Game Account Takeover Scams
Scammers steal gaming accounts via phishing, fake login pages, or social engineering to sell them or drain their value.
Last reviewed: 1 June 2026
What this scam is
Game account takeover scams target the accounts players build up over months or years of play — accounts containing rare items, high character levels, accumulated currency, cosmetics, and a history of purchases. Because these accounts can hold real monetary value on secondary markets, they are a direct target for theft.
The scammer's goal is to gain access to the account credentials and then change the associated email address and password before the legitimate owner can respond, locking them out. Once in control, the scammer may sell the account on grey-market platforms, strip valuable in-game items and sell them separately, use stored payment methods for further purchases, or hold the account to ransom.
Account takeover can happen through several routes. Phishing is the most common: a fake login page that mimics the game's official site captures credentials when the player attempts to sign in. Credential stuffing uses email and password combinations leaked from other data breaches, exploiting the fact that many people reuse passwords. Social engineering — posing as a friend, a game support agent, or a tournament organiser — manipulates the player into sharing a verification code or changing their linked email.
Game accounts often hold real value that players do not think of in purely financial terms — a beloved account with years of progress can feel irreplaceable. Account takeover can therefore cause significant distress beyond any monetary loss, which is why prevention is so much more effective than recovery after the fact.
How it works
The phishing route typically begins with a convincing message. A direct message on a gaming platform, a Discord notification, or a text or email informs the player that their account has been flagged, that they have received a prize or reward, or that they must verify their details to prevent suspension. The message contains a link to a website that replicates the game's official login design.
The player enters their username and password. These are captured immediately. The page may then redirect to the real site or show an error message. In the same moment, the scammer uses the captured credentials to log into the real account and begins changing recovery details.
Credential stuffing is less targeted: scammers use automated tools to attempt logins across many gaming platforms using email and password combinations from known data breaches. If someone uses the same password for their email and their game account, both can be compromised in sequence.
In social engineering variants, a player may be contacted by someone claiming to be a friend whose account was hacked, a tournament coordinator requiring account verification, or a support agent. The scammer asks the player to confirm their one-time login code — an authentication code the player has just received — claiming it is needed for verification. Sharing this code allows the scammer to complete the login and lock the player out.
Some takeovers occur through third-party cheating tools or 'boosting' services where the player willingly shares credentials, only to find their account stripped afterwards.
Why this scam works
Gaming accounts have genuine value — both monetary and emotional. The investment of time and in some cases real money makes the idea of account suspension or loss alarming, which the phishing message exploits.
For younger players especially, the social dimension of gaming — knowing friends' accounts, seeing familiar usernames — can lower suspicion. A message that appears to come from a familiar gaming community or a well-known platform name feels safe.
Password reuse is extremely widespread and significantly amplifies risk. A single breach of a less secure site can expose the same credentials used for a high-value game account. Players are not always aware that their email and password have been exposed in a breach, or what consequences this might have for other services.
A typical pattern
A player receives a direct message on a gaming platform informing them that their account has won a prize or been selected for a beta test. The message contains a link to a site that looks identical to the game's official login page. The player signs in. Moments later they receive a notification that their email address on the account has been changed. By the time they attempt to use the game's account recovery, the email linked to the account belongs to the scammer, and the recovery path is blocked. The account — containing years of progress, rare items, and linked purchases — is inaccessible.
Common red flags
- Message claiming your account has been flagged or will be suspended
- Link to a login page sent via message — check the URL before entering anything
- Request to share a verification or login code you just received
- Offer of a prize or reward that requires logging in through an external link
- Account email changed notification you did not initiate
- Someone claiming to be support asking for your account password
- Tournament or giveaway requiring credentials beyond your public username
- Login page that looks slightly off or is hosted on an unfamiliar domain
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Your [game] account has been reported. Log in to verify your identity or it will be suspended: [fake link]
Congratulations! Your account was selected for a free [item] reward. Claim here: [fake link]
Hi, I'm from [game] support. Can you confirm the code sent to your email so we can restore your account?
This is [username] — I got hacked and need you to verify your account on this link too: [fake link]
You've qualified for our beta programme. Sign in to confirm your place: [fake link]
Security alert: an unrecognised device tried to access your account. Confirm your login at [fake link]
Common variations
- Phishing via fake login page — most common, replicates the game's sign-in page
- Credential stuffing — automated use of leaked email/password pairs from other breaches
- Code-sharing social engineering — tricks player into sharing a one-time authentication code
- Boosting service theft — player shares credentials with a 'booster' who then steals the account
- Fake support agent — poses as official support to obtain recovery details
- Friend impersonation — uses a compromised or similar-looking account to trick the player
How to verify before you act
Always navigate to the game's official site by typing the address directly or using your saved bookmark — never via a link in a message, even one from an apparent friend or support contact. Check the domain in your browser carefully before entering any credentials.
Legitimate game support teams do not ask players to share one-time login codes, authentication codes, or verification codes. If someone asks you to read out or paste a code you just received, treat it as a takeover attempt regardless of how they are identifying themselves.
Check whether your email address has appeared in known data breaches by using a reputable breach-checking service. If it has, update the password for that email account and any other service that uses the same credentials.
Enable two-factor authentication on your game account and the associated email address. An authenticator app is more secure than SMS-based verification for this purpose.
Payment methods used
- No direct payment — harm is account theft and loss of items or purchases
- Stored payment methods may be used for further purchases after takeover
Who is usually targeted
- Players with high-value accounts containing rare items or currency
- Competitive players who have invested significant time or money
- Younger players less familiar with phishing patterns
- Players who reuse passwords across multiple services
What to do immediately
- If you entered credentials on a suspicious page, immediately go to the official site and change your password
- Change the password of the email address linked to the account
- Enable two-factor authentication on both the game account and linked email
- Contact the game publisher's support team to report the takeover and begin recovery
- Check recent login history on the account for unrecognised sessions
- Review linked payment methods and check for unauthorised purchases
- If the account is already locked, use the official account recovery process — not any link from the scammer
How to prevent it
- Use a unique, strong password for every game account — never reuse passwords
- Enable app-based two-factor authentication on game accounts and linked emails
- Navigate to game sites by typing the URL directly, never via links in messages
- Never share one-time codes with anyone, regardless of who they claim to be
- Use parental controls to restrict account changes on younger players' accounts
- Check your email for breach notifications and update affected passwords promptly
- Be sceptical of any message offering prizes, flagging your account, or requesting verification
- Use a password manager to generate and store unique credentials
Evidence to preserve
- Screenshot or copy of the message that led to the page
- URL of the fake login page
- Timestamps of when account changes occurred
- Records of any purchases made after the takeover
- Correspondence with the scammer if any occurred
- Confirmation emails of account changes received from the game publisher
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Can game publishers recover a stolen account?
Yes, most publishers have an account recovery process. Contact their official support team using contact details from their official website. The process varies but typically involves verifying original purchase information or the original email address used to create the account.
Why would someone want my game account?
Accounts containing rare items, high-level characters, significant currency, or extensive purchase history have real monetary value on secondary markets. Some buyers pay substantial amounts for established accounts in competitive games.
I shared a code with someone — is that enough for them to take over my account?
Yes. One-time codes are the key to bypassing two-factor authentication. If you shared a code, contact the game's support team immediately and change your password and the linked email address.
How do I know if my email or password has been leaked?
Reputable breach-checking tools allow you to enter your email address to see whether it appears in known data breaches. If it does, change the password for that email account and any other account that uses the same password.
Is SMS two-factor authentication safe enough?
SMS-based two-factor authentication is better than nothing, but it can be intercepted by SIM-swapping attacks. An authenticator app generates codes on your device without relying on your phone number, making it significantly more secure.
A friend's account messaged me with a suspicious link — what should I do?
Do not click the link. Contact your friend through a separate channel (call, email, different platform) to let them know their account may be compromised. Report the message to the platform.
What if I shared my credentials with a boosting service?
Change your password and the linked email address immediately. Enable two-factor authentication. Check for any items transferred or purchases made. Sharing credentials with any third party violates most games' terms of service and removes the publisher's obligation to assist with subsequent loss.