Short answer: Install the Battle.net Authenticator in the Battle.net mobile app, then attach it at account.battle.net → Security. Blizzard’s own authenticator is the primary method and it unlocks in-game rewards, but you can also use a standard TOTP app. Save your recovery information, and add SMS Protect as a recovery channel rather than as your main factor.
Why Blizzard accounts get targeted
Years of game licences, WoW characters with rare mounts and gear, Overwatch and Diablo cosmetics, and a stored payment method. Some individual items on old accounts genuinely cannot be obtained any more, which gives them collector value.
Gold selling is the other driver. A compromised WoW account gets stripped — items sold, gold transferred — within minutes of access, and restoration is a support process rather than a guarantee.
Attacks are usually phishing or password reuse rather than anything technical. In-game whispers with links, fake “your account has been suspended” emails, and addon or cheat downloads carrying malware.
Step 1: Set up the Battle.net Authenticator
Blizzard’s own authenticator lives inside the Battle.net mobile app, and it is the method the platform is built around.
- Install Battle.net from the App Store or Google Play (check the publisher is Blizzard Entertainment).
- Sign in to your account.
- Open the menu and find Authenticator under settings or security.
- Tap to set it up and follow the prompts.
Because it is tied to your account rather than to a scanned secret, moving it to a new phone means removing and re-adding it — so keep your recovery details current.
Blizzard has historically given in-game rewards for having an authenticator attached, and some account actions become smoother with one. It also enables push-style approval prompts rather than typing codes.
Step 2: Or use a standard authenticator app
If you would rather keep all your codes in one place, Battle.net supports standard TOTP apps.
- Go to account.battle.net → Security.
- Choose to attach an authenticator and select the option for a third-party app.
- Scan the QR code with Google Authenticator, Aegis, 2FAS, Microsoft Authenticator or a password manager.
- Confirm with the six-digit code.
New to this? See what is an authenticator app. If the QR will not scan, use manual key entry.
Do not screenshot the QR code — and be particularly careful if you stream or record, since gaming setups are exactly where this leaks. See what’s inside a 2FA QR code.
Whichever you choose, save the serial and restore code if Blizzard offers them — they are what let you detach the authenticator if your phone is lost.
Step 3: Add SMS Protect — as recovery, not as your factor
Blizzard’s SMS Protect sends alerts about account changes and lets you unlock your account or remove an authenticator by text.
Enable it, because the alerts are genuinely useful early warning. But understand what you are adding: a phone-number-based recovery route, which inherits the risks of SIM swapping. Set a port-out PIN with your carrier to close that gap.
Treat SMS Protect as the safety net and the authenticator as the lock — not the other way round. The reasoning is in SMS 2FA vs authenticator apps.
Step 4: Secure the account behind the account
- Email — current, and with its own strong 2FA. Blizzard recovery runs through it, so it is the real perimeter. See Google and Microsoft.
- Password — unique, from a password manager. Reused gaming passwords are the leading cause of these compromises: credential stuffing.
- Connected accounts — Facebook, Google, Steam, PlayStation, Xbox links under account settings. Each is another route in; remove what you do not use.
- Payment methods — remove cards you no longer need. Prepaid balance is a reasonable alternative if you buy rarely.
- Parental controls if the account belongs to a child.
The specific gaming risk: addons and cheats
Worth stating plainly, because it defeats every measure above.
Cheats, “unlockers”, mod menus and pirated launchers frequently carry infostealer malware. That malware takes session cookies and saved credentials, which means an attacker is already inside without needing a login — your authenticator is never consulted. See session hijacking.
Even legitimate addon ecosystems deserve care: download from established sources, keep them updated, and be sceptical of anything distributed through a Discord DM.
Frequently asked questions
Do I have to use Blizzard’s own authenticator?
No. Standard TOTP apps are supported. Blizzard’s app adds push approvals and has historically been tied to in-game rewards, which is the main reason to prefer it.
What if I lose my phone?
Use your restore code or serial to detach the authenticator, or SMS Protect if enabled. Failing both, Blizzard support with proof of ownership — purchase history is the strongest evidence. See recovering accounts after losing your 2FA phone.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time. The Battle.net app also has a time-sync option. More: why 2FA codes get rejected.
Will I need a code every time I launch a game?
No. Recognised devices stay authorised. Prompts appear for new devices and sensitive account changes.
My account was compromised and my character stripped. What now?
Change your password from a clean device, detach and re-add the authenticator, remove payment methods, and open a support ticket immediately — Blizzard does restore items in many cases, but sooner is far better. Then scan your PC properly, because the malware that caused it is probably still there.
Does Blizzard support security keys or passkeys?
Not for standard accounts at the time of writing. The authenticator is the strongest option available here — see phishing-resistant MFA for what keys add elsewhere.
The bottom line
Attach an authenticator — Blizzard’s or a standard app — save the restore information, enable SMS Protect as a safety net, and secure the email address behind it. Then keep cheats and unofficial launchers off the machine entirely, because that is the route that walks straight past everything you just set up.
Other gaming accounts? See Steam, Epic Games, PlayStation and Nintendo. If you stream your play, it is worth setting up 2FA on Twitch too.