Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A PlayStation Network (PSN) breach or suspected account takeover calls for a specific order of operations: secure the email account tied to PSN, recover access if necessary, change your PSN sign-in method, then add a passkey or 2-step verification and preserve your recovery options. Do not start by repeatedly guessing your PSN password or scanning a QR code sent in a message.
The steps below apply whether a breach exposed a reused password, you received an unrecognized sign-in alert, or someone changed your account details. They use PlayStation’s current recovery and security guidance and distinguish what to do while you still have access from what to do when you are locked out.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should I do immediately after a PSN breach?
Start with the account that can reset everything else: the email address linked to your PlayStation account. Then secure PSN itself, add a second sign-in protection, and check for activity you do not recognize. Completing the steps in this order reduces the chance that an attacker can use your email to undo your PSN changes.
- Secure the linked email account. Change its password to a new, unique one. If you used that password anywhere else, change it there too. If the email provider will not let you reset the password, use that provider’s recovery process or support channel.
- Determine whether you can still sign in to PSN. If you can, go straight to Account Management security settings. If you cannot, use PlayStation’s account-recovery route rather than trying random passwords.
- Change the PSN sign-in method. Replace the password and review the sign-in ID, passkey, mobile number, and 2-step-verification settings.
- Add a passkey or 2-step verification. Keep backup codes or another recovery method available before signing out of devices.
- Review account and payment activity. Report continuing suspicious activity to PlayStation Support promptly.
PlayStation says that sharing PlayStation details can compromise account security. Treat unsolicited requests for your password, verification code, or QR-code scan as suspicious, even when the message uses familiar branding.
Popular on Amazon
Why must I secure my email account first?
Your PSN email account is a recovery channel. Anyone who controls it may be able to receive password-reset messages, intercept security alerts, or change the address that PlayStation uses to identify you. PlayStation’s compromised-account guidance therefore starts by telling users to change the email password.
Use a password that is different from your PSN password and from every other important account. A long, randomly generated password stored in a password manager is practical if you do not want to memorize it. If your email service offers its own multi-factor authentication, enable it and review the provider’s list of signed-in sessions or recovery addresses.
Recommended Free Tools
If you reused the exposed password
Assume that the same password is unsafe everywhere it appeared. Change it on your email account first, then on financial, social, shopping, and other gaming accounts that used it. Do not wait for a suspicious-login alert; attackers commonly try credentials from one service on other services.
If you cannot change the email password
Contact the email provider and follow its account-recovery instructions. PlayStation cannot reset a mailbox that you no longer control. Keep notes about the recovery case and any confirmation numbers so you can show PlayStation Support that the linked email is being recovered if PSN access is also blocked.
How do I change my PSN password and other security settings?
When you still have access, use PlayStation’s security-settings instructions. Changes made in Account Management apply across your consoles and other PlayStation devices, so you do not need to repeat the password change on every system.
- Open PlayStation Account Management in a browser and sign in.
- Select Security.
- Change the PSN password to a unique password that has not appeared in the breach or on another service.
- Review the Sign-In ID (email address). Replace it if it was changed without your permission, and confirm the new address through the email message PlayStation sends.
- Review the listed mobile number, passkey, and 2-step-verification settings. Remove or correct details you do not recognize.
- Check the account’s device and payment activity. If anything remains suspicious, contact PlayStation Support rather than continuing to make changes while an attacker may still have access.
You can also reach the same controls from a console:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAlso popular on Amazon
- PS5: Settings > Users and Accounts > Account > Security.
- PS4: Settings > Account Management > Account Information > Security.
If an attacker changed the sign-in ID, password, or other recovery details before you acted, stop trying to overwrite them from an untrusted session. Use the recovery procedure below.
What if I am locked out of my PlayStation account?
Use PlayStation’s account-recovery flow first. It can use a passkey or email recovery when those options still belong to you. Follow the prompts from a device you trust, and check the email account’s spam, junk, and security-notification folders.
PlayStation directs you to its Online Assistant when you have no access to the linked email, an unrecognized sign-in ID or Online ID appears, the password was changed without permission, or the automated verification cannot be completed. Have the account information you still know available, but do not send your password or one-time codes to anyone outside the official support process.
Recovering PSN access and recovering the email account are separate jobs. If the mailbox is compromised, secure it with the email provider while you work with PlayStation. Otherwise, an attacker who still controls the mailbox may regain PSN access immediately after you recover it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Signs that you should stop self-service recovery
- The sign-in email shown by PlayStation is not yours.
- Your Online ID or profile details changed without your approval.
- Reset messages never arrive because you cannot access the linked mailbox.
- A passkey, phone number, or 2-step-verification method appears that you did not add.
- Recovery succeeds briefly, then the account changes again.
These signs indicate that PlayStation’s Online Assistant is the appropriate route. Save screenshots of the alerts and note the approximate time of each change; those details can make a support conversation clearer.
Should I use a passkey or 2-step verification?
Both options add protection beyond a password. Choose the one you can reliably use and recover: PlayStation supports passkeys on PS5, PS4, its website, the PlayStation App, and Remote Play for Mac; 2-step verification can use an authenticator app or SMS and provides backup codes.
Also popular on Amazon
| Option | How you sign in | PlayStation support and trade-offs | Recovery planning |
|---|---|---|---|
| Passkey | Approve the sign-in with the screen lock or biometric unlock on a compatible device. | Available across PS5, PS4, the PlayStation website, PlayStation App, and Remote Play for Mac. It avoids typing a reusable password, but device and account synchronization must be maintained. | Keep another synced device or a documented recovery route available before removing your old sign-in method. PlayStation notes that some external hardware security keys can encounter issues; a synced mobile passkey may be a better fallback. |
| 2-step verification | Enter your password, then a code from an authenticator app or text message. | Works with an authenticator app or SMS. SMS depends on access to the registered number; an authenticator app depends on access to the phone or its transfer process. | Record the backup codes PlayStation provides and store them somewhere you can reach if the phone is lost, replaced, or offline. |
PlayStation’s passkey guide explains setup on supported devices. Its 2-step-verification guide covers authenticator-app and text-message choices. Do not assume that every USB security key will work simply because it follows a common security standard; PlayStation specifically warns that some hardware keys may have passkey issues.
When a passkey is the better fit
A passkey is useful when you regularly sign in on devices whose screen lock you control and you can keep the passkey synchronized. It removes the need to type a PSN password at each sign-in and is resistant to many phishing pages because the credential is bound to the legitimate site or app. Before enabling it, confirm that you can unlock the device and that another recovery path remains available.
When 2-step verification is the better fit
2-step verification may be easier if your household uses devices that do not share a passkey or if you already maintain an authenticator app. An authenticator app avoids dependence on cellular service, while SMS can be simpler but requires access to the registered number. Whichever method you choose, test that you can retrieve a code and locate the backup codes before signing out elsewhere.
How do I set up 2-step verification without losing access later?
- In Account Management, open Security and choose the 2-step-verification setup option.
- Select an authenticator app or SMS, then follow PlayStation’s enrollment prompts.
- Complete the verification challenge while you still have access to the account.
- Save every backup code in a secure location that is separate from the phone. A password manager’s secure-notes feature, an encrypted document, or a private paper copy can work.
- Check that your phone number or authenticator account is current before replacing or wiping the device.
Backup codes are for emergencies, not for routine sharing. Treat each code as sensitive as a password. If you use one, mark it as used so you know which codes remain.
How do I set up a PSN passkey safely?
- Open PlayStation’s passkey setup from Account Management or the supported PlayStation app or console path described in its official passkey instructions.
- Choose a device whose screen lock, PIN, or biometric protection only you control.
- Approve the passkey creation on that device and verify that the new sign-in method appears in your security settings.
- Keep a second synced device or another recovery option available before deleting a password or old authentication method.
- Sign in once from each device you commonly use, such as your PS5, PS4, phone, or Remote Play setup, so you know which prompts to expect.
Do not enroll a passkey on a shared console profile, a borrowed phone, or a computer that other people can unlock. If a hardware security key fails, do not repeatedly remove working recovery methods; use a compatible synced mobile passkey or 2-step verification instead.
What account and payment activity should I check?
After changing credentials, inspect recent sign-ins, profile changes, purchases, subscriptions, and stored payment activity for anything you do not recognize. The purpose is to identify continuing access and to give PlayStation Support precise information; it is not a guarantee that every unauthorized transaction can be reversed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also popular on Amazon
- Look for purchases or subscription changes you did not make.
- Check whether the sign-in email, Online ID, phone number, passkey, or 2-step-verification method changed.
- Review consoles, browsers, and apps that remain signed in, and sign out of devices you no longer control.
- Read PlayStation security emails carefully. A message that reports a change you did not request is evidence to preserve, not a link to click blindly.
Use PlayStation’s official support route for suspicious activity. Do not post transaction details, full card numbers, passwords, or verification codes in public forums or send them to an unsolicited contact.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can I avoid being hacked again?
Account recovery fixes the immediate problem; the following habits reduce the chance of a repeat.
Use unique credentials
Never reuse the PSN password or the email password on another site. A password manager can generate and store separate credentials, while a passkey can remove the need to remember a PSN password on supported sign-ins. PlayStation recommends these approaches as ways to make secure practices easier, but you do not need a particular paid product.
Ignore unsolicited QR codes
A QR code can open a fake sign-in page or initiate an authorization request. PlayStation warns against scanning QR codes sent by other people. Open the PlayStation App or type the official website address yourself instead of following a code from a direct message, chat, email, or forum post.
Use trusted, private devices
Avoid entering credentials on shared or public devices. If you must use one, do not save the password or passkey, and sign out completely when finished. Remove browser autofill data and close the session before handing the device back.
Keep recovery information current
Update your phone number, email-recovery options, authenticator transfer method, and backup-code storage when those details change. Recovery information that belongs to an old phone or an inaccessible mailbox can turn a simple lockout into a support case.
Also popular on Amazon
What should I do on each PlayStation device?
The security change itself is account-wide, but the sign-in experience differs by device.
- PS5: Use Settings > Users and Accounts > Account > Security to reach security controls. Confirm that you are changing the intended PSN account if several profiles are present.
- PS4: Use Settings > Account Management > Account Information > Security. Older console software may display a prompt to continue in Account Management on the web.
- PlayStation website: Make security changes in Account Management, then sign out of the browser if it is shared.
- PlayStation App: Use it for supported passkey sign-ins, but install or update it only through your device’s official app store.
- Remote Play for Mac: A supported passkey can simplify sign-in, but the Mac user account and its screen lock must be protected.
If a console remains signed in after a password change, do not assume that means the old password still works. Sign out and sign in again with the new method on devices you control, and remove access from devices that are lost, sold, or shared.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat mistakes make PSN recovery harder?
- Changing only the PSN password. If the linked email remains compromised, an attacker may reset the new password.
- Reusing the new password. A fresh password is not protective if it is already known from another breach.
- Deleting all recovery methods immediately. Remove an unauthorized method, but keep at least one working recovery path and your backup codes.
- Trusting a “support” message. PlayStation Support will not need your password or a one-time code sent to an unsolicited contact.
- Using a public or shared device. Saved credentials, browser sessions, or malware can expose the replacement password.
- Waiting for proof of a purchase. Unrecognized sign-in or security-setting changes are enough reason to secure the account and contact support.
- Assuming every security key is compatible. PlayStation documents possible issues with some external hardware keys and supports synced mobile passkeys as an alternative.
What is the shortest safe checklist?
Use this order when you need a compact response plan:
- Change and protect the password for the email account linked to PSN.
- Change any reused password on other important services.
- Try PlayStation account recovery if you cannot sign in.
- If the sign-in ID, Online ID, password, or email was changed, or recovery fails, open PlayStation’s Online Assistant.
- In Security, change the PSN password and inspect sign-in ID, phone, passkey, and 2-step-verification entries.
- Set up a passkey or 2-step verification and save the recovery information.
- Review account and payment activity, sign out of devices you do not control, and report ongoing suspicious activity.
- Ignore unsolicited QR codes and messages, and use only official PlayStation pages or apps.
How we built this recovery sequence
The order follows PlayStation’s own account, recovery, security-settings, passkey, 2-step-verification, and security-best-practice guidance. It prioritizes control of the linked email, then PSN credentials, then a phishing-resistant or second-factor sign-in method, with recovery codes and support escalation treated as part of the setup rather than an afterthought.
Frequently Asked Questions
Can I secure my PSN account from the PlayStation App?
The PlayStation App supports passkey sign-in on supported devices, while core account changes are managed through Account Management. If the app cannot complete recovery or shows unfamiliar account details, use PlayStation’s Online Assistant instead of relying on an in-app workaround.
What happens if I lose the phone used for PSN 2-step verification?
Use one of the backup codes saved during setup. If you cannot access a backup code or the phone number, follow PlayStation’s account-recovery process and contact the Online Assistant when verification cannot be completed.
Should I remove my credit card after a suspected PSN takeover?
Review payment activity and any stored payment details, but do not publish card information or send it to an unsolicited helper. Report suspicious transactions through official PlayStation Support so the account and billing issue are handled together.
Is a passkey stored on my PS5 or on my phone?
The passkey is associated with the compatible device or synced credential system you choose during setup, and you approve sign-in with that device’s screen lock or biometric unlock. Keep another synced device or recovery method available before replacing the device that holds it.
