Short answer: Sign in at accounts.nintendo.com, open Sign-in and security settings, and enable 2-Step Verification. Nintendo supports authenticator apps only — no SMS — so scan the QR code with Google Authenticator, Aegis, 2FAS or similar, confirm with the six-digit code, and save the backup codes Nintendo shows you.
Why this one is worth five minutes
A Nintendo Account holds your digital game library, Nintendo Switch Online membership, saved payment method, and — for families — the parental controls and any child accounts linked to it.
Digital libraries are the main draw for attackers. Games bought over years, plus a stored card that can buy more. There have been waves of Nintendo Account compromises where attackers used stored payment methods to buy digital currency and content before anyone noticed.
Nintendo’s own past incidents led it to strengthen account security and encourage 2-Step Verification directly. It is not a hypothetical risk.
Step 1: Open your account settings
- Go to accounts.nintendo.com and sign in.
- Select Sign-in and security settings.
- Find 2-Step Verification and choose Edit → Enable.
- Nintendo emails you a verification code — enter it to confirm your email address first.
This is a website job. The Switch itself does not offer the setup screen, which catches people out.
Step 2: Scan with an authenticator app
Nintendo displays a QR code and a manual entry key.
- Open your authenticator app and add a new account.
- Scan the QR code, or use the text key — see manual setup key entry.
- Enter the six digits your app generates.
Nintendo does not offer SMS, which is a good decision on their part — text codes are exposed to SIM swapping. Any standard authenticator works: Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, Authy, or a password manager. If this is unfamiliar, read what is an authenticator app first.
Do not screenshot the QR code — it contains the raw secret key.
Step 3: Save the backup codes
Nintendo provides backup codes immediately. Save them before you close the page.
Nintendo’s account recovery is workable but involves support and proof of ownership, and it takes days rather than minutes. On a family account, the codes are also what lets a parent regain access when a child’s phone is lost or replaced.
Print them, or store them in a password manager. Household documents drawer is a perfectly good answer here. See where to store 2FA backup codes safely.
Step 4: The family angle
Nintendo accounts are unusually family-oriented, so a few extras are worth doing:
- Use a parent’s email on the main account, and keep child accounts linked under family management rather than standalone.
- Store the backup codes where an adult can find them, not on a child’s phone.
- Set spending limits in the eShop and consider removing the stored card entirely in favour of prepaid eShop credit. This removes the incentive for the most common attack.
- Parental controls — the Nintendo Switch Parental Controls app ties to the account, so protecting the account protects the controls.
Step 5: Check the rest
- Sign-in history — Nintendo shows recent sign-ins. Check for anything unfamiliar.
- Linked accounts — Google, Apple, Facebook and Twitter sign-in links. If any of these can sign in as you, that account’s security is now your Nintendo security. Remove links you do not use.
- Email address — current, and protected with its own strong 2FA: Google, Microsoft.
- Payment method — remove cards you do not need.
The linked-accounts point deserves emphasis. Enabling 2-Step Verification on Nintendo while leaving a “sign in with Facebook” link active means an attacker can bypass it through the linked account entirely.
Frequently asked questions
Can I set this up on the Switch itself?
No. The setup happens on the Nintendo Account website. Once enabled, your console stays signed in and does not prompt for codes constantly.
Does Nintendo support SMS 2FA?
No — authenticator apps only. That is a deliberate and sensible choice; see SMS vs authenticator apps.
Will I need a code every time I play?
No. Your console and devices remain signed in. Codes are for new sign-ins and account changes.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time in date and time settings. More causes: why 2FA codes get rejected.
What if I lose my phone and my backup codes?
Contact Nintendo Support with proof of ownership — purchase history and the original email address are the strongest evidence. See recovering accounts after losing your 2FA phone.
My account was compromised and purchases were made. What now?
Change the password immediately, remove the stored payment method, enable 2-Step Verification, and contact Nintendo Support about the charges. Also check the email account behind it — that is frequently the original entry point (what to do if your email is hacked).
The bottom line
Five minutes on the website, backup codes saved somewhere a parent can reach, and any unused linked sign-in methods removed. Then consider whether that stored card needs to be there at all — prepaid eShop credit turns a compromised account from a financial problem into an annoyance.
Other gaming accounts to secure? See PlayStation Network, Steam, Epic Games and Roblox.