How to protect your Steam, PSN and Xbox accounts, and recover them if hacked

Start with the linked email account

Start by deciding which situation you are in. If you are setting up protection today, secure the linked email first and then Steam, PlayStation or Xbox. If you have spotted an unfamiliar sign-in or account change, stop entering passwords on the device you no longer trust. Move to a trusted phone or computer, secure the email account first, then follow ‘If you suspect theft, use this order’ to scan the device and end open sessions.

The inbox comes first because anyone who controls it can request a new password, delete the warning and regain access after you secure the gaming account. Valve gives email security the same priority in its stolen-account assistant.

Give the email account a password that you use nowhere else. Enable two-step verification or a passkey, then confirm that its recovery phone number and address still belong to you. Keep backup codes away from the device used to sign in.

Now secure each platform. Enable Steam Guard Mobile Authenticator and store its recovery code away from the phone. PlayStation supports passkeys or an authenticator app and provides ten backup codes. Microsoft passkeys use a device PIN, face or fingerprint, so a convincing fake website cannot trick you into typing the account password.

Enable verification and review authorised devices

Check the website address before signing in. Steam warns about fake login pages and says its staff will not contact players through Discord, so type `steampowered.com`, `playstation.com` or `microsoft.com` yourself instead of following an urgent link sent by a stranger.

Install the official apps and enable sign-in notifications. Keep recovery codes in a password manager or on paper, not in a screenshot on the same phone you might lose. Add another recovery method that you control and remove old phone numbers.

Review authorised devices and close anything unfamiliar. Steam can deauthorise devices through its security settings, Microsoft shows 30 days of recent activity, and PlayStation provides a control to sign out on every device. The same check removes access from a console you have sold.

Do not share a password to let someone play at home. Use features designed for that purpose, such as Steam Families or Console Sharing on PS5. Another person can then use the games without gaining your account credentials.

If you suspect theft, use this order

Before changing any passwords, update the system and run a security scan rather than using a computer that might be infected. Then use a trusted device to change the email password first and the gaming account password second. If you reused that password, replace it on every other service too.

Look for warnings about changed email addresses, aliases, phone numbers or authenticators, as well as unfamiliar purchases and trades, and save screenshots, messages and receipts. Then end open sessions and remove unknown devices. Microsoft's global sign-out can take up to 24 hours and does not include Xbox consoles, so check those separately.

Never pay an account-recovery stranger or hand over one-time codes. Genuine support does not need you to read back a code that just arrived to verify you.

Recovering Steam, PlayStation and Xbox

Steam: use the official stolen-account assistant. Valve asks you to scan the device and secure the email account first. You can then find the Steam account by email, phone number or name. If you can still sign in, change the password, deauthorise unfamiliar devices and inspect recent trades. Check for an API key you did not create as well, because it may let an external tool act on the account.

PlayStation Network: try a password reset through Account Management. If the email address changed, messages do not arrive or other details were altered, use PlayStation's official US recovery route and online assistant. Keep the online ID, original email address, serial number of a linked console and purchase receipts available in case support asks for them.

Xbox/Microsoft: inspect Recent activity and select ‘This wasn't me’ where appropriate. Use the official Microsoft account recovery form if you can no longer sign in. After access returns, review the aliases, security methods and password. Check Outlook, OneDrive and Microsoft Store as well because the same Microsoft account opens those services.

Handling purchases and personal data

Check the transaction history and saved payment methods. Report an unfamiliar charge to the platform first so it can secure the account and trace the transaction. Contact the card issuer when appropriate. Speak to platform support before requesting a chargeback because some services restrict accounts after a payment reversal.

Change the password for every store, forum or game where you reused those credentials. Secure the email account and close any sessions the attacker may still control.

Once you can sign in again, create new recovery codes, invalidate the old ones and confirm that you control the email account, active sessions, sign-in methods, purchases and recovery options.