Gaming account security: two-step verification, backup codes and scams

A video game account is worth far more than it seems. It holds the games you bought, your skins, years of progress and, often, a saved credit card. That's why scammers target it so much. The good news is that every major platform offers a simple, free protection that stops most break-ins: two-step verification.

This guide explains what that protection is, how to turn it on in the four accounts gamers use most and which scams deserve attention. The information comes from the companies' own help pages, listed at the end.

What two-step verification is

With a normal sign-in, the password is enough. With two-step verification, also called two-factor authentication or 2FA, the site asks for a second proof that it's you: a code sent by email or text message, or shown in an authenticator app on your phone. So even if someone finds out your password, they can't get in without that second code.

Among the options, an authenticator app is usually the safest, because the code is generated on your own phone and doesn't depend on a message. Apps such as Google Authenticator, Microsoft Authenticator and Authy are free and work with every account in this guide that accepts this method.

Epic Games (Fortnite)

In an Epic account, verification is in the password and security area, with three options: a code by email, by text message or by authenticator app. You can turn on more than one method and pick a primary one. Besides protecting the account, Epic requires two-step verification to send gifts in Fortnite, to take part in competitive events and to claim some free games from the store. In other words, Fortnite players have one more reason to turn it on.

PlayStation

In a PlayStation account, verification can use an authenticator app or text messages. You can turn it on from the website, under Account Management and then Security, or on the PS5 itself, under Settings, Users and Accounts, Security. During setup, PlayStation shows backup codes. Without them, anyone who loses their phone number has to verify their identity to recover the account.

Xbox (Microsoft account)

On Xbox, the Microsoft account protects everything. Two-step verification is turned on at the Microsoft account security site, in the additional security section, and the code can come by email, by phone or through the authenticator app. Microsoft recommends adding more than one contact method and warns that if you lose access to all of them, recovery can take up to 30 days.

Nintendo

In a Nintendo Account, verification uses Google Authenticator: you scan a QR code in the account settings and then type the 6-digit code when signing in. Right after that, Nintendo shows a list of backup codes. Each one works only once and lets you sign in if you lose the app. Child accounts subject to parental consent rules may not have this option.

The most common scams

In 2018, when Fortnite took off, Epic published a security notice saying there is no such thing as free V-Bucks and that sites promising them can't grant any currency at all. Scams change their look over time, but the idea is almost always the same: promise something too good to be true so you hand over your password, your data or your time.

• Free currency and skin generators: they don't exist. Sites and videos promising them want your password, or want you to fill in surveys and watch ads.
• Fake sign-in pages: a link that looks like the official store but leads to a different address. Always check the address before typing your password.
• Fake support messages: no real support agent will ask for your password or your verification code.
• Programs promising in-game advantages: they can carry viruses and, when they're cheats, get your account banned.

Golden rule: your verification code is yours alone. If anyone asks for it, even claiming to be a friend, a moderator or support, it's a scam.

Passwords and everyday care

Two-step verification works best alongside a good password. Use a different password for each account, so a leak on one site doesn't open the other doors. A password manager helps create and remember long passwords. Also protect the account's email, with a strong password and two-step verification, because it's how almost everything gets recovered.

For families who play together, it's worth agreeing on a few rules: purchases only with permission, a saved card only when needed and open conversation about strange messages received in games. The platforms also offer parental controls that limit spending and contacts.

Quick summary

• Turn on two-step verification on every gaming account and on your email.
• Prefer the authenticator app over text messages when you can.
• Keep backup codes away from your phone.
• Never give your password or verification code to anyone.
• Be suspicious of any promise of free currency, skins or advantages.

A few minutes of setup can save you the headache of losing years of collecting. It's worth doing today.