due to activity on the account that 'violated their terms of service' despite no one using the account since the earlier migration.

I had to create XBox accounts for some PC games my kids were playing. Used unique email accounts on my own mail server. A week in got a message upon login that "Your email account was hacked" (verbatim) and then it demanded a phone number.

Fucking liars.

I don't seem to be able to migrate any of my children's accounts, the onboarding process just fails in strange ways. Got tired of trying to make it work.

That's the thing, what business are they losing exactly? I don't think it even registers in their annual accounting.

I've heard so many stories about people being locked out of their accounts, but I've never heard about what happens if taking legal action to regain access. How is that not a thing yet? Or does it just work so well at getting human attention that it isn't even worth writing about?

You’ll see the same problem with Roblox and children accounts. We’ve paid for piles of robux, I had a child account linked to my email. It no longer seems linked and cannot reset it, I’ve sent 10s of emails but only get automated responses.

Gaming industry don’t care

Yes, they are doing that. Had the same experience and several of my friends also.

Haha, nice try, can't login to skype since 2011, old login info I was using it with was just gone prompting me to create new MS account with the same email, no message history or contacts preserved whatsoeever

Sounds like a dark pattern to harvest more user data, which is basically the entire business model of most of the Internet.

We're getting to the point that the entire consumer computing ecosystem is one big dark pattern.

Could you buy a SIM card with one month's PAYG on it? In the USA I have a Boost account that is only $15 for one month, no contract.

Since Microsoft bought Minecraft, consider regular login broken. I just want to play Minecraft, not be part of your cloud solution.

Had to deal with this for an alt. account....

Not a lawyer, but....

Given how many children play this game.... locking access to the accounts and demanding PII from minors seems like a recipe for the EU to put GDPR to use for once...

Authentication and printers. The two hardest problems in Computer Science.

My son encountered the exact same issue. We've given up.

not Microsoft, but i can't login into web version of VK anymore because they started requiring adding phone number to existing accounts

Migration was a total nightmare for my family too.

if you're in europe, report them for a GDPR violation

even thought i bought the game back in the days, i still play a pirated version, 0 hassle, all the fun!

Reply on news.ycombinator.com