Reports are flooding in that PSN accounts are getting hijacked through Sony’s own customer support system. Attackers reportedly need only a public PSN ID and a single piece of old transaction data to contact Sony support, impersonate the account owner, and request an email change. That swap also disables two-factor authentication, leaving the original owner locked out entirely.
Sony has not publicly addressed the vulnerability yet, which makes it urgent for every PlayStation user to take action now. This guide covers every step you need to lock down your account before attackers reach it.
Keep Your PSN ID Off Public Profiles
Your PSN ID is the entry point for this attack. Hackers use it to contact Sony support and pose as the account owner. If your PSN ID appears in your X (Twitter) bio, Reddit username, Discord profile, or any other public page, remove it immediately.
This is especially important if your public profiles also contain your real name, gaming history, or any details that could help an attacker answer verification questions. Prominent gaming community members are being targeted specifically because their PSN IDs are easy to find.
Enable Two-Factor Authentication on PSN
Two-factor authentication adds a verification layer when someone tries to log in from an unrecognized device. Current reports suggest that attackers can bypass 2FA after they complete the support-driven email swap, but 2FA still blocks standard credential-stuffing attacks and unauthorized logins before the email gets changed.
To enable 2FA on your PSN account:
- Go to PlayStation.com and sign in.
- Select your profile icon, then open Account Settings.
- Navigate to Security.
- Select 2-Step Verification and complete the setup.
Use an authenticator app such as Google Authenticator or Authy instead of SMS. Authenticator apps are harder to intercept than text messages.
Use a Strong, Unique Password
A strong password does not protect against the current support loophole, but it does protect against every other type of account attack. If your password appears in a data breach from another service, attackers will try it on your PSN account automatically.
Use a password that is at least 16 characters and mixes uppercase letters, lowercase letters, numbers, and symbols. Never reuse a password from your email, streaming services, or any other account.
A password manager such as Bitwarden or 1Password generates and stores strong unique passwords so you do not need to remember them.
Remove Saved Payment Methods
Saved credit cards and PayPal accounts become a direct financial risk once an attacker controls your PSN account. Removing them limits the damage significantly.
To remove payment methods from your PSN account:
- Go to PlayStation.com and sign in.
- Open Account Settings, then select Payment Management.
- Delete all saved payment methods.
You can re-add a payment method at checkout whenever you need to make a purchase. The minor inconvenience is worth the protection.
Watch for a Sudden Flood of Spam Emails
One detail that keeps appearing across hacking reports is a sudden burst of hundreds of spam emails hitting the victim’s inbox at the exact moment the attack begins. This is a deliberate tactic to bury the notification email Sony sends when an account change takes place.
If you notice an unusual spike in email volume, log in to PlayStation.com immediately. Go directly to the site rather than clicking any link in an email. Check your account email address, linked phone number, and active sessions to confirm nothing has changed.
Avoid Sharing Transaction History Publicly
Attackers reportedly use old transaction data as proof of ownership when they contact Sony support. Screenshots of your purchase history, posts about specific games you own, or public trophy lists can all provide the information an attacker needs.
Review your social media posts and forum history. If you have publicly shared purchase details or account-linked information alongside your PSN ID, consider whether that combination gives attackers enough to attempt a support request.
PSN Account Hacked: What to Do Immediately
If you believe your PSN account has already been compromised, act quickly:
- Contact PlayStation Support at support.playstation.com and report unauthorized access.
- Request account recovery and clearly explain that the email was changed without your authorization.
- Alert your bank or card provider if a payment method was saved to the account.
- Change your email account password immediately in case the attacker also accessed your inbox.
- File a complaint with the Better Business Bureau if Sony does not respond within a reasonable time. Several affected users report that filing a BBB complaint accelerates Sony’s response.
- Document everything including timestamps, support ticket numbers, and any confirmation emails. A clear paper trail strengthens your recovery case.
Recovery can take time. Sony’s support volume is high and the process is slow, but persistence and documentation improve your chances of getting the account back.
