How to secure your PlayStation account

Passkey or 2-step verification on PlayStation: which to choose

Sony now offers two ways to make your account harder to break into. A passkey replaces your password: you sign in with your phone's face or fingerprint unlock (or screen lock), so there is no password to steal. 2-step verification (2SV) keeps your password but adds a second code from an authenticator app or a text message.

Sony's support pages now point people towards passkeys first, and suggest 2SV if your device doesn't support passkeys. Sony lists passkeys as supported on most mobile devices with iOS 16 or later or Android 9 or later, and recommends the latest versions of Safari, Chrome or Edge if you sign in on a browser. It also advises against using a PIN code as your passkey on Android.

There is one trade-off worth knowing before you choose. Sony says 'Require Password at Checkout' is not compatible with your account if you have passkeys set up. If your main worry is someone in the house spending money, read the purchase section below before deciding.

Setting up passkeys and 2SV on PS5, PS4 and the web

Passkey

1. Sign in to Account Management.
2. Go to Security and enable Sign in with Passkey.
3. Select Create a Passkey and follow the on-screen instructions.

On a PS5, go to Settings > Users & Accounts > Account > Security > Sign in with Passkey, scan the QR code with your phone, then select Create a Passkey. You get an email confirmation once it is done. If a passkey ever stops working, Sony says to select Can't Sign In with Passkey on the sign-in screen and sign in via email or QR code.

2-step verification

1. Sign in to Account Management and select Security.
2. Next to 2-step Verification Status, select Edit.
3. Choose Authenticator App or Text Message, then scan the QR code or enter your mobile number.
4. Enter the code and select Activate.
5. Record your Backup Codes.

On PS5 the route is Settings > Users and Accounts > Security > 2-Step Verification. On PS4 it is Settings > Account Management > Account Information > Security > 2-Step Verification. Codes are valid for 10 minutes. Sony mentions Authy, Google Authenticator and Microsoft Authenticator as examples of authenticator apps.

Require Password at Checkout and wallet limits for children

Sony's best-practice page recommends setting up 'Require Password at Checkout' so someone else can't buy from PlayStation Store without your knowledge. As noted above, it doesn't work alongside passkeys.

For families, child accounts work differently. Sony explains that child accounts don't have their own PlayStation wallet; they spend from the family manager's wallet within a spending limit, and that limit is set to 0 by default when the family manager creates the account. You can change it in Account Management > Family Management, on the console under Settings > Family and Parental Controls > Family Management (PS5), or in the PlayStation Family app.

Sony also notes that if a child uses an adult account, they use PlayStation services without parental controls, which breaches its Terms of Service. If your child has been playing on your account, setting them up with their own child account is both safer and simpler. Our parents' guide covers this in more detail.

QR codes, DMs and 'free currency' sites Sony warns about

Sony's security best-practice page calls out three scams by name, which tells you how common they are.

• QR code scams. Never scan a QR code someone sends you, even if they say it will help you access your account or win a reward. Sony says these offers of free vouchers, gift cards or in-game items are designed to trick you into giving away access. See our guide to QR code login scams.
• DM scams. Messages offering a beta test or tournament place, or claiming your account was accidentally reported and offering help, are designed to get your sign-in details. Sony suggests changing your privacy settings to stop messages from unknown players.
• Free virtual currency sites. Sony says these sites exist to collect your information and get into your account and payment details. If you've ever entered details on one, change your sign-in method.

Sony also asks you not to sign in on shared devices such as public consoles, internet cafés or libraries, and to sign out at the end of any session on someone else's console.

Recovering a compromised account for PlayStation

If you can still reach your email, go to the Account Management sign-in page and select Trouble Signing in? > Recover Your Account. Sony emails you a secure link; follow it, fill in the details and set a new password. If the email doesn't arrive, check spam for "PlayStation", make sure the address is spelled correctly, and check the PlayStation status page.

If you have a passkey registered on another device, Sony says to sign in with that device and register a new passkey. If you can't use another device, or you can't access your email, or you don't recognise a sign-in ID, online ID or password change, contact Sony using its Online Assistant. The same applies if you have lost your 2SV phone and have no backup codes.

Once you're back in, sign out of every device. Sony lets you deactivate and sign out of all devices attached to your account from Account Management on a web browser, but only once every six months, so use it when it counts. Check Manage authorised apps for third-party services you don't recognise, and review your transactions. For a stolen console, Sony's advice is to change your sign-in method and remove all payment methods. Our triage page keeps these steps in order if you're doing this under pressure.