Short answer: Sign in at epicgames.com, open Account → Password & Security, and under Two-Factor Authentication choose Authenticator App. Scan the QR code, enter the six-digit code, and save your backup codes. Epic also gives you an in-game reward for enabling it, which is a rare case of security paying you directly.
Why Fortnite accounts are stolen so often
Skins. That is genuinely most of it.
Rare cosmetics — early Battle Pass items, promotional skins that never returned — cannot be bought at any price once they leave the shop. An account carrying them has a market value that has nothing to do with the games attached to it, and there is an entire economy of people buying, flipping and stealing them.
Add saved payment methods, V-Bucks balances, and a library that may include years of free Epic Games Store titles, and the account is worth real money to a stranger.
The attacks are rarely sophisticated. They are phishing links promising free V-Bucks, fake “skin generator” sites, Discord messages about a tournament, and passwords reused from a game forum that got breached in 2019.
Step 1: Open your security settings
- Sign in at epicgames.com.
- Hover your account name (top right) and choose Account.
- Select Password & Security in the left menu.
- Scroll to Two-Factor Authentication.
Do this in a browser rather than in-game — the launcher will send you to the same place anyway.
Step 2: Pick the authenticator app
Epic offers three options, and they are not equal:
- Authenticator App — six-digit codes generated offline. Choose this.
- SMS — a text code. Better than nothing, but exposed to SIM swap attacks.
- Email — a code to your inbox. The weakest option, because your email is often what an attacker compromises first.
Click Enable next to Authenticator App. Epic shows a QR code with a manual entry key underneath.
Scan it with any standard app — Google Authenticator, Aegis, 2FAS, Authy, Microsoft Authenticator. See what an authenticator app is if this is new, or the best 2FA apps for Android if you are choosing one.
Do not screenshot the QR code. It contains the raw secret, and gaming accounts are frequently compromised through Discord screen shares and streamed setups. If you want a spare, scan it into two apps while it is on screen.
Step 3: Save the backup codes
Epic generates one-time backup codes. Download or copy them and store them offline — printed, or in an encrypted password manager. Not in a Discord DM to yourself, which is where a surprising number of people put them.
Epic’s account recovery involves support tickets and proof of ownership, and it is slow. The codes are what turn a lost phone into a two-minute problem. See where to store 2FA backup codes safely.
Step 4: Collect your reward
Epic has long rewarded enabling 2FA with in-game items — historically a Boogie Down emote in Fortnite, a glider, and equivalents in Rocket League and Fall Guys, plus the ability to claim certain free Store games and compete in tournaments.
The specific rewards change over time, but the pattern holds: Epic wants 2FA on your account badly enough to pay you for it. Competitive Fortnite requires it outright.
Step 5: Secure the account behind the account
Your Epic account is only as strong as the email address attached to it. If someone gets into your inbox, they can run a password reset and work around your 2FA through the recovery flow.
- Make sure your email has strong 2FA of its own — Google, Microsoft.
- Check the email on file is one you still control, and not an old school or parent’s address.
- Change your Epic password if it is reused anywhere else.
- Under Apps and Accounts, review connected platforms — PlayStation, Xbox, Nintendo, Steam. Each connection is another route in, and each of those accounts needs its own 2FA.
The scams aimed at players
Worth naming, because they are relentless and they work:
- Free V-Bucks generators. There is no such thing. Every one is a credential harvester.
- “Vote for my tournament team” links from Discord that lead to a fake Epic login.
- Fake account-merge or refund pages asking you to “verify” with a code.
- Cheats and mod menus, which are frequently infostealer malware. That steals your session cookies, which bypasses 2FA entirely because no login is needed — see how 2FA gets bypassed.
And the universal rule: nobody legitimate will ever ask for your code. Not Epic support, not a tournament organiser, not a friend. More in OTP scams.
Frequently asked questions
Is 2FA required for Fortnite tournaments?
Yes. Epic requires two-factor authentication for competitive play, and for claiming certain free games and gifting.
Which authenticator app works with Epic?
Any standard TOTP app — Epic uses the normal algorithm. See how TOTP codes work.
Can I use 2FA on console?
The setting lives on your Epic account, so it protects sign-ins everywhere including console. You set it up once on the web.
Why is my Epic code being rejected?
Usually clock drift on your phone. Turn on automatic network time. More causes: why 2FA codes get rejected.
What if I lose my phone?
Use a backup code, or contact Epic support with proof of purchase history. Our guide: recovering accounts after losing your 2FA phone.
Someone has taken my account. What now?
Reset the password from the email on file immediately. If the attacker changed the email, contact Epic support with your earliest purchase receipts — those are the strongest proof of ownership. Then scan your PC for infostealer malware before logging back in, or you will simply lose it again.
The bottom line
Five minutes, a free emote, and an account full of items you cannot replace stays yours. Use the app rather than email or SMS, save the backup codes somewhere that is not Discord, and secure the email address behind it — that last one is where most “but I had 2FA” stories go wrong.
Need a code while you test the setup? Our free online 2FA code generator runs entirely in your browser.