Securing your game account: a practical setup and recovery guide
A game account can hold years of progress and purchases, and often a saved payment method too. That makes it worth protecting, and worth stealing. The good news is that a few habits, mostly set up once, deal with the large majority of account takeovers. This guide covers those habits, the scams aimed at players, and what to do if you have already lost access.
The short answer
Use a password you use nowhere else. Turn on two-step verification. Keep the email account linked to your game account secure, because whoever controls that email can usually reset the game password. Sign in only by going to the game's site or launcher yourself, never through a link someone sends you.
Why game accounts are targeted
Accounts with rare items, high progress or saved payment details have value to someone else. They can be resold, stripped of items, or used to make purchases. Attackers rarely break in through clever technical tricks. Most takeovers come from reused passwords, phishing pages that copy a game's login screen, and malicious downloads posing as tools or mods. Each of those depends on the account holder doing something, so each can be avoided.
Setting up a new account properly
Secure the email address first
Your email account is the master key, because password resets go there. Give it a strong unique password and two-step verification before you create any game account linked to it.
Choose a unique password for the game
The National Cyber Security Centre's guidance suggests combining three random words into a password that is long and memorable. A password manager can generate and remember passwords for you, so each account has its own.
Turn on two-step verification
If the game offers it, switch it on. You will be asked for a code from an app or a message when you sign in on a new device. A stolen password alone then is not enough to get in.
Confirm the account and save recovery details
Activate the account through the confirmation email when it arrives. Store any backup codes somewhere safe and offline. A note in a drawer is better than a screenshot on the same computer.
Review what is saved
If you have no plans to spend, do not save a card. If you do, look at whether the game or platform can ask for a password before each purchase.
Recognising phishing aimed at players
Phishing means persuading you to enter your login details on a page that only looks genuine. Messages aimed at players tend to follow a few patterns:
- An urgent warning that your account will be suspended unless you "verify" it.
- An offer of free premium currency, rare items or a giveaway prize that needs you to sign in.
- A message from a "friend" or "moderator" in chat with a link to a site that looks like the game's.
- An email reporting a purchase you did not make, with a link to "cancel" it.
The defence is the same each time. Do not use the link. Open the game's launcher or type its website address yourself, then check your account from there. If the warning was real, you will see it. In the UK, you can forward suspicious emails to the NCSC's reporting service at report@phishing.gov.uk. The NCSC website explains how the service works.
What to watch out for
- Currency generators and "hacks". No outside tool can add premium currency to an account held on a game's servers. These downloads and pages exist to take your login or install unwanted software.
- Unofficial mods and add-ons. Where a game allows modifications, get them only from sources the developer recognises. Mods packaged as installers deserve particular suspicion.
- Account trading. Buying or selling accounts usually breaks a game's terms. The original owner can often reclaim a sold account through the email address linked to it.
- "Support staff" who contact you first. Real support teams do not ask for your password. Anyone who does is not support.
- Codes from unofficial sources. Bonus and invite codes shared on forums or video descriptions may be expired, fake, or bait for a login page. Check any code on the game's own site.
If you think your account has been taken over
Secure your email first
If you can still get into the email account linked to the game, change its password and check its recovery settings and forwarding rules. Attackers sometimes add a forwarding rule so they keep receiving reset emails.
Try the game's password reset
If you still control the email address, a reset may be enough. Afterwards, sign out of all other sessions if the game offers that option.
Contact the game's support
If you cannot get in, use the official support route on the game's website. Give details only you would know, such as when you created the account, past purchase dates and receipts. Expect it to take some time.
Check payments
Look for purchases you did not make. If a card was used, contact your card provider promptly and explain what happened.
Report fraud where money is involved
In England, Wales and Northern Ireland, report fraud to Action Fraud. In Scotland, contact Police Scotland on 101.
Check the computer
If the takeover followed a download, run your operating system's built-in security scan, remove the suspicious software and change passwords from a device you trust.
Keeping the computer itself in good order
Account security and device security overlap. Keep your operating system and game launcher up to date, because updates fix security problems as well as bugs. Windows and macOS both include built-in malware protection; leave it switched on. Use an everyday user account rather than an administrator account for routine play where you can. None of this needs special software. It needs the defaults left in place and updates allowed to install.
Account security checklist
- Email account secured with a unique password and two-step verification
- Game account password unique and stored safely
- Two-step verification turned on in the game, if offered
- Account confirmed and backup codes kept offline
- No card saved unless you intend to spend, and purchase passwords switched on if offered
- Launcher and operating system set to update automatically
- Sign-in only through the launcher or a typed web address
Sharing a computer with others
On a family or shared computer, give each person their own user account on the operating system, so that saved logins and launcher sessions stay separate. Sign out of the game launcher when you finish if others use the same account. Do not let the browser save your game password on a shared profile. If a child uses the same machine, it matters even more that no payment card is saved in the launcher or the game.
Personal data and the game company
The company running a game holds your account data and must handle it lawfully. If you want to know what it holds, you can ask. Under UK data protection law you have a right of access to your personal data. If a company does not respond properly, the Information Commissioner's Office explains how to raise a concern.