How to protect your Steam, PSN and Xbox accounts, and recover them if hacked

Start with the linked email account

Start by deciding which situation you are in. If you are setting up protection today, secure the linked email first and then Steam, PlayStation or Xbox. If you have spotted an unfamiliar sign-in or account change, stop entering passwords on the device you no longer trust. Move to a trusted phone or computer, secure the email account first, then follow ‘If you suspect theft, use this order’ to scan the device and end open sessions.

The inbox comes first because anyone who controls it can request a new password, delete the warning and regain access after you secure the gaming account. Valve gives email security the same priority in its stolen-account assistant.

Give the email account a password that you use nowhere else. Enable two-step verification or a passkey, then confirm that its recovery phone number and address still belong to you. Keep backup codes away from the device used to sign in.

Now secure each platform. Enable Steam Guard Mobile Authenticator and store its recovery code away from the phone. PlayStation supports passkeys or an authenticator app and provides ten backup codes. Microsoft passkeys use a device PIN, face or fingerprint, so a convincing fake website cannot trick you into typing the account password.

Enable verification and review authorised devices

Check the website address before signing in. Steam warns about fake login pages and says its staff will not contact players through Discord, so type `steampowered.com`, `playstation.com` or `microsoft.com` yourself instead of following an urgent link sent by a stranger.

Install the official apps and enable sign-in notifications. Keep recovery codes in a password manager or on paper, not in a screenshot on the same phone you might lose. Add another recovery method that you control and remove old phone numbers.

Review authorised devices and close anything unfamiliar. Steam can deauthorise devices through its security settings, Microsoft shows 30 days of recent activity, and PlayStation provides a control to sign out on every device. The same check removes access from a console you have sold.

Do not share a password to let someone play at home. Use features designed for that purpose, such as Steam Families or Console Sharing on PS5. Another person can then use the games without gaining your account credentials.

If you suspect theft, use this order

On a trusted device, secure the email account first: change its password and review recovery methods and sessions. Then do the same for the gaming account and replace reused passwords elsewhere. Keep the suspect device aside, update it and scan it before entering credentials there again. Do not delay protection you can complete from another trusted device.

Look for warnings about changed email addresses, aliases, phone numbers or authenticators, as well as unfamiliar purchases and trades, and save screenshots, messages and receipts. Then end open sessions and remove unknown devices. Microsoft's global sign-out can take up to 24 hours and does not include Xbox consoles, so check those separately.

Do not pay account-recovery strangers or share sign-in codes with people contacting you by message. Enter codes only in an official process you opened yourself, checking the domain and the purpose of the code.

Recovering Steam, PlayStation and Xbox

Steam: use the official stolen-account assistant. Valve asks you to scan the device and secure the email account first. You can then find the Steam account by email, phone number or name. If you can still sign in, change the password, deauthorise unfamiliar devices and inspect recent trades. Check for an API key you did not create as well, because it may let an external tool act on the account.

PlayStation Network: try a password reset through Account Management. If the email address changed, messages do not arrive or other details were altered, use PlayStation's official US recovery route and online assistant. Keep the online ID, original email address, serial number of a linked console and purchase receipts available in case support asks for them.

Xbox/Microsoft: if you can sign in, review Recent activity and select “This wasn't me” where appropriate. Otherwise, start with Microsoft's sign-in helper. The recovery form cannot bypass two-step verification. If it was enabled and every verification method and recovery code is lost, support cannot replace them. After regaining access, review aliases, security settings, Outlook, OneDrive and Microsoft Store.

Handling purchases and personal data

Review transactions and saved payment methods. Report unrecognised charges to the platform and card issuer through official channels. Do not delay reporting possible fraud while attempting account recovery. Keep receipts and the reference numbers for both reports.

Once you can sign in again, create new recovery codes, invalidate the old ones and confirm that you control the email account, active sessions, sign-in methods, purchases and recovery options.