If Your Game Account Gets Hacked, Do This First

A step-by-step recovery path for a compromised gaming account, from locking down your email to getting stolen purchases looked at by support.

Short version

• Secure the email tied to your gaming account first, since a hijacked inbox lets a thief reset everything all over again.
• Scan your devices for malware before resetting passwords, or the thief can simply steal the new one too.
• Change the password, sign out all devices, turn on two-factor authentication and revoke apps you don’t recognize.
• Report fraud to the FTC, and to the FBI’s IC3 if money was lost; IdentityTheft.gov handles cases where your identity is being used.

Few things ruin an evening like opening your launcher and finding your password no longer works. Someone changed it, the recovery email isn’t yours anymore, and your library, your skins and your rank are all sitting in somebody else’s hands. It’s fixable more often than it feels in that moment, but the order you do things in matters. Here’s the sequence that works, starting with the account most people forget about.

Signs Your Account Has Been Taken Over

Some takeovers are loud. Others you only notice when a friend asks why you sent them a link to a shady site. The FTC lists the common warning signs:

• You can’t log in, even though the password worked last week.
• You get a notification about a username or password change you didn’t make.
• You get a login alert from a device you don’t recognize or a location you’ve never been.
• Friends or family report getting messages from you that you never sent, sometimes with random links or fake pleas for money.

If any of those hit, assume the worst and move fast. Credentials get lifted through phishing pages, malware, old data breaches, reused passwords or someone watching over your shoulder on a shared network; our piece on gaming on public Wi-Fi covers one of those in detail.

Secure Your Email Before Anything Else

This is the step people skip, and it’s the one that matters most. Steam’s own recovery guidance points out that gaming accounts are commonly compromised after the email address tied to them is compromised. If the thief still controls your inbox, they can intercept every reset link you generate and take the account right back.

So start there. Change your email password first, then work through your email settings:

• Delete any forwarding rules you didn’t create, so your messages stop going to someone else’s address.
• Check your sent folder for messages you didn’t write, and your deleted folder for anything the intruder read and removed.
• Confirm the recovery email and phone number on the account are actually yours.

Sign out of all sessions on the email account too, which kicks out anyone logged in from another device.

Change Passwords and Revoke Linked Apps

Before you reset anything, update your security software and run a scan on every device you use to log in. Steam’s guidance says to run virus and spyware scanners before changing your password, and the FTC gives the same advice for hacked accounts: if the scan finds something, delete it and restart. Otherwise a keylogger sitting on your PC will just capture the new password the moment you type it.

Then reset. The FTC suggests aiming for at least 15 characters, mixing upper and lowercase letters, numbers and symbols. A passphrase, which is several words strung together, is easier to remember and still hard to guess. A password manager can generate and store one for you; just protect the manager’s own password like the keys to the house.

While you’re in the game account’s settings:

• Sign out of all devices so every other session dies.
• Turn on two-factor authentication if the platform offers it. With 2FA, a stolen password alone isn’t enough to log in.
• Review connected apps and devices and revoke anything you don’t recognize.
• Screenshot unauthorized logins if the platform shows them. Most list the time, date, IP address and device type, and that record helps both support and any later report.

Contact the Platform’s Support the Right Way

Most big platforms have a dedicated flow for hijacked accounts, and using it beats filing a generic ticket. Activision, for one, routes hacked-account requests through a separate process and says those requests can take up to 2 days to process, with an email notification when it’s done.

Have your details ready before you start. Support teams commonly ask for things that prove you’re the real owner, such as purchase receipts, payment method details or the account’s creation information. If a ticket stalls, ask politely for it to be escalated. Persistence pays here, and so does staying calm; the person reading your ticket didn’t hack you.

What to Do About Purchases and In-Game Items

Once you’re back in, go through the account’s purchase history, download history and in-game activity to see what the intruder actually did. Screenshot anything that isn’t yours, since that’s your evidence if you need to dispute charges or claim lost items.

What you get back depends on the store and the situation. No store guarantees a refund for unauthorized activity, so treat any promise otherwise with suspicion, and check the platform’s own policy before you file. Our article on digital game refunds breaks down how the major stores handle requests. It’s also worth remembering that everything tied to that account, from games to cosmetics to currency, is a license rather than property you hold outright; what “buy” really means explains why recovery through support is often your only route back.

Check Your Other Accounts and Payment Methods

The FTC has been blunt about password reuse: in its case against the delivery platform Drizly, an executive’s reused password that had leaked in an unrelated breach allegedly got a hacker into a database holding information on 2.5 million users. Hackers count on the same password showing up elsewhere, and the Cyber Helpline’s gaming recovery guide says it plainly: change any other account that uses the same or similar login details immediately.

Then do a quick sweep:

• Scan every device you use to reach the account, not just your gaming PC.
• Check your card and bank statements for charges you didn’t make.
• Look at your other game platforms, since thieves often hop between them once they have working credentials.
• If your saves or progress were affected, our guide to backing up game save data covers how to protect what’s left on every platform.

When to Report a Scam to the FTC

If money was stolen or you were scammed as part of the takeover, report it. The FTC asks people who spot a scam to slow down, talk it through with someone they trust, and then file a report at its ReportFraud site. Your report feeds the FTC’s investigations, and other law enforcement agencies can see it too.

Two other routes depending on what happened:

• If someone is using your information to open new accounts or make purchases, that’s identity theft. IdentityTheft.gov is the federal government’s one-stop resource for reporting it and building a recovery plan.
• For broader cybercrime, including fraud where you lost money, the FBI’s Internet Crime Complaint Center (IC3) accepts reports even when you’re unsure your case qualifies. Reports help the FBI track trends and, in some cases, freeze stolen funds, though it can’t respond to every submission.

One caution: the IC3 says it does not work with any non-law enforcement entity to recover lost funds and will never contact you asking for money or information. Anyone offering a paid “account recovery service” with an inside line is selling you a second scam.

Getting a gaming account back is mostly about sequence: email first, clean devices second, passwords and 2FA third, support and reports after that. While you wait on a ticket, it’s a decent time to think about where the credentials leaked in the first place, starting with our look at what’s actually safe on public Wi-Fi. And once you’re back in, lock the door behind you with two-factor authentication before someone tries the same trick twice.

Quick questions

Why fix my email before my game account?
Steam’s support guidance notes that gaming accounts are commonly compromised through the email address linked to them. If the hacker still controls your inbox, they can intercept recovery links and undo every password you reset.

How long does account recovery take?
It varies by platform. Activision, for example, says hacked-account requests can take up to 2 days to process and that you’ll be notified by email when the request is complete.

Should I pay a service that promises to recover my account?
Be skeptical. The FBI’s IC3 warns that it does not work with any non-law enforcement entity to recuperate lost funds, so anyone claiming a special recovery pipeline is a red flag.

Is it worth reporting if I got my account back?
Yes. The FTC uses reports to build cases against scammers, and IC3 reports help the FBI track trends and, in some cases, freeze stolen funds.