Social Interactions & Gaming Experiences On The Metaverse Leaving Consumers Potentially Vulnerable

MIAMI (CBSMiami) – The metaverse can look and feel more real than the online social interactions and gaming experiences we're used to – leaving consumers potentially vulnerable.

Researchers predict that the global metaverse market could be worth about $680 billion by 2030.

"The metaverse is a virtual reality world where you can go to concerts, you can see famous and really cool people around the world," said 12-year-old Cooper Stone.

Cooper plays video games like Fortnite and uses his virtual reality headset to play sports.

And in the future, those experiences will likely seem more real, as Jason Rubin of Meta, formerly called Facebook, told CBS News in February in an interview conducted in a virtual reality program.

"Slowly but surely, I think that things you can do in the metaverse, and the amount of time you spend in virtual reality in the metaverse will slowly increase to the point where we really become an immersive world," Rubin said.

So, it's no surprise that companies are seeking ways to create experiences, and make money, in the metaverse.

But where there's money to be made, the criminals won't be far behind.

"We totally expect them to move into this," said Kevin Gosschalk, who is with the cybersecurity firm Arkose Labs. "The moment there's a valid metaverse spun out that has a real money mechanism where they can make money, they'll be in there day one."

He showed CBS News how in chat rooms, conversations are already going on about how to exploit the metaverse for fraud.

"Criminal marketplaces to sell identities, to sell Social Security numbers," he said. "The way they do it may be slightly different, but what they're trying to achieve is money and the goal of doing it, duping somebody into giving them money, they're going to be aligned."

Cooper and his parents say they already got scammed when hackers broke into his Fortnite account last year and charged up his parents' credit cards.

"They were like, 'Cooper, did you spend $25 or $50 on this game without my permission?' And I'm like, 'No,'" he said.

"We investigated a little bit more and found out that he had not done it," said Nina Stone, Cooper's mom.

"Everyone is looking to make money off the metaverse," said Caroline Wong. "And the hackers go where the money is."

Wong, with cybersecurity firm Cobalt.io, says criminals' attacks can take on more disturbing forms. For example, if a hacker gains access to your VR headset they "can access that camera, they can see into your office, they can see into your bedroom. They can see inside of your home."

That's called the camera attack. Another one is called the overlay attack, when they can control what you're seeing and what you're hearing.

Not only that: some content in the metaverse might be disturbing to some users, especially children.

In a program called "VR Chat," CBS found users – some who clearly sounded like children – making crude drawings.

And in a user-created room in Meta's Horizon Worlds, CBS was able to pick up guns lying randomly around a "house" as other users fired them off.

Another user who sounded like a young child played with one of those guns.

Meta declined to comment on camera but said Quest headsets are "designed for children ages 13 and up" with "some experiences only for people 18 and up."

The company says it has set up "safe zones" inside the software so users can exit situations they might find uncomfortable.

And later this month, Meta will offer a way for parents to lock specific apps that aren't age-appropriate for teens.

VR Chat said those underage users are not permitted and are banned if detected, and that "user safety is a top priority."

"You can't protect against everything," said Wong. "But there are things that you can do."

Wong continued, "They build the world, they create the experiences. Everything is very much on purpose. Everything is being monitored already. How long your eyes gaze at a particular digital object? Exactly what you click on, exactly what you type. All of that is being monitored. It can be monitored… it is the appropriate thing to do. It is absolutely possible. And it costs money and resources to do so."

The goal, both she and the companies say, is to create safe, enjoyable experiences for all, in a new, virtual world.

The company that owns Fortnite, Epic Games, said it has purchase controls for parents to manage Fortnite purchases and "checks all accounts for signs of compromise continuously" to help stop fraud.