Cyber
If your kid cannot log into Roblox, Fortnite, Minecraft, Xbox, PlayStation, or another game account, treat it like any hacked email or social account: recover through the platform’s official help pages, change the password, sign out everywhere, and turn on multifactor authentication (MFA). The FTC’s recovery steps for hacked email and social accounts map cleanly onto game logins that use email. Do not buy “account recovery” software from a stranger, and do not treat Microsoft Family Safety as antivirus — it is parental controls.
Signs the game account was taken over
The FTC lists the same red flags parents see on game logins:
- The child cannot log in, or the password suddenly does not work.
- A notice says the username or password changed, but nobody in the house did that.
- A login alert names a device or city the family does not use.
- Friends get in-game messages, friend requests, or “send V-bucks / Robux” pleas the child did not send.
Also check the email inbox that owns the game account. Hackers often change the recovery email first so password-reset links go to them. Protecting that email is the FTC’s main follow-on advice.
First-hour checklist
- Use a device you trust. Update security software and run a scan, as the FTC recommends before recovery, so a leftover stealer does not grab the new password.
- Open the platform’s official account-recovery page from a bookmark or a search you type yourself — not from a Discord DM, TikTok bio, or “support” account that messaged first.
- Change the password to a long, unique passphrase. CISA’s Secure Our World guidance is to use strong passwords and never reuse them across games and email.
- Sign out of all sessions / devices inside the game or account settings so the thief’s console or phone drops offline.
- Turn on MFA / 2FA (authenticator app preferred when the platform offers it). CISA’s Turn On MFA page: even if a password leaks, the second step blocks most takeovers.
- Fix recovery email and phone so only parent-controlled contacts remain.
- Revoke weird linked apps and check recent purchases; dispute bank/card charges with the issuer if real money moved.
- Tell the child’s friends not to click gift links or send currency — same “notify contacts” step the FTC uses for social hacks.
- Report the takeover to the platform, and if personal data was exposed more broadly, use IdentityTheft.gov.
Phishing that pretends to be the game studio is common. Walk through how to spot a phishing email before anyone “verifies” the account again.
Parent controls vs antivirus (do not mix them up)
Family Safety and a malware scan are different jobs. One does not replace the other.
| Tool | What it is for | What it is not |
|---|---|---|
| Microsoft Family Safety | Screen time, app limits, location for family group | Not antivirus — details in Family Safety on Windows 11 |
| Platform parental controls (Xbox, PlayStation, Nintendo, store age ratings) | Spending limits, who can message, what can be bought | Does not replace MFA on the game login |
| Microsoft Defender / paid AV | Malware on the PC or phone | Cannot “unstick” a password the thief already changed in the cloud |
FTC’s child-privacy article is about COPPA and what sites may collect from kids — useful background for parents reviewing which games store birthdates and chat logs, but the immediate fix for a takeover is still password + MFA + session sign-out.
FAQ
What should I do first if my kid’s game account is hacked?
Recover via the platform’s official help page, change the password, sign out everywhere, and turn on MFA. Secure the email that owns the account in the same hour.
Do we need to buy antivirus to get the account back?
No. Scan the device once, then finish recovery on the platform. Antivirus does not reset a cloud password.
Is Microsoft Family Safety the fix?
No. Family Safety helps with screen time and spending rules after you regain the account. It is not a malware product.
What if someone already spent money?
Document the order IDs, contact the platform’s billing support, and dispute the card charges with your bank. Keep screenshots.
If you later want paid device protection
Account recovery itself is free. If the household wants a multi-device suite after the dust settles, use only on-site paid links: TotalAV, Norton, Bitdefender, McAfee, Avast.