In late 2018, a chain of flaws in Epic Games’ web login infrastructure could let an attacker take over a Fortnite account after its owner clicked a crafted phishing link. Epic patched the flaws within weeks of disclosure, according to WIRED’s January 2019 report; this is a historical incident, not evidence that the same vulnerability is active today.
How the Fortnite account takeover worked
Check Point Research described an attack against Epic’s single sign-on (SSO) login and token-handling flow, rather than a cheat, downloadable mod, or ordinary Fortnite game-client bug. The attack began with a malicious link, potentially dressed up as an offer or free game credits. In the reported flow, clicking the link could be enough: the victim did not need to enter their password again.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Fortnite eGift Card | $50.00 | Buy on Amazon |
| 2 |
|
Fortnite eGift Card | $25.00 | Buy on Amazon |
| 3 |
|
Fortnite Physical Gift Card | $30.00 | Buy on Amazon |
| 4 |
|
Fortnite eGift Card | $15.00 | Buy on Amazon |
| 5 |
|
Fortnite Physical Gift Card | $50.00 | Buy on Amazon |
The researchers said a redirect in the SSO sign-in process could send authentication data to a vulnerable Epic subdomain. Injected JavaScript on that subdomain could then capture the authentication token. An attacker holding the token could access the account without needing the player’s password in that described attack chain. Check Point Research’s technical account and WIRED’s contemporaneous report describe the chain.
What an attacker could do with a stolen token
Check Point said account access could expose stored information, enable in-game purchases, and allow an attacker to access or record in-game conversations. Those are capabilities described by the researchers, not proof that every capability was used against victims.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- Redeemable on accounts in the United States and in U.S. Dollars.
- Gift card must be redeemed at EpicGames.com/redeem. This gift card WILL NOT work if redeemed directly on a console device (PlayStation, Xbox, Nintendo Switch, etc.)
- If you play Fortnite experiences on a console device, you need to link your Epic Games account to your console account(s) so items purchased at Fortnite.com/item-shop appear across all of your linked accounts
- Requires internet connection, valid Epic account and prior acceptance of the terms
- Redemption: Online
What is known—and not known—about exploitation
WIRED reported that the researchers combined three flaws: an issue involving a legitimate Epic URL, a redirect problem in the SSO process, and a database-query flaw. Check Point disclosed its findings to Epic at the beginning of November 2018, and Epic patched the bugs a few weeks later, WIRED reported in January 2019.
The reviewed reports do not establish that attackers used this specific chain against players, how many accounts may have been affected, or any realized financial losses. WIRED cautioned that another party might have discovered the attack before Check Point. Its report also said Fortnite had topped 200 million registered players at the end of 2018; that is historical context, not a current player count or an estimate of affected accounts.
Rank #2
- Redeemable on accounts in the United States and in U.S. Dollars.
- Gift card must be redeemed at EpicGames.com/redeem. This gift card WILL NOT work if redeemed directly on a console device (PlayStation, Xbox, Nintendo Switch, etc.)
- If you play Fortnite experiences on a console device, you need to link your Epic Games account to your console account(s) so items purchased at Fortnite.com/item-shop appear across all of your linked accounts
- Requires internet connection, valid Epic account and prior acceptance of the terms
- Redemption: Online
How to protect your Epic account now
For current account security, Epic recommends steps that address phishing, password reuse, and access through linked accounts. Its account security guidance includes:
- Use a unique password for Epic. Epic suggests considering a password manager to create and store strong, unique passwords.
- Turn on two-factor authentication (2FA). Epic lists authenticator apps, SMS, and email as methods, and recommends authenticator apps.
- Enable 2FA on linked accounts too. A linked console or social account may provide a route into your Epic account.
- Sign in through official Epic websites or apps; avoid suspicious links and attachments, including unofficial free V-Bucks offers.
- Keep your devices and security software up to date.
What to do if your Fortnite account is compromised
If you suspect someone has accessed your account or you cannot sign in, Epic’s compromised-account recovery instructions set out this sequence:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- An Epic Games account is required to redeem an Epic Games Store Card code
- If playing on a console platform (PlayStation Network, Xbox Live, Nintendo Switch or Mobile) you need to link your Epic Games account to that gaming platform (one time) to redeem your gift card code
- The 16 digit code on the back of the card WILL NOT work if redeemed directly through your gaming platform (PlayStation Network, Xbox Live, Nintendo Switch, Mobile, etc.)
- Note: Nintendo devices do not support Fortnite Shared Wallet, so V-Bucks purchased using your account balance will not show up on your Nintendo device. However, if you purchase items in the web Item Shop — or another platform where you play Fortnite — those items will be available in your Locker across all platforms.
- Redemption: Online
- Secure the email account associated with Epic first, including changing its password and enabling 2FA if available.
- Reset your Epic password if you can still access the account.
- If Epic sign-in is unavailable, try signing in through a linked console or social account.
- If you still cannot log in, or the account email was changed, submit an account recovery request through Epic’s support workflow.
- After regaining access, reset the Epic password and turn 2FA back on.
Recovery depends on Epic’s review; following the steps does not guarantee that an account can be restored.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where to report a security flaw
Researchers who believe they have found a vulnerability in an Epic site or product can email [email protected] or submit it through Epic’s security page, which directs researchers to its HackerOne bug bounty program. For account access or password problems, Epic directs players to customer support. The security page is the place to check current reporting terms; no bounty amount or eligibility is established here.
Quick Recap
Best Value
- An Epic Games account is required to redeem an Epic Games Store Card code
- If playing on a console platform (PlayStation Network, Xbox Live, Nintendo Switch or Mobile) you need to link your Epic Games account to that gaming platform (one time) to redeem your gift card code
- The 16 digit code on the back of the card WILL NOT work if redeemed directly through your gaming platform (PlayStation Network, Xbox Live, Nintendo Switch, Mobile, etc.)
- Note: Nintendo devices do not support Fortnite Shared Wallet, so V-Bucks purchased using your account balance will not show up on your Nintendo device. However, if you purchase items in the web Item Shop — or another platform where you play Fortnite — those items will be available in your Locker across all platforms.
- Redemption: Online
Rank #4
- Redeemable on accounts in the United States and in U.S. Dollars.
- Gift card must be redeemed at EpicGames.com/redeem. This gift card WILL NOT work if redeemed directly on a console device (PlayStation, Xbox, Nintendo Switch, etc.)
- If you play Fortnite experiences on a console device, you need to link your Epic Games account to your console account(s) so items purchased at Fortnite.com/item-shop appear across all of your linked accounts
- Requires internet connection, valid Epic account and prior acceptance of the terms
- Redemption: Online
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
