"in the past few days I have seen a lot of players have their accounts compromised"
Must be players having out of date anti-virus and poor passwords! Couldn't possibly be a data breach at Riot!
"and check your match history every now and then."
Don't stop there, always keep an eye on how many Riot Points are on your account. If they go down, go to "Store" -> "Account" -> "Gift History" to find out who benefited from your account compromise. Riot won't restore the RP so you are completely screwed in that regard but at least you get to see where it went!
It might be a good idea to just do a full 10 minute review of your entire LoL account every day. Riot could do several things to improve security but won't because they don't care and take their lack of caring "very seriously."
"something that looks suspicious, be proactive and file a support ticket to explain the situation in detail."
You can then get a "helpful" response from "support" like:
"There isn't much I can do for your case as a Player Support, I'm really sorry"
The level of "seriousness" taken in the lack of escalation to Riot's apparent non-existent security team is breath taking! Every detail clearly of so much great importance to Riot support to ignore!
Could you still get banned for account sharing after pointing out to support your account was compromised? Support won't spoil that surprise by telling you! It seems the answer maybe YES! Or maybe no? Who is to say? Such fun! :)
"jot down some information about your account (such as your account creation date, skins owned, or other confidential information that only you would know)"
Yes, we should ignore that websites like Mobalytics might help determine publicly the date of the first match and help make a determination when the account creation date might be.
Also someone that has compromised an account to the extent they can play matches on it couldn't possibly know what skins are owned by the account. Out of curiosity, what does clicking on "Collection" -> "Skins" show again?
"Stay safe out there."
Yeah. Right.
It should also be stated that if you want to get the full details on what IP address someone logged into the account from, what they said in chat and other details, you can do so by submitting a ticket. An automated reply will be provided by Blitzcrank bot (I'm not make a joke, this is how "seriously" Riot takes this) and you will be told to NOT change your password for 30 days or your request for the information will be void.
Again, I am not making a joke no matter how much it may sound like I am. If you are trying to get details about an account compromise, Riot's taking things "very seriously" solution is to discourage changing your password for 30 days even if it seems like your account might have gotten compromised again during those 30 days!
Things you should NOT expect Riot to do:
(1) Riot will not require a 2FA verification code if you use the League of Legends game client. 2FA verification may help prevent someone be able to play matches from an untrusted device but the game client is always trusted from all devices. Riot believes 2FA is only a web browser security method.
(2) Riot will not provide a method to review recent login IP addresses immediately without waiting 30 days. That would just be too damn helpful and Riot want you to talk to "Blitzcrank Bot" instead.
(3) Riot will not require 2FA verification on the website BEFORE confirming the password is correct. An attacker can use the web site to brute force the password and then ignore the 2FA step. Since the League of Legends game client doesn't require 2FA, they are golden.
(4) Riot will not use a cell phone app based authenticator system similar to Google Authenticator. If you wanted the security provided by something like Blizzard Authenticator then you would be playing Heroes of the Storm instead. Or if you wanted security provided by something like Steam Guard Mobile Authenticator you would be playing Dota 2 instead. If you are playing LoL then you want the frustration of not having that. There is a League Friend mobile app but you should never expect a smart phone security app from Riot.
But remember, keep anti-virus up to date because that way Riot doesn't have to acknowledge there should be anything they should change on their side! Also run Windows Update since that also will change nothing about Riot's attitude towards 2FA or easy access to last login information!
Happy mass account compromise month! Here is hoping to Riot changes nothing and October can be record breaking!
Thanks for the heads up Hotarµ! I'm glad you got our back.
Such joy and wonderfully insecure gaming experience -- GLHF!
