A UK court entered a guilty plea against Ashley Mitchell, an IT guy who hacked into Zynga's servers last year and stole 400 billion virtual poker chips. His efforts to resell them, which is against Zynga's terms of service, netted him $86,000 and a yet to be determined jail sentence.
To avoid issues with the gambling laws, Zynga sells poker chips to users for real money (and in some cases to reward user actions), but prohibits any cash out or resale of the chips.
Zynga's Terms of Service states:
"Zynga owns, has licensed, or otherwise has rights to use all of the content that appears in the Service or the Zynga games. Notwithstanding any provision to the contrary herein, you agree that you have no right or title in or to any content that appears in the Service, including without limitation the virtual goods or currency appearing or originating in any Zynga game, whether earned in a game or purchased from Zynga, or any other attributes associated with an Account or stored on the Service.
Zynga prohibits and does not recognize any purported transfers of virtual property effectuated outside of the Service, or the purported sale, gift or trade in the "real world" of anything that appears or originates in the Service, unless otherwise expressly authorized by Zynga in writing. Accordingly, you may not trade, sell or attempt to sell in-game items or currency for "real" money, or exchange those items or currency for value of any kind outside of a game, without Zynga's written permission. Any such transfer or attempted transfer is prohibited and void, and will subject your Account to termination."
With respect to chip "purchases", Zynga states:
"The purchase of Zynga Poker chips from a third party seller is a violation of Zynga's Terms of Service. We are not responsible for any losses incurred and will not restore chips.
The only safe method of purchasing our chips is directly through the application, via the Buy Chips tab."
As virtual currencies proliferate, it is important for companies to ensure that they think through their business models, develop and enforce effective terms of service and consider up front how they can use technological measures to deal with people who inevitably will try to beat the system. This requires a careful integration of business, legal and technical strategy.