If your PlayStation Network (PSN) account has been hacked, secure the email account tied to it first, then use PlayStation’s official recovery process. After you regain access, sign out everywhere, remove unknown passkeys and consoles, block purchases, and contact PlayStation Support about unauthorized charges or changes you cannot undo. Open Account Management by typing playstation.com into your browser—not by following a link in an email or message.
What should I do first if my PlayStation account is hacked?
Work through the recovery in order: protect the inbox used as your PSN sign-in ID, recover the account, end other sessions, and then check security, spending, and family settings. A hacked PSN account usually means someone has access to the account—not that the console itself has a virus. A crash or a slow PS5 alone is not evidence of an account takeover.
- Use a trusted device and type playstation.com yourself. Start at Account Management or PlayStation Support. Do not trust links or QR codes in unexpected emails, Discord messages, or social posts.
- Secure the email inbox used for PSN. Change its password, enable the email provider’s own two-factor authentication or passkey, and review forwarding rules and active sessions for anything you did not set up.
- Recover your PlayStation account. Use the official recovery route if you still control the inbox; contact PlayStation Support if the sign-in ID was changed, you cannot access that inbox, or two-step verification (2SV) blocks you.
- Remove the intruder’s access. Sign out on all devices, deactivate consoles you do not control, and remove any passkey you did not create.
- Stop further spending and inspect account activity. Remove payment methods, require a password at checkout, review transactions, and report unauthorized purchases to PlayStation.
- Restore and audit security. Turn on 2SV, save the backup codes somewhere secure, and check Family Management for unknown members.
Sony’s compromised-account guidance says to change the email password when an account-change email was not initiated by PlayStation: “Change the password on your email account. If you have problems doing this, please contact your email provider as soon as possible.” That inbox matters because it receives password-reset and security messages.
How can I tell whether someone took over my PSN account?
A takeover is more likely when you see an account change, sign-in, or purchase that you did not make—especially if you can no longer sign in. One strange message or console glitch by itself does not establish that the account is compromised.
- Your password or sign-in ID no longer works, or you receive notice of an email, password, or online ID change you did not request.
- You receive unexpected 2SV codes or messages and cannot change the verification method.
- Your transaction history shows a purchase, wallet top-up, or subscription renewal you do not recognize.
- An unfamiliar console appears on the account, or friends report messages or invitations you did not send.
- Family Management lists a child or adult you did not add.
An unexpected password-reset email does not by itself prove PlayStation was breached. Do not use the link in that message to investigate; open PlayStation’s site directly and check your account or contact official Support. Sony has not published a count of hacked PSN accounts or of accounts involved in the October 2026 family-account reports.
How do I recover my PlayStation account?
Use self-service recovery only if you can access the sign-in email or have a working 2SV backup code. If the email was changed, the inbox is unavailable, or you cannot get past verification, contact PlayStation Support instead of repeatedly trying to reset the account.
If you can access your PlayStation email
- Open Account Management, choose Trouble Signing In?, then Recover Your Account, and enter the account’s sign-in ID (email address).
- Open the secure recovery link PlayStation sends. Sony says a verification or password-reset email can take a few minutes to arrive; check junk or spam if it does not appear.
- Create a new password using uppercase and lowercase letters, numbers, and special characters. Do not reuse the password from your email account.
If you only need a password reset and still know the sign-in email, choose Trouble Signing In? > Reset your password and follow the email-link instructions.
If two-step verification is stopping you
At the sign-in prompt, choose Trouble Receiving Code? > Sign In Using a Backup Code and enter one of the backup codes you saved. Sony provides 10 one-time codes; each works once. If you have no code, no access to the registered number, or unexpected 2SV messages and cannot change the method, use the Online Assistant on PlayStation.com.
If you lost the device holding your passkey
Sony’s instructions say to sign in from another device that already has the same verification method, then register a new passkey. If you have no such device, contact the Online Assistant. If you do not recognize a change to your sign-in ID, online ID, or password, Sony directs you to its Online Assistant rather than ordinary self-service recovery.
How do I make sure the attacker is signed out?
Changing your password is not a substitute for ending other sessions and reviewing account access. Use the web account controls to sign out on all devices, then handle consoles you do not recognize.
- Sign out everywhere: Account Management > Security > Sign Out on All Devices at the bottom of the page. On a PS5 you control, the local option is Settings > Users and Accounts > Other > Sign Out.
- Deactivate consoles you cannot reach: Account Management > Device Management > PlayStation Consoles > Deactivate All Devices. This remote option deactivates all consoles, not just one, and Sony limits it to once every six months.
- Check a PS5 you can access: Settings > Users and Accounts > Other > Console Sharing and Offline Play > Disable if it is not your console. Console Sharing and Offline Play is automatically enabled on the first PS5 you sign in to.
- Check a PS4 you can access: Settings > Account Management > Activate as Your Primary PS4 > Deactivate if it is not yours.
Sony’s deactivation guidance says, “To sign out from inaccessible consoles, change your password.” Because it is not confirmed whether removing a passkey also ends sessions already open on other devices, use Sign Out on All Devices as well.
Why should I check passkeys after changing my password?
A passkey can remain a separate way into an account, so changing the password and email alone may not remove access for someone who registered an unauthorized passkey. In October 2026, researcher baas (0xbaas) warned that passkeys are tied to the account and that changing the email and password alone would not invalidate an attacker-added passkey.
Go to Account Management > Security > Manage Passkeys and remove entries you do not recognize. Sony describes passkeys as a password replacement used from personal devices, but the October report makes it important to check the list during recovery. Sony’s support pages retrieved in October 2026 did not include a dedicated article for removing an attacker-added passkey, so contact Support if you cannot identify or remove an entry.
How do I stop unauthorized PlayStation Store spending?
Cut off easy access to payment first, then review the transaction history and report unfamiliar charges to PlayStation. Do not start by reversing a payment through your bank: Sony says an account can be suspended until a reversed charge is resolved.
Review purchases and lock down payment
- Open Transaction History through Account Management, or on PS5 go to Settings > Users and Accounts > Account > Payment and Subscriptions > Transaction History. The default view covers the past two years. Only the family manager can see family members’ transaction history.
- Remove saved payment methods. Sony’s compromised-account guidance says: “To protect your account from unwanted purchases, consider removing all payment methods from your account.”
- Enable Require Password at Checkout in Account Management > Payment Method, or on PS5 at Settings > Users and Accounts > Account > Payment and Subscriptions > Purchase Settings.
- Check whether a charge is a PlayStation Plus renewal or a purchase by a child account before treating it as fraud.
- For a charge you do not recognize, use PlayStation’s unauthorized-payment help and contact Support. Keep order numbers and receipts private; do not post them publicly.
Password-at-checkout protection does not apply to child accounts or wallet funding. Set an unknown child account’s spending limit to zero while Support investigates. Wallet top-ups cannot be cancelled under Sony’s refund guidance.
Understand refund eligibility and chargeback risk
Sony’s stated refund rules distinguish purchases by type. Games and add-ons may qualify within 14 days if they have not been downloaded or streamed. In-game consumables may qualify within 14 days if bought through PlayStation Store and the game has not been launched. Subscription refunds may be requested within 14 days of the first payment. Sony says refunds may take 30 to 60 days and usually return to the original payment method, or to the wallet if that is not possible.
A chargeback is a payment reversal through the card issuer or bank. Sony’s US Contact Us guidance states: “If you or the payment owner reversed a payment to PlayStation, your account will be suspended until the charges are resolved.” Contact PlayStation first about an unauthorized PlayStation charge; if you already reversed it, work with Support to resolve the account debt.
How do I turn on 2-step verification again?
After securing the account, enable 2SV using an authenticator app or text message and keep its backup codes somewhere safe. PlayStation names Authy, Google Authenticator, and Microsoft Authenticator as authenticator-app options.
- On the web: Account Management > Security > Edit next to 2-step Verification Status. Choose an authenticator app or text message, enter the number or scan the QR code, select Activate, and record the backup codes.
- On PS5: Settings > Users and Accounts > Security > 2-Step Verification.
- On PS4: Settings > Account Management > Account Information > Security > 2-Step Verification.
PlayStation may ask for a code the first time you sign in after enabling 2SV, after you manually sign out, after a password reset, or when you change your sign-in ID or online ID. A text verification code is valid for 10 minutes after the sign-in attempt; use Resend Code if it expires.
There are 10 backup codes, and each is usable once. You can view them while signed in under Security > Backup Codes. If you use most of them, turn 2SV off and on again to generate a new set. Sony warns: “Without a record of these codes, you need to verify your identity to recover your account.” If you cannot use an authenticator or registered number and have no backup code, contact Support. Reporting in October 2026 did not establish that PSN’s authenticator itself had been cryptographically broken; keep the extra factor enabled.
What should I do about unknown accounts in Family Management?
Check Family Management if you see an unfamiliar child or adult on your account, especially if you received an unexpected sign-in ID change notice. Reporting from 24–28 October 2026 described players finding child accounts they had not added; Sony confirmed to The Sankei Shimbun that it was investigating, but had not publicly stated a cause, affected-account count, or full scope of exposed data.
- On PS5, open Settings > Users and Accounts > Family > Family Management, or Settings > Family and Parental Controls > Family Management. On the web, open Account Management > Family Management.
- Screenshot unfamiliar names and account details before contacting Support.
- Until Support responds, set each unknown child account’s monthly spending limit to zero and disable its communication features.
- Ask PlayStation Support to remove unknown members. Cyber Kendra and Beebom, citing Sony’s family rules, reported that a family manager cannot remove child members themselves; adults also cannot leave a family they did not create without Support.
Child accounts do not have their own PlayStation wallet; they can spend from the family manager’s wallet within an assigned limit. Sony says the limit defaults to zero when a family manager creates a child account. Only the family manager can reset a child account’s password.
Cyber Kendra reported that the researcher’s High-severity HackerOne report was rated CVSS 8.6 and paid $5,000, plus a $2,000 retest bonus. Its account of the report named email addresses and full names as exposed. Claims that birth dates, phone numbers, or home addresses were also exposed were not confirmed by Sony or by the researcher in that write-up. The report does not establish how many accounts were affected.
When should I contact PlayStation Support, and what should I prepare?
Contact Support if you cannot access the sign-in inbox, do not know the account email, see a sign-in ID change you did not make, cannot pass 2SV, find an unknown family member, or need help with an unauthorized charge. The US support pages mark the PlayStation Assistant bot as recommended for account recovery, password-reset, and 2SV issues.
Have these details ready for the identity check:
- Your Online ID and the account’s sign-in ID (email address), if known.
- The serial number of the console used to create or sign in to the account.
- Recent transaction details, including the order number, content, price, and date.
On the US Contact Us page, the phone number listed for unauthorized-payment and unauthorized-email topics is 800-345-SONY (7669), Monday to Friday, 9:00 AM to 6:00 PM PT. Phone availability and support channels vary by country; readers outside the United States should use the country selector on playstation.com/support. Sony does not publish a fixed end-to-end timeline for Support’s identity verification.
How can I avoid recovery scams while this is happening?
Only PlayStation can restore access to a PSN account. Do not pay someone on Discord, Reddit, or another social platform who promises recovery, claims to be a Sony or support-desk employee, or asks for your password, serial number, or verification code.
- Type playstation.com into the browser instead of following a link or scanning a QR code in a message.
- Never share a password, live 2SV code, or backup code with someone who contacts you.
- Keep transaction IDs, receipts, and order emails out of public posts; they can be sensitive account-ownership details.
- Do not create a second PSN account to report the old one, and do not buy gift cards as a recovery measure.
Sony’s security guidance says: “Sharing your PlayStation details can compromise your account security. Always ensure that your password and account details are kept secret and safe.” This is an account-recovery process, not a reason to buy a replacement console or install a PC cleaner. For general guidance on why a second authentication factor matters, see CISA’s MFA guidance.
Frequently Asked Questions
Does PlayStation say how many accounts were affected by the October 2026 reports?
No affected-account total has been published by Sony. Cyber Kendra, citing Japanese outlet Game Watch, said the first reported family-account cases dated back to at least 6 October 2026; that is a reported starting point, not a count.
Can I request a copy of my PlayStation personal data?
Readers in the UK or EU may separately request a copy of personal data under UK GDPR or GDPR Article 15. That legal data-access process does not recover an account or replace contacting PlayStation Support.
Does changing my PSN password prove that PlayStation itself was breached?
No. A takeover can result from access to an email inbox, reused credentials, phishing, or other account-security failures; Sony has not published a reliable breakdown of PSN takeover causes. Treat the account as compromised and use official recovery regardless of the cause.