Gaming Account Hacked? How to Get It Back, in the Right Order

A stolen game account is not usually stolen for what is in the inbox. It is stolen for the library, the inventory and the identity: years of purchases, tradable items with a real market price, a rank and a friends list that will believe anything signed with your name, and a payment method that is still attached. The recovery order below is the one the platforms themselves use, with the two steps most guides leave out: the machine the credential was taken from has to be cleaned before a new password means anything, and the password change alone does not remove the person who is already inside.

What a game account is actually worth to a thief

Most people underestimate this, which is why they under-react. A modern account carries at least five separate assets, and each one is monetised differently.

• The library. Hundreds of titles bought over a decade, often worth more than the hardware. Resold as a whole account, it has a street price.
• The inventory. Skins, cases, currency, characters, mounts. Anything tradable converts to money in minutes, and anything untradable still has value to a buyer.
• The identity. Rank, level, hours, achievements, a name other players recognise. That is what account resale and boosting services are buying.
• The payment method. A stored card, a wallet balance, a subscription. This is the asset that costs you money while you are locked out.
• The social graph. The friends list is the delivery mechanism for the next wave of fraud, because a message from a friend's account gets clicked.

There is a sixth asset that people forget until it bites: the sign-in. Steam, Epic, Xbox and PlayStation identities are used to log into third-party sites through open authentication. An attacker who holds the account can authorise services you never touched, and those authorisations can outlive your password.

Signal check: takeover, lock, or a routine security prompt

Three situations look similar from the outside and need different responses. Filing a takeover report against an account that is only locked wastes days, and treating a takeover as a glitch hands the attacker more time.

The distinction matters because the evidence you need differs. A takeover needs proof of ownership and a security cleanup. A ban needs an enforcement appeal, and pretending a ban was a hack is one of the fastest ways to lose an account for good.

Clean the machine before you change the password

Game accounts are rarely guessed. They are harvested, and the harvest happens on the device you play on. Cracked releases, mod menus, cheat loaders, trainers and anything advertised as free currency are the classic delivery route, and the payload is usually an information stealer that copies saved browser sessions, not just passwords.

That detail changes the order of everything that follows. If a session token was copied, the attacker does not need your password at all: they are already authenticated, and your password change does not remove them. So:

1. Recover from a different device. Use a phone or a machine you have not installed game mods on.
2. Scan the gaming PC with an up-to-date malware scanner, remove anything it finds, then check browser extensions and startup entries by hand.
3. Assume every password typed on that machine is exposed until proven otherwise, and treat reused passwords as the next incident already in progress.
4. Do not reinstall the thing that took it. A second infection after a clean recovery is the most common way people lose the account twice.

Two delivery tricks deserve their own line because they bypass passwords entirely. The first is a fake login page that looks like a platform sign-in and instead registers an authorisation on your account. The second is a QR code sent in a message, presented as a way to verify yourself, which actually authorises the sender's client. Neither asks for your password, so neither fails a "did I give my password away" check.

Secure the mailbox the account hangs from

Nearly every platform reset travels through email, so the mailbox is the real perimeter. Steam says it plainly, Epic says it plainly, and the console makers behave the same way. Before touching the game account:

• Change the email password from the clean device and turn on two-factor authentication there.
• Check for forwarding rules, filters and auto-replies you did not create. A filter that quietly files platform mail into an archive folder is how people miss the "your email was changed" notice for a week.
• Review recovery addresses and phone numbers, app-specific passwords, and any connected third-party mail clients.
• Check the sent and deleted items for platform notifications. Support will ask when the change happened, and that timestamp is your best answer.
• If you no longer control the mailbox, recover it through the provider first. A stolen mailbox makes every game-account reset impossible.

The step almost everyone skips: evict the sessions

Changing a password is the middle of the job, not the end. Already-authenticated sessions keep working on many platforms, and a stolen token does not care what the password is now. After the password change, go straight to the device and authorisation lists and remove everything you cannot identify:

• Steam: deauthorise all other devices from the Steam Guard settings, then sign out everywhere. Regenerate backup codes from the mobile authenticator afterwards.
• PlayStation: deactivate all devices from Account Management, then set your own console as primary again. Remote deactivation is limited, so read the next section before using it.
• Xbox and Microsoft: sign out everywhere from the security settings, then review connected apps and app passwords.
• Epic, Riot, Battle.net, Roblox, Discord: each has a session or authorised-device list; end every session, then revoke connected applications you do not recognise.

While you are in there, look at the account changes rather than only the sessions: recovery email, recovery phone, linked accounts, authorised payment methods, and any API keys or developer tokens. Those are the settings that let an attacker come back after you have changed everything else.

Steam, precisely: the route, the devices and the API key

Steam is where most of the money is, and where the sequence is most often done out of order. If you can still sign in, the order is: clean the machine, change the email password, change the Steam password from a trusted device, deauthorise all devices, then check four specific places.

The scam this exists to serve is trade redirection. With access, or with an API key, an attacker can cancel your outgoing offer and create a near-identical one to an account that copies your friend's name and avatar. You approve a trade to someone you trust and the items go to a stranger. Steam holds some trades in escrow precisely to blunt this, and where a protected trade can still be reversed the window is short and costs you a trading cooldown. Be clear about the limit: Steam does not return items that have left an account. The reversal window is the only rollback that exists, which is why the history check comes before anything else.

If you cannot sign in at all, use the stolen-account wizard and work its order: scan the machine, secure the email, then recover the account. The ticket is judged on evidence, not on urgency, so prepare the card described further down before you submit. Enabling the mobile authenticator and storing its backup codes offline is the difference between this being a bad week and a lost library.

PlayStation, Xbox and Nintendo

PlayStation. Start with the account recovery flow, which sends a secure link to the sign-in ID. If two-step verification is on and the phone is gone, the ten single-use backup codes are the intended way in. When neither works, support needs four things: your online ID, the sign-in ID, the serial number of a console used to create or sign in to the account, and details of a recent transaction including its order number, the item, the price and the date. One operational trap: remote deactivation happens once every six months and cannot be done per device, so if you deactivate all, you will not be able to do it again until the window resets. Change the password first, because that is what signs other consoles out.

Xbox and Microsoft. If you can still sign in, Recent activity is the fastest instrument on the page: each entry can be marked as not you, which forces a password change and a security review. If you cannot sign in, the account recovery form is the route, and it asks for details only the owner would know: old passwords, subject lines of recent mail, contacts, subscriptions, console names. The form cannot bypass two-step verification. If verification was on, and every method and recovery code is lost, support cannot substitute for it, so the honest plan is to review aliases and recovery options first and expect a multi-day review rather than an instant reset.

Nintendo. The Nintendo Account page holds sign-in history and linked accounts. The reset runs through the registered email, and the console is not a recovery channel on its own. If the email was changed, the support form is the only route, and it wants the account's date of birth and the serial number of the console it was created on.

Epic, Riot, Roblox and Discord

Epic. Epic's own order is the clearest of any platform and worth following literally: secure the email, reset the password, then try a linked console or social sign-in, then submit an account recovery request. The linked-account step is the one people miss, because the attacker changed your password, not the console linkage. Signing in through PlayStation, Xbox, Nintendo or a social account can put you back inside. And if the email was changed to one you do not control, signing in is not enough: you must submit the recovery request, because whoever holds the email can take the account back at will.

Riot. The ticket route, and it is judged on specifics: account name, region, the email the account was created with, the date it was created, the first purchase and its order number, and any previous names. A ticket that says "I was hacked, please help" gets a form reply; a ticket with a date, an order number and a first champion purchase gets a human.

Roblox. Recovery runs through the verified email, and two-step verification is the difference between a bad afternoon and a lost inventory. If the email is gone, support needs the account name, the original email, and payment evidence for any purchase, including gift cards redeemed on the account.

Discord. Takeover here is usually token theft rather than a password guess, so a password change alone can leave the attacker inside. Log out of all known devices, then review authorised apps and connected accounts, because a bot authorisation is a permanent door. The QR-code login scam belongs here too: a code sent as verification authorises the sender's client in one scan.

The evidence card support actually reads

Every platform asks for the same underlying proof: that you are the person who created the account, and that you still control something attached to it. Assemble it before you open a ticket, because half of these facts disappear once the attacker edits the profile.

Support staff never ask for a password, and no legitimate recovery requires you to install a remote-desktop tool. Those two sentences cover most of the fraud that follows a public account theft.

While you are locked out: what is happening on the other side

The account is being used, not parked. Inventory and currency go first, because they convert fastest. Stored payment methods are tested with small purchases or gift-card top-ups, and the account itself may be listed for sale with the rank and library described as features. Your friends list gets the second wave: messages offering cheap currency, a tournament invite, a trade that needs a quick confirmation, or a link to a clan site that asks them to sign in.

Four actions are worth taking in parallel with the recovery ticket. Tell your payment provider and freeze the card attached to the account. Warn your friends and clan in one message, naming the platform and the fact that anything from your account is not you. Do not open a new account with the same email, which complicates the recovery rather than helping it. And record everything as it happens, with timestamps, because a chargeback dispute or a police report later depends on a record you make now.

The ban that the attacker earned

This is the part no checklist likes to say out loud. An attacker who used your account to cheat, launder items or abuse other players can leave you with an anti-cheat ban, a hardware ban or an enforcement strike. Restoring access does not automatically clear it, and on some platforms violations are recorded against the account rather than the person.

The only route is the platform's own appeal, filed after the account is back in your hands, with the evidence that the activity was not yours: the date the account was accessed from an unfamiliar location, the change of email, the support ticket number for the recovery. Two rules keep this honest and effective. Do not claim a hack for a ban that predates it, because a false appeal is treated as a second violation. And do not expect a guarantee: some bans are permanent by design, and a platform that says so is telling you the truth, not stalling.

The recovery-service market, and the second theft

A stolen account creates a second business: people who offer to get it back. The pattern repeats across Discord, Telegram, livestream chats and forum direct messages. They show screenshots that could be anyone's, quote a price, ask for a small deposit, then ask for exactly the information that proves ownership, or for remote access to your machine, or for one verification code to confirm the request.

Three things separate lawful paid help from the fraud. Lawful help works only through the platform's own recovery and appeal routes, and says so up front. It asks the account owner to file, or works under written authorisation from the owner of record. And it never needs your password, a live two-factor code, or a remote session on your computer. Anyone offering to break into the account on your behalf is describing unauthorised access, which remains a crime even when the account was yours first, and it is also how the second theft starts.

When the account is not yours to recover

Team, company and family accounts need one extra step before anything else: written authorisation from the owner of record. An esports organisation's account belongs to the organisation, not the player who plays on it; a company's store account belongs to the company; a child's account is administered by the parent. The owner of record files the ticket, and anyone helping does so in writing, with a named scope. If you are the one helping, keep that authorisation, because it is what separates incident response from account takeover when the request is later questioned.

For family accounts, the practical setting is the platform's own family or parental controls, which let an adult manage purchases and playtime without sharing a password. Sharing one login across a household is the most common reason a recovered account is lost a second time.

Prevention that survives the next attempt

• An authenticator app or a passkey, not SMS alone. SMS falls to a sim swap, and the recovery codes printed and stored offline are the only way back if the phone is lost.
• A unique password per platform, generated and stored in a password manager. The reuse cluster is what turns one breach into six.
• A separate email for purchases, or at minimum an alias per platform, so a breach list does not map your identity across services.
• Purchase notifications on for the card attached to the account, so a test charge is visible within minutes.
• No account sharing, no boosting services, no lending a login, even to a friend. It breaks the platform's terms and destroys the ownership evidence you would need.
• A periodic look at the authorisations list, once a season, because the door that matters is usually one you do not remember opening.

Frequently asked questions

Can I get a hacked game account back if the email was changed to one I do not control?

Yes, through the platform's recovery request rather than the reset flow, and only with ownership evidence. The reset route is closed because the code goes to the attacker, so the request has to establish that you created the account: original email, creation date, order numbers, card last four digits, console serial numbers, previous usernames. This is why the evidence card matters more than the wording of your message.

Do I need to change my password everywhere if one game account was stolen?

Assume yes until you have checked. Game credentials are usually harvested by a stealer that copies everything the browser had saved, so the same device, the same reused password and the same email are all exposed. Change the email password first, then every account that shared the password, then enable two-factor authentication on the ones that matter.

Will changing my password remove the person who is already inside my account?

Not always. Sessions and authorisations can survive a password change, and a stolen session token does not care what the new password is. Changing the password, ending all sessions, deauthorising unknown devices and revoking unknown API keys or connected apps are four separate actions, and the account is not secured until all four are done.

The attacker used my account to cheat and now I have a ban. Will support remove it?

Only through the platform's own appeal, and there is no guarantee. Some anti-cheat and enforcement penalties are permanent by policy or are recorded against the account rather than the person. File the appeal after you have recovered access, attach the evidence that the activity was not yours, and never claim a hack for a ban that predates it.

Is it legal to pay someone to recover a game account for me?

Only if they work through the platform's official recovery and appeal routes with your authorisation. Anyone who offers to break in, or asks for your password, a live verification code or remote access to your machine, is describing unauthorised access, which is a crime even when the account was yours. The lawful version is authorised help with the official process, and it never needs your credentials.

The short version

Clean the device, secure the mailbox, change the password, evict the sessions, revoke what you did not create, then let support judge the evidence you collected before the profile changed. Do the steps in that order and a stolen game account is usually an expensive week. Do them in the wrong order, or skip the session and API-key step, and the same account gets taken twice.