Short answer: On a PS5, go to Settings → Users and Accounts → Account → Security → 2-Step Verification and turn it on. Choose the authenticator app option rather than text message, scan the QR code, enter the code, and — critically — write down the backup codes before you leave the screen. You can also do all of this at account.sonyentertainmentnetwork.com in a browser, which is easier.
Why PSN accounts get stolen
A PlayStation account is a wallet with a games library attached. It holds a stored payment method, a wallet balance, years of purchases, and — for many people — an active subscription.
The classic attack is not subtle: get in, top up the wallet using the saved card, and spend it on digital content that can be resold or transferred. It happens quickly and the charges are real.
There is also the account-name angle. Established PSN IDs, particularly short or desirable ones, get taken and traded.
Most compromises trace back to a password reused from a gaming forum or an old breach, or a phishing message promising free currency or a “free game” code.
Setting it up in a browser (easier)
- Go to account.sonyentertainmentnetwork.com and sign in.
- Open Security.
- Find 2-Step Verification and select Edit or Set Up Now.
- Choose Authenticator App.
- Scan the QR code with your app and enter the six-digit code.
Typing on a console controller is a genuine deterrent to good security. Doing this in a browser takes a fraction of the time.
Setting it up on the console
PS5: Settings → Users and Accounts → Account → Security → 2-Step Verification.
PS4: Settings → Account Management → Account Information → Security → 2-Step Verification.
Then pick your method and follow the prompts.
App over text message
Sony offers 2-Step Verification by text message or authenticator app.
Choose the app. SMS codes travel through the mobile network, where an attacker who takes over your phone number receives them without touching your phone — see SIM swap attacks and SMS vs authenticator apps.
Any standard authenticator works — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, Authy, or a password manager. If this is new, start with what is an authenticator app. If the QR will not scan, use manual key entry.
Do not screenshot or capture the QR code, and be careful if you stream or share your screen — the console’s share features have caught people out.
Write down the backup codes
Sony provides backup codes at setup. This step matters more than usual here.
PSN account recovery involves Sony support and can be slow, and if the account is tied to a console you no longer have, it gets harder. The backup codes are the difference between a five-minute recovery and a long support queue.
Write them on paper and keep them with household documents, or store them in a password manager. Not in a note on the phone that also holds your authenticator. See where to store 2FA backup codes safely.
The device-setup password
Once 2-Step Verification is on, some devices and apps that cannot display a code prompt — older devices, certain media apps — will ask for a device setup password instead of your normal one. You generate it from the same security screen.
Treat it as a credential in its own right: use it once, do not store it in plain text, and regenerate it if you think it has been exposed.
The rest of the account
- Sign-in notifications — turn them on so an unfamiliar login reaches you immediately.
- Device list — deactivate consoles you have sold or no longer use. A sold PS4 that is still your “primary” console is a real problem.
- Payment methods — remove cards you do not need. If you rarely buy digital content, consider using prepaid top-ups instead of a stored card.
- Email address — it must be current and protected with its own strong 2FA. Whoever controls your email can attempt a reset. See our Google account guide.
- Purchase history — check it occasionally. Unauthorised purchases are easier to dispute when caught early.
The scams aimed at players
- Free PSN card or currency generators. Every one is a credential harvester.
- “Your account has been suspended, verify here.” A fake login page relaying your credentials in real time.
- Friend requests and messages with links, often from compromised friends’ accounts.
- Requests for your code to “confirm” a giveaway or tournament entry. Sony will never ask. See OTP scams.
If you play on PC as well, be aware that cheats, mods and cracked launchers frequently carry infostealer malware that takes session tokens and bypasses 2FA entirely — see session hijacking.
Frequently asked questions
Will 2FA make me enter a code every time I turn on my console?
No. Your console stays signed in. Codes are requested for new sign-ins and account changes.
Which authenticator app should I use?
Any standard TOTP app — Sony uses the normal algorithm. See how TOTP codes work.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time. Console clock settings can also drift if set manually — leave them on automatic. More: why 2FA codes get rejected.
What if I lose my phone and my backup codes?
Contact PlayStation Support with proof of account ownership — purchase history and the original email are the strongest evidence. Expect a wait. See recovering accounts after losing your 2FA phone.
Can I use 2FA on a shared family account?
Better to use separate PSN accounts on the same console, each with its own security. Sharing one login means sharing the second factor, which gets awkward fast.
My account was already compromised. What now?
Reset the password via the email on file, deactivate all devices, check purchase history and remove saved payment methods, then enable 2FA. If the email was changed, PlayStation Support is the route, with receipts as evidence.
The bottom line
Do it in a browser rather than on the controller, choose the app over text messages, and write the backup codes on actual paper. Then deactivate old consoles and think about whether that card really needs to stay saved — because a wallet top-up is what the attacker is aiming for.
Securing other gaming accounts too? See our guides for Steam, Epic Games and Discord. If you stream your sessions, it is worth setting up 2FA on Twitch as well.
One Response