If an account is hacked and stolen, can the service provider be compelled to return it?
<p><a href="https://waypoint.vice.com/en_us/article/43ebpd/the-long-weird-story-explaining-why-i-bid-dollar700-for-a-stolen-psn-account" rel="nofollow noreferrer">This story</a> describes how a PlayStation Network (PSN) account holder had their account repeatedly hacked and stolen. Eventually the thief was able to create enough uncertainty that Sony (the service provider in this case) blocked any further changes. Unfortunately they did so when the thief had control, so the original account holder was unable to get it back.</p>

<p>The account holder had taken all reasonable security measures recommended by Sony, including enabling 2-factor authentication and using long unguessable passwords. It is not known for certain how the account was hacked, but it seems to have been done by making repeated calls to customer service agents until the thief found one who could be tricked into disabling the security.</p>

<p>The account in question was quite valuable: it included a number of "purchased" games (scare quotes because of the dubious nature of ownership here) and accumulated achievements from 12 years of play. The thief was offering it on the open market for $1,200.</p>

<p>Once this story went viral Sony suddenly fixed the problem. But suppose that this hadn't happened. </p>

<p>My question is: could the account owner have taken Sony to court to demand the return of the account? Would they have a case?</p>

<p>Sony PSN terms of service are <a href="https://www.playstation.com/en-us/network/legal/terms-of-service/" rel="nofollow noreferrer">here</a>.</p>

<p>The TOS states that users with disputes are bound by arbitration (see <a href="https://www.nolo.com/legal-encyclopedia/arbitration-basics-29947.html" rel="nofollow noreferrer">Arbitration Basics | Nolo.com</a>) unless they opt-out of binding arbitration within 30 days of opening an account. Binding Arbitration means the user is legally bound to work with Sony and a third-party arbitrator - outside of a court - to work out a settlement (and possible refund or return access to the account) that is agreeable to both parties. That rules out suing Sony in state or district courts for damages or to force Sony to give them access to their account again.</p>

<p>But, as per the TOS, users are <em>not</em> prevented from filing in small claims court.  Small claims courts are still courts, but they are easier to navigate for citizens and cost less.</p>

<p>Since the court jurisdiction for Sony is California, these are some of the stipulations for filing in California Small Claims Court:</p>

<blockquote>
  <p>You can sue for up to $10,000, if you are an individual or a sole
  proprietor. Corporations and other entities are limited to $5,000. In
  addition, a party (individuals or corporations) can file no more than
  two claims exceeding $2,500 in any court throughout the State of
  California during a calendar year. <a href="https://www.dca.ca.gov/publications/small_claims/file.shtml" rel="nofollow noreferrer">The Small Claims Court - California Department of Consumer Affairs</a></p>
</blockquote>

<p>But the first step in small claims court is always to send a "demand letter" to the potential defendant, a letter that outlines the cause of court action, a request for damages and gives the defendant a chance to agree to a settlement before an actual court filing.</p>

<p>So that user could have looked into suing Sony in small claims, and may have been successful in a settlement from a demand letter to get their account back without even having to formally sue in court.</p>

<p>In general terms, if a user is not in California, whether that person can actually file in California from that other state (with or without a lawyer) may depend on the jurisdiction of that state. And, it depends on the jurisdiction of the home state if one can file in the small claims court of that state against Sony in California.</p>

terms-of-service