When Your Friend's Gaming Account Is Hijacked and Sold Without Permission
01 — UNDERSTANDING THE CASE: WHAT HAPPENED?
Imagine a student named Kevin who has spent years building his online gaming account on a platform such as Mobile Legends, Free Fire, or Roblox.
The account holds both emotional and financial value because it contains items, skins, and a history of achievements that Kevin purchased using his allowance.
One day, his school friend, Aldo, takes advantage of Kevin's carelessness while they are playing a game together to observe Kevin's account password.
That night, Aldo logs into Kevin's account without permission, changes the linked email address (bind email), changes the password, and then sells the account to an online buyer for millions of Indonesian rupiah.
When Kevin can no longer access his account, Aldo repeatedly claims that Kevin's account was probably hacked by an unknown person.
However, Kevin discovers that his account was being sold through a post on Aldo's social media.
Kevin experiences both financial and emotional harm.
Aldo believes that his actions are merely an internal issue within the gaming world and cannot be legally prosecuted because a gaming account is not considered a physical object.
This situation raises two important questions.
Do gaming accounts, usernames, passwords, OTP codes, player IDs, and game data stored within an account qualify as Electronic Information and/or Electronic Documents protected under Indonesian law?
Does taking over a digital account and selling it without the lawful owner's permission constitute a legal violation in the real world?
Note: Kevin and Aldo are fictional characters. This scenario was created solely for educational purposes and to promote legal literacy among students.
02 — ISSUE: WHAT ARE THE LEGAL QUESTIONS?
The Main Question
Can someone face criminal or civil legal consequences for taking over, changing access credentials, and selling another person's gaming account without permission?
Several legal issues need to be identified:
- Are gaming accounts and the access data associated with them protected as Electronic Information or Electronic Documents under Indonesian law?
- Does logging into someone else's account without permission satisfy the legal elements of illegal access?
- Does changing a password and linked email address without authorization qualify as damaging or modifying electronic data?
- Does selling an account obtained through a takeover satisfy the legal elements of fraud or embezzlement that causes harm to another person?
- What happens if the gaming account is connected to personal data, such as the owner's primary email address and telephone number?
What Does This Mean for Students?
Digital assets, such as gaming accounts, social media accounts, and electronic wallets, have real legal value and protection.
Accessing and taking control of someone else's account without authorization is not merely "mischief in a game." It is an unlawful act.
03 — RULE: WHICH LAWS ARE RELEVANT?
A. Electronic Information and Transactions Law (ITE Law)
1. Protection Under the ITE Law (Law No. 11 of 2008 in conjunction with Law No. 1 of 2024)
The Legal Status of Gaming Accounts and Access Data as Electronic Information or Electronic Documents
Article 1, Point 1 — Electronic Information
Electronic Information refers to one or a collection of electronic data, including but not limited to writing, sound, images, maps, designs, photographs, electronic data interchange (EDI), electronic mail, telegrams, telex, telecopy or similar forms, letters, signs, numbers, Access Codes, symbols, or perforations that have been processed and have meaning or can be understood by a person capable of understanding them.
Article 1, Point 4 — Electronic Documents
An Electronic Document is any Electronic Information that is created, forwarded, sent, received, or stored in analog, digital, electromagnetic, optical, or similar forms, which can be viewed, displayed, and/or heard through a computer or Electronic System.
This means that gaming account data stored within an electronic system and meeting the elements of this definition may be categorized as Electronic Documents.
A gaming account consists of a collection of electronic data, such as usernames, passwords, user IDs, linked email addresses, transaction histories, and digital assets within the game.
These data meet the qualifications of valid Electronic Information and Electronic Documents that are protected by law.
Article 1, Point 5 — Gaming Platforms as Electronic Systems
The gaming application or server where the account is hosted is categorized as an Electronic System.
Article 30 — Prohibition of Unauthorized Access / Illegal Access
Every person is prohibited from accessing another person's Electronic System or computer by any means without authorization or unlawfully.
Observing someone's password and then logging into a friend's gaming account without permission directly violates this article.
Article 32 — Prohibition of Unauthorized Modification or Damage to Electronic Data
Changing passwords, modifying linked email addresses, or deleting or transferring items within a gaming account without the lawful owner's permission satisfies the elements of unlawfully altering, adding, reducing, or transferring Electronic Documents or Electronic Information.
2. Protection Under the Personal Data Protection Law (Law No. 27 of 2022)
Articles 65 and 67 — Unauthorized Disclosure and Use of Personal Data
Most gaming accounts are connected to users' personal data, such as their full names, primary email addresses, telephone numbers, and digital payment methods.
Taking control of or using personal data linked to an account without the owner's consent constitutes a violation of personal data protection laws that may be subject to criminal penalties.
04 — APPLICATION: HOW DO THESE LAWS APPLY?
Scenario A — Observing a Password and Accessing a Friend's Account (Illegal Access)
Aldo observes Kevin's password and then logs into Kevin's account from his personal mobile phone without permission.
Legal Analysis:
Accessing another person's Electronic System without authorization or permission directly satisfies the elements of Article 30 of the ITE Law.
The absence of Kevin's permission makes the access unlawful.
Scenario B — Changing the Linked Email Address and Password, Then Selling the Account
Aldo changes the linked email address and password of Kevin's account, preventing Kevin from accessing it.
Aldo then receives payment from an online buyer.
Legal Analysis:
- Changing account data without authorization satisfies the elements of Article 32 of the ITE Law concerning the modification or transfer of electronic data.
- Selling property or access that does not belong to the seller for financial gain satisfies the elements of fraud and an unlawful act that causes financial harm to Kevin (Article 36 of the ITE Law and Article 492 of the 2023 Criminal Code).
- Taking control of Kevin's email address and personal information linked to the account satisfies the elements of a violation of the Personal Data Protection Law.
Scenario C — Sharing an Account to Play Together, Which Is Later Taken Over
Kevin voluntarily gives his password to Aldo so that Aldo can help improve his gaming rank, commonly known as joki or push rank.
However, Aldo later changes the password and refuses to return the account.
Legal Analysis:
Giving someone permission to use an account for gaming is not the same as granting permission to permanently own or control that account.
When Aldo refuses to return the account and changes the access credentials beyond the original purpose of the permission, the action becomes an unauthorized takeover.
Additional Facts Needed Before Making a Legal Assessment
- Had Kevin ever given Aldo permission to access the account before?
- What was the amount of financial loss involved, including top-ups, item purchases, and other expenses?
- Is there supporting transactional evidence, such as screenshots of conversations, proof of account sale and purchase transfers, or IP and login records?
- Did the account takeover compromise Kevin's primary email account or digital wallet?
What Does This Mean for Students?
Permission to borrow an account does not mean permission to own it or change its data.
The law carefully considers the boundaries of consent and the purpose for which access was granted.
05 — CONCLUSION: WHAT IS THE LEGAL CONCLUSION?
Conclusion for Students
Under Indonesian law, a gaming account is not merely a virtual toy. It is an asset containing electronic data protected by law.
Taking over, changing the password of, or selling a friend's gaming account without permission has real legal consequences.
A gaming account is not simply a username or gaming profile.
It contains various forms of Electronic Information, digital identities, access codes, and data stored within the game provider's Electronic System.
Therefore, the access credentials and digital information that make up a gaming account may receive protection under the ITE Law.
If someone takes over an account without authorization, changes access data, or transfers another person's Electronic Information to an unauthorized party, the conduct may raise legal issues under Article 30 and/or Article 32 of the ITE Law, provided that all the relevant legal elements are satisfied.
However, it is important to distinguish between legal protection for Electronic Information and the ownership status of gaming accounts and virtual items.
The status and usage rights of an account must also be examined under the agreement and terms of service of the relevant gaming platform.
What Does This Mean for Students?
The ITE Law and Personal Data Protection Law do not apply only to professional hackers.
Anyone who intentionally observes a friend's password, takes control of their account without permission, and changes its data may face legal consequences under provisions concerning illegal access and the modification of electronic data.
The main conclusions are:
- Gaming accounts and their digital access data constitute Electronic Documents or Systems protected under Indonesia's ITE Law and Personal Data Protection Law.
- Hijacking, changing passwords, and selling another person's gaming account without permission satisfy the elements of the criminal offenses of Illegal Access (Article 30 of the ITE Law), Electronic Data Modification (Article 32 of the ITE Law), Personal Data Violations, and Fraud.
- Claiming that these actions are "just jokes within a game" does not eliminate their unlawful nature when they involve taking control of another person's rights and causing actual harm.
06 — PRACTICAL LESSONS: WHAT SHOULD STUDENTS DO?
Use the SAFE Method to Protect Your Digital Accounts
S — Secure Authentication
Use two-factor authentication (2FA) and avoid passwords that are easy to guess.
A — Avoid Account Sharing
Never share your password or login credentials with anyone, including close friends.
F — Formal Recovery Info
Make sure your recovery email address and telephone number belong to you and remain active.
E — Evidence Collection
If an account takeover occurs, immediately document recovery evidence and relevant conversations.
Practical Steps if Your Gaming Account Is Hijacked
1. Use Official Account Recovery
Use the official account recovery feature provided by the game developer and submit proof of ownership, such as payment records or your first top-up receipt.
2. Secure Connected Accounts
Immediately change the passwords of your primary email, social media accounts, and digital wallets linked to the gaming account.
3. Preserve Transaction and Conversation Evidence
Take screenshots of conversations, account sale and purchase records (if available), and unfamiliar login histories.
4. Report the Incident Internally and Seek Help
If the person responsible is a school friend, report the incident to school authorities or parents to seek disciplinary resolution or assistance with account recovery.
07 — WHY DOES THIS CASE MATTER TO YOUNG PEOPLE?
For young people, gaming accounts and digital identities are an integral part of their social lives and represent a significant investment of time.
However, the ease of conducting transactions online often makes the boundaries of ownership unclear.
This case teaches us that digital literacy is not simply about being good at playing games.
It is also about understanding that ownership rights, privacy, and ethics continue to apply in cyberspace.
Understanding the law helps us respect the creativity, time, and digital property rights of others.
08 — LEXTEEN ACCOUNT & DIGITAL CHECK
Before accessing or using a friend's digital account, consider these five questions:
WHO?
Who is the lawful owner of this account and its digital data?
WHAT?
What data or economic value is stored within the account?
WHY?
Why am I requesting or using access to this account?
WHERE?
Where will the access data be stored or used?
HOW?
Could my actions cause harm, involve hacking, or violate the account owner's trust?
If you are unsure:
Do not access it. Do not change it. Do not sell it.
09 — LEXTEEN TAKEAWAY
- Gaming accounts and digital data are protected by real-world laws.
- Observing someone's password and taking over a friend's account constitutes illegal access.
- Selling a hijacked account carries legal consequences related to fraud and unlawful acts.
- Protect your passwords and respect your friends' digital property rights.
- "Think before you log in. Ask before you access. Respect digital ownership before you share."
LEGAL BASIS AND REFERENCES
- Law No. 1 of 2024 on the Second Amendment to Law No. 11 of 2008 on Electronic Information and Transactions.
- Law No. 27 of 2022 on Personal Data Protection.
- Law No. 1 of 2023 on the Criminal Code (KUHP 2023).
DISCLAIMER
This content was prepared by LEXTEEN solely for educational purposes and to promote legal literacy among young people and students.
The scenarios presented are illustrative and do not constitute official legal advice or legal consultation.