Account security

How to keep a mobile game account from being stolen

·3 min read
Contents
  1. Quick answer
  2. Why this keeps happening
  3. What to do, in order
  4. How to measure it
  5. Mistakes that undo the work
  6. Frequently asked
  7. Read next
  8. Games worth trying

Most account thefts start with a reused password and an old email address, not with a clever hacker. This guide walks through the four settings that close almost every real-world gap in under twenty minutes.

Quick answer

  • Write down which email address each game account uses.
  • Change the password on the email account first.
  • Turn on two-factor authentication in the game.

Why this keeps happening

Account recovery is the weak point, not the login screen. Attackers rarely guess a password; they use the reset flow, which depends on an email inbox or a phone number that the owner stopped checking years ago.

The second gap is session trust. A device that was signed in once keeps a token that survives a password change on many services, so a stolen phone or a shared tablet can stay logged in long after you think you have locked things down.

What to do, in order

  1. Write down which email address each game account uses, then confirm you can still sign into that inbox today.
  2. Change the password on the email account first, before touching any game password.
  3. Turn on two-factor authentication in the game, and prefer an authenticator app over SMS where both exist.
  4. Remove every device you do not recognise from the account's active session list.
  5. Set a recovery phone number you control, not a family member's number that may be reassigned.
  6. Repeat the whole check once a year, or immediately after changing phones.

How to measure it

Count how many of your game accounts share one password. Every shared password is one breach away from becoming five compromised accounts, and the number should be zero before you do anything else.

Mistakes that undo the work

  • Changing the game password while leaving the old email address as the recovery route.
  • Storing recovery codes in the same password manager as the password itself.
  • Assuming a linked social login is safer than a password; it is only as safe as that social account.

Frequently asked

Is SMS two-factor better than nothing?
Yes, but only as a fallback. SMS can be intercepted through number porting, so use an authenticator app where the game offers one and keep SMS for accounts that give no other option.
What if the game has no two-factor option?
Then the email account becomes the entire security perimeter. Use a unique password there, enable two-factor on the inbox, and never reuse that address for forums or giveaways.
Does deleting an old account help?
It removes one target but also destroys purchase history and progress, so it is usually better to secure the account properly than to abandon it.

Read next

Games worth trying

Recommended games