Keeping your child's game accounts safe: a UK parents' guide

Why the email address decides who really owns the account

Almost every game account can be reset through its email address. Whoever controls that inbox ultimately controls the account. If a child's account is linked to an old school email, a sibling's address or an inbox nobody checks, security alerts go unseen and recovery becomes much harder.

For younger children, use an address you control or a family account the platform links to yours. As they get older, you can hand over control in stages, keeping your contact details as a recovery option. Protect that email well: the NCSC recommends a strong, separate password and 2-step verification for email, because it is the key to everything else.

What each platform's family settings can do

Each major platform has its own family tools. Names and options change, so check the platform's own pages, but at the time of writing:

• Xbox: the Xbox Family Settings app manages screen time, content filters by PEGI age rating, purchases through 'Ask a Parent' requests, and who your child can play and chat with.
• PlayStation: a parent set up as family manager can create child accounts, set monthly spending limits, restrict communication with other players and set playtime controls.
• Nintendo: the Nintendo Switch Parental Controls app covers play time limits, content restrictions and communication; spending is managed through the Nintendo Account.
• Steam: Steam Families lets a household share a game library; adults can turn on parental controls for child accounts to choose which games they can play, restrict the Store, Community or chat, set playtime limits and approve purchase requests.
• Roblox: a linked parent account can set a monthly spending limit, choose purchase notifications, manage who your child can chat with, and set daily screen time limits.
• Discord: Family Center shows a connected parent which friends and servers a teen has added and who they message, but not the content of messages.

Our platform guides cover the security side of each one, starting with Xbox and Microsoft, PlayStation, Nintendo and Roblox.

The scams children meet most often

Scams aimed at young players use what children want most: free currency, rare items, and not getting in trouble. The ones worth talking through together are:

• Free currency generators that ask for a password or a download.
• 'I accidentally reported you' messages that threaten a ban.
• Fake giveaways using copied creator names.
• QR code logins presented as server verification.
• Cheat downloads on the family computer.

The common thread is a request for a password, a code, a QR scan, a download or money. If your child learns to stop at any of those five, most scams fail.

Making it safe for your child to own up

Many children hide a scam because they fear losing the console or being told off. The longer it is hidden, the more damage an attacker can do. A calm response the first time makes it more likely they will come to you next time.

It can help to agree in advance:

• Telling a parent about a scam message never leads to punishment.
• Any request for a password, code, QR scan, download or payment is shown to an adult first.
• Real staff never ask for codes and never say 'don't tell your parents'.

If something has gone wrong, our hacked account triage gives you the order of steps.

Children also learn from what they see you do. Saying out loud when you spot a scam text or email, and showing how you check it, makes the habit feel normal rather than a rule just for them.

Spending: limits, approvals and saved cards

Unexpected spending is one of the most common reasons parents notice a problem. Use the platform's purchase approval or monthly limit, and avoid leaving a card saved on a child's account. Gift cards or a set allowance give you a fixed ceiling.

If you see purchases you did not approve, check whether your child made them or the account has been taken over. Contact the platform through its official help site, and your bank if a card was charged. Be wary of anyone who contacts you offering a refund. That is a common route into fake support scams.

When it is more than a hacked account

Some contact from strangers is not about accounts or money. If an adult has asked your child for images, tried to move the conversation to a private app, offered gifts in exchange for secrecy, or made threats, report it:

• CEOP, part of the National Crime Agency, takes reports about online sexual abuse or the way someone has been communicating with a child online.
• If a child is in immediate danger, call 999.
• Children and young people can talk to Childline on 0800 1111. Adults worried about a child can contact the NSPCC helpline on 0808 800 5000.
• For harmful content that platforms have not removed, Report Harmful Content, run by the UK Safer Internet Centre, can advise.

Keep screenshots and usernames, but do not forward any indecent images, even to report them.

A ten-minute account check you can do together

Set aside ten minutes with your child and their device, and go through these questions:

1. Which email address is on the account, and can you both get into it?
2. Is 2-step verification on, and whose phone receives the codes or approvals?
3. Are there saved cards or a spending limit?
4. Who can send direct messages and friend requests?
5. Are there signed-in devices or linked accounts neither of you recognises?
6. Is the password used anywhere else?

The NCSC suggests three random words for passwords that are long but easy to remember, which can be a fun exercise with a child. Repeating the check every few months, or whenever a new console or game arrives, keeps settings from drifting.