Game account hacked? Start here

First, work out what kind of trouble you are in

Before you start changing settings, take a minute to identify which situation you are in. It changes the order of your steps.

• You can still sign in, but something is wrong. Unfamiliar purchases, messages you did not send, or a security email about a new device. You are in the strongest position: secure the account now from inside.
• Your password no longer works, but the email is still yours. Use the platform's password reset and then follow the universal steps.
• The email or phone number on the account has been changed. You will need the platform's full account recovery process. Check your inbox for a 'your email was changed' notice, which some platforms send with a link to undo it.
• Your email account itself has been taken. Recover the email first, using your email provider's recovery page. Everything else depends on it.
• You ran a file or tool shortly before this happened. Assume the device is infected and use a different device for every password change.

Write down the time you noticed, what you saw and anything you clicked or downloaded. Support teams and the police will ask for these details.

The order that stops an attacker getting back in

Attackers often keep a back door: a forwarding rule on your email, a second email or phone added to your account, a linked app, or a still-active session. If you only change one password, they may simply reset it again.

Work in this order:

1. Email account: new password, sign out everywhere, 2-step verification on, check forwarding and filters.
2. The affected game or chat account: new password, sign out everywhere, check email and phone, check 2-step settings.
3. Linked accounts: game accounts are often linked to each other and to social media. Unlink anything you do not recognise.
4. Anything that shared the old password: the NCSC recommends changing passwords on any other account that used the same one.

The NCSC suggests three random words as a way to make each password long and memorable, or a password manager to create and store them.

If your email provider shows recent activity or signed-in devices, review those too.

Platform recovery routes, in brief

Every major platform has its own recovery process, and only that process can restore an account. Our platform pages give the detailed steps and settings names:

• Steam: account recovery through the Steam Support help site.
• Xbox and Microsoft: the Microsoft account recovery process.
• PlayStation: PlayStation account support.
• Nintendo: Nintendo Account support.
• Epic Games: Epic Games account support.
• Discord: Discord support and Trust and Safety.
• Roblox: Roblox support.
• EA app: EA Help.

Recovery forms tend to ask for proof that only the real owner would have. Answer as fully as you can, even approximately. Submitting several conflicting requests can slow things down, so send one complete request and wait for the reply.

What to keep as evidence

Gather this before you contact support or the police. It is also useful if you need to dispute a payment with your bank.

• Screenshots of suspicious messages, including the sender's username and the date.
• Security emails from the platform (new sign-in, email changed, password changed). Do not delete them.
• Order confirmations and purchase history showing unauthorised spending.
• The address of any website where you entered details.
• Original purchase receipts or the payment card used on the account, as proof of ownership.

Where to report in the UK

Reporting helps the platform remove the attacker and helps UK agencies take down scam sites.

• Report Fraud replaced Action Fraud as the national fraud and cyber crime reporting service for England, Wales and Northern Ireland. Report online or call 0300 123 2040. The NCSC advises reporting to Report Fraud if you have lost money or been hacked.
• Police Scotland: in Scotland, call 101 (or 999 in an emergency).
• Your bank: call the number on your card, or 159, which connects you to many UK banks.
• Suspicious emails: forward to [email protected].
• Suspicious texts: forward to 7726.
• Scam websites: report through the NCSC's website reporting form.
• The platform itself: use its report tools and official help site.

If a child has been contacted in a sexual or threatening way, that is different from a hacked account: report to CEOP or the police. See our parents' guide.

When a child's account has been taken

If the account belongs to a child, the steps are the same, but a few things are different in practice:

• The account may be linked to a parent's family group, which can give you extra recovery options and proof of ownership.
• Child accounts are sometimes registered with an old or forgotten email address. Find it before starting recovery.
• Check the family group's spending history as well as the child's account.
• Ask calmly what happened. Knowing whether a code, QR scan, password or download was involved tells you which steps matter most.

Once the account is back, take the chance to set up the protections in our parents' guide, especially parent-controlled email and 2-step verification on a parent's phone. That makes the next attempt far less likely to succeed.

Avoiding the second scam after a hack

People who have just been hacked are often targeted again. Watch for:

• 'Recovery experts' who reply to your public posts offering to get the account back for a fee.
• Fake support numbers found through search adverts.
• Messages claiming to be from the platform asking you to 'confirm' your identity through a link.

Official recovery is free and happens through the platform's own help site. Read our pages on fake support agents and phishing login pages for the details.