How to secure your Nintendo Account

Where Nintendo keeps its security settings

Almost everything that protects a Nintendo Account is managed on the web at accounts.nintendo.com, not on the console. Once you sign in, look for Sign-In and Security Settings. That page is where you will find two-step verification, passkeys and your sign-in history.

When you change something important, Nintendo may ask you to confirm it's you by re-entering your password, using a passkey, or entering a verification code sent to your email. If you have registered a phone number, you can choose Use another method to verify your identity and get the code by text instead.

Nintendo also lists two less-known protections on its recovery page. You can register a phone number to your Nintendo Account, and you can create a Sign-In ID that only you know and then change your sign-in method preference to "Sign-In ID only". Nintendo says this can stop other people using your email address to try to sign in without your permission.

Turning on two-step verification for a Nintendo Account

Nintendo calls this feature "two-step verification" in its settings. Once it's on, you need your password and a code from an authenticator app on your smartphone or tablet each time you sign in.

1. Go to accounts.nintendo.com and sign in.
2. Select Sign-In and Security Settings, scroll to Two-Step Verification and click Edit.
3. Confirm your identity if asked.
4. Install Google Authenticator or another authentication app on your phone or tablet.
5. Scan the QR Code shown on the Nintendo Account screen, then enter the 6-digit verification code and select Submit.
6. When the list of backup codes appears, select Copy, paste them somewhere safe, then select Backup codes saved.

Nintendo says a backup code is needed to sign in if you lose access to the authenticator app, and each code works once. You can return to the same section later to review your backup codes. Note that Nintendo says this option is not available for child accounts; for children, the parental controls covered in our parents' guide do more of the work.

Nintendo passkeys and which devices support them

A passkey lets you sign in to your Nintendo Account with your phone or computer's own unlock (face, fingerprint or screen lock) instead of typing your email or Sign-In ID and password. Nintendo describes it as an additional layer of security that helps prevent unauthorised access.

To register one, use the device you want to hold the passkey: sign in at accounts.nintendo.com, select Sign-In and Security Settings, then Passkeys, then Edit. Verify your identity if asked, select Register New Passkey, enter your Nintendo Account password and follow the prompts. You can register up to 10 different passkeys. Even with a passkey, you can still sign in with your email (or Sign-In ID) and password if you need to.

Nintendo says passkeys are currently only confirmed to work on iPhone and iPad with iOS or iPadOS 16 or higher using Safari, on a Mac with macOS 13 or higher using Google Chrome, and on Android 9 or higher using Google Chrome. Nintendo also warns not to register a passkey on a device other people use, because anyone who can unlock that device could use it to sign in to your account.

Nintendo eShop sign-in, saved cards and the pass-enabled console

Inside Nintendo eShop, select your user icon to see your account information. Nintendo lists several options that matter for security:

• Credit card information: view your saved card (last 4 digits and expiry) and delete it.
• PayPal account: view or unlink a linked PayPal account.
• Sign-in settings (Nintendo Switch): choose to skip or require sign-in when using Nintendo eShop. Nintendo warns that if you don't require sign-in, your funds and account information are accessible to other people who use your console.
• Pass-enabled console: check whether this console is the pass-enabled console for your account, and deregister it if you want to.

If you share a console with children or housemates, requiring sign-in is the simplest way to stop surprise purchases. If you don't buy often, deleting the saved card and topping up only when needed limits what anyone could spend.

What Nintendo tells you to do after unauthorised access

Nintendo's Account Recovery Process page lists three warning signs: an email saying "A new device has been used to sign in to your Nintendo Account" (it may mention an unknown device or location), an unexpected "[Nintendo Account] Email address verification" email, or evidence someone else has been using your account.

Its recommended steps are, in order: change your Nintendo Account password (or reset it if you can't remember your details); sign out of all devices by going to Sign-In and Security Settings, selecting View beside your sign-in history and then Sign out on all other devices; add a phone number, a passkey and two-step verification; and delete any stored credit card or PayPal details.

Then look at what is linked. If your Nintendo Account signs in through Google or Apple, change those passwords too, because one of them may have been the way in, and unlink them if you think they were compromised. The same goes for an older Nintendo Network ID, whose password can be changed on a Wii U or Nintendo 3DS family system. If your email inbox itself was accessed, contact your email provider first. Our hacked account triage follows the same order and works across platforms.

A five-minute Nintendo Account security check

If you only have a few minutes, this is the order we'd work through, using the settings Nintendo documents.

1. Sign-in history. On accounts.nintendo.com, open Sign-In and Security Settings and select View beside your sign-in history. If you see a device or location you don't recognise, use Sign out on all other devices and change your password.
2. Two-Step Verification. Check it says it's on. If you can't find your backup codes, you can return to the two-step verification section to review them.
3. Passkeys. Open Passkeys and look at what's registered. Remove any passkey saved on a device you no longer own or that other people use.
4. Linked accounts. If you sign in with Google or Apple, make sure those accounts have their own two-step sign-in, because Nintendo notes they can be a route into your Nintendo Account.
5. Nintendo eShop. Check whether a card or PayPal account is stored and whether sign-in is required on shared consoles.

Repeat the check whenever you get one of Nintendo's "new device" emails you weren't expecting, or after a console is sold, lent out or lost.