PSN Account Hacked? 2FA Bypass Exploit and How to Protect Yours

PlayStation players are reporting that strangers are taking over their PSN accounts, and in some cases two-factor authentication didn't stop it. Sony told Japan's Sankei Shimbun it is "investigating the issue." As of Wednesday, October 28, there's no fix and no official advisory. GTA 6 preloads start on PS5 in about two weeks, so check your account tonight.

What's happening to PSN accounts

Two different takeover methods are being reported.

• The fake "child" family member: Sankei Shimbun reported on Monday, October 26 that attackers are adding themselves to victims' accounts as child members of a PlayStation Family, reportedly without the password or 2FA. GamesRadar+ says one user's account email was changed overnight by an unauthorized child member. Depending on parental controls, a child account may be able to buy from the PlayStation Store with linked payment methods.
• The support-desk route: TweakTown reports attackers get a single transaction ID tied to an account, give it to Sony support as proof of ownership, and get the linked email changed. Once the email changes, 2FA no longer protects the account. Victims reportedly lose their digital libraries. Podcaster Colin Moriarty says his account was compromised.
• Where: Japanese users seem hit hardest by the family exploit, but it isn't limited to Japan.
• Not totally new: GamesRadar+ found a Reddit post from about three years ago describing a similar unknown child account making purchases.

How to protect your PSN account right now

1. Check your family members. On PS5, go to Settings > Family and Parental Controls > Family Management. If you see anyone you didn't add, contact PlayStation Support right away. Sony's help page says child members can't simply be removed.
2. Keep 2FA on anyway. It's not stopping these specific attacks, but it still blocks the usual password stuffing.
3. Unlink your card, or lock down spending. Lowyat.NET suggests not keeping a credit card on the account. Use PSN wallet top-ups instead, and set a spending limit if you have family members.
4. Watch your transaction history and email. An unexpected "email changed" notice is your warning. Act on it immediately.
5. Don't share receipts or transaction IDs. Not in screenshots, Discord or support threads. That's reportedly what the support exploit relies on.

What Sony has said

Only that it's investigating. Sony hasn't announced a patch or a change to its support verification, or said how many accounts were hit. We'll update this page if it does.

The 2nd Shift take

Two-factor is supposed to be the thing that saves you. When it can be bypassed through a family menu or a support desk, the problem is Sony's process, not your password. The timing is bad, too. Millions of people are about to preload a $70-plus game onto PS5 accounts tied to their cards and decade-long libraries. Sony needs to say something real before November 12. Until then, do the five-minute check above.

Got hit, or seeing weird family invites? Tell the crew in the 2nd Shift Discord so others know what to look for.

Keep reading: GTA 6 release time, preload and download size and GTA 6: everything we know.

Sources: GamesRadar+, Lowyat.NET, TweakTown