Secure Your Epic Games Account: 2FA, Recovery, PIN

Lock it down, in order

Work top to bottom. Each step makes the next one count for more.

Epic Games lockdown0 of 7 done

Verify and secure your account email Epic says your account email and access to it are the key to your account. Verify it, use an address you'll keep long term, and protect it with a unique password and 2FA.
Turn on two-factor authentication Go to the Password and security section of your Epic Games account. Under Two-Factor Authentication, click Set up for your preferred method and enter the code Epic sends.
Prefer an authenticator app Epic supports authenticator apps, SMS and email, and says an authenticator app gives the strongest protection.
Set a primary method If you add more than one method, click the three dots (…) next to your favourite and select Make my primary 2FA method.
Use a unique password Epic recommends a password you don't use anywhere else, and suggests a password manager.
Secure every linked account Epic asks you to enable 2FA on any linked Xbox, PlayStation, Nintendo, Facebook or Google account, because those can be used to get into your Epic account.
Add a Parental Controls PIN for children Sign in to the child's account, open Parental Controls and set a 6-digit PIN. 'Require a PIN for Epic Games Payments' then protects real-money purchases using Epic payment.

Ticks stay on this page only and clear when you leave.

Already been taken over?

Secure your email first Change your email password and turn on its 2FA. If you've lost the email, contact your email provider to recover it.
Reset your Epic password Follow Epic's 'How can I recover access to my Epic Games account?' steps. This only works if you still control the email on the account.
Try a linked account If your Epic account is linked to PlayStation, Xbox, Nintendo Switch, Facebook, Google or another service, try signing in with it.
Submit an account recovery request If the email was changed to one you don't control, use Epic's multistep account recovery form. Epic only processes recovery requests through that form.
Re-secure after recovery Reset your password, turn 2FA back on from the Two-Factor Authentication tab, and re-link your accounts from the Linked Accounts tab.
Report anything still wrong If you see linked accounts you don't recognise or can't change settings, submit a support ticket.

Open the recovery wizard for Epic Games

Red flags to watch for

An offer of free V-Bucks, games or items from an unofficial site or account.
A request to enter your Epic login on any external website.
Someone offering to buy, sell or share an account.
A message asking for your password. Epic says it only asks on official Epic Games login pages.
A request to pay money for in-game gifts through a third party.

What two-factor authentication unlocks on Epic

Two-factor authentication (2FA) adds a second step when you sign in, so a stolen password alone isn't enough. Epic also uses it as a gate for some features. Its help page lists three: 2FA is required to claim some free games on the Epic Games Store, to send gifts in Fortnite, and to take part in Fortnite competitive events.

To turn it on, go to the Password and security section of your Epic Games account. Under Two-Factor Authentication, click Set up next to the method you want, then enter the code Epic sends by email or SMS, or the one shown in your authenticator app. Epic confirms on the page and by email once it's active. If you use several methods, choose your main one with the three dots (…) and Make my primary 2FA method.

Epic supports authenticator apps, SMS and email, and says authenticator apps provide the strongest protection. That fits a wider pattern: email codes are only as safe as your inbox, and text messages can be intercepted. If a younger player's account has limited features, Epic notes it may be a Cabined Account; see our parents' guide for what that means.

V-Bucks offers, account trading and other Epic warning signs

Epic's security page lists the traps it sees most. Don't trust offers of free V-Bucks, games or other items from unofficial sources, and don't enter your login on external websites. Epic says official offers only appear on the Epic Games Store, official Epic Games websites or verified Epic Games social media channels. Our guide to free currency generators explains how these sites work.

Buying, selling or sharing accounts is against Epic's Terms of Service and can lead to restrictions or bans, and you're responsible for anything that happens on an account you share. Epic also asks you to buy items only through the Epic Games Store or in-game, and not to exchange money for in-game gifts through third parties. See account buying and selling for why these deals so often go wrong.

Finally, Epic says it will only ask for your password on official Epic Games login pages, never by email, message or third-party website.

Using Epic's account recovery form

Epic's compromised-account article gives a clear order. Secure your email first. Then try resetting your password, which only works if the email on your Epic account is still yours. Next, try signing in through a linked console or social account. If you get in but the email has been changed to one you don't control, signing in isn't enough: you need to submit an account recovery request.

The recovery form asks for, in this order: the email address you want to use from now on (Epic sends a security code to it); a way to find your account, such as Account ID, Invoice ID, an email you've used, your display name or a linked account; all the email addresses and display names you've used; your name and the country used when you created the account; any phone number you used for 2FA; details of linked accounts; and payment methods used for purchases. Epic says Account ID or Invoice ID helps it find the account most accurately, and you can't add information after you select Submit.

Epic emails the outcome to the new address you gave. After approval, reset your password, turn 2FA back on from the Two-Factor Authentication tab and re-link accounts from the Linked Accounts tab. Our hacked account triage covers the same sequence.

Our view: dig out an old purchase receipt with an Invoice ID before you start. It makes the form much easier.

Keeping the email behind your Epic account safe

Epic's help articles keep returning to one point: your account email is the key to your Epic Games account. A password reset only works if you still control that inbox, and Epic's recovery form exists mainly for cases where someone changed it.

Epic gives three pieces of advice here. First, when you create an account or change its email, use an address you expect to keep for the long term, because losing access to it could stop you recovering your Epic account later. Second, verify the email on your account if you haven't already; Epic says this helps protect the account with its 2FA and makes it easier for Player Support to help if there's suspicious activity. Third, secure the email itself with a unique password and 2FA through your email provider.

A school or work email is a poor choice for a gaming account you plan to keep, because you'll lose it when you leave. A personal address with its own two-step sign-in is the safer base for everything else on this page.

Epic Parental Controls PIN and purchase permissions

Epic's Parental Controls are set from the child's account. Go to the Parental Controls page in the account portal while signed in as the child, and you'll be asked to set and confirm a 6-digit PIN. Epic sends parental control messages to the email address on the account.

Under Purchasing Permissions, the 'Require a PIN for Epic Games Payments' setting means your PIN is needed to complete real-money payments using Epic payment. Epic points out its limits: it does not affect payments made on PlayStation, Steam, Xbox or Nintendo Switch, and it does not affect purchases with in-game currencies such as V-Bucks. A separate setting controls whether a child can spend V-Bucks on paid random items, where that feature is available.

If your child plays on a console, set that platform's own purchase controls too, because Epic's PIN won't cover them.

Questions

Do I need 2FA to send gifts in Fortnite?

Yes. Epic says 2FA is required to send gifts in Fortnite, to claim some free games on the Epic Games Store and to take part in Fortnite competitive events.

Which 2FA method does Epic recommend?

Epic supports authenticator apps, SMS and email, and says an authenticator app provides the strongest protection.

The hacker changed my email. Can I still recover my Epic account?

Yes, through Epic's account recovery request form. Epic says it can only process recovery requests submitted through that form.

Does the Parental Controls PIN stop V-Bucks spending?

Not directly. 'Require a PIN for Epic Games Payments' covers real-money payments using Epic payment, not in-game currency. There is a separate setting for paid random items.

Sources we checked

Last checked: 3 November 2026. Settings menus change; if a step looks different, the official page linked here wins.

How to secure your Epic Games account