Ask a parent what is worth stealing in their house and they will list the jewelry, the truck, maybe the tools in the garage. Almost nobody says the eleven-year-old’s game account. Then somebody takes it, and the family finds out there was a card saved on file, four years of purchases attached to it, and a kid who is heartbroken in a way that is hard to explain to an adult.
Game accounts are real money. Not metaphorically. There are stored payment methods, purchased items with resale value, and passwords that often get reused somewhere more important. Protecting one takes about fifteen minutes, and most of that is a conversation rather than a setting. Here is what actually happens, and what to do before and after.
Why Anyone Would Bother Stealing a Game Account
Three reasons, and they stack.
- The card on file. A saved payment method means whoever gets in can spend without ever seeing the card number. They buy currency, convert it, and move on before the statement arrives.
- The items. Rare skins, characters, and in-game currency have genuine resale value on secondary markets. An account built over several years is inventory to somebody.
- The password itself. Kids reuse passwords more than adults do. A password lifted from a game gets tried against email, and email is the master key to everything else in the house.
There is a fourth reason, and it is the uncomfortable one. The Consumer Financial Protection Bureau’s 2024 consumer advisory on video games notes that gamers, or their parents and guardians, frequently report being harmed by scams or theft on gaming platforms, and that game publishers claim to have no obligation to compensate players for financial losses. The advisory is blunt that players have little recourse when they suffer losses. Money in a game account does not carry the protections money in a bank account does.
The Trades and Giveaways That Are Actually Scams
Almost every stolen kid account we hear about was handed over voluntarily, by a child who thought they were being clever rather than careless. The pitch is always some version of free stuff, aimed precisely at what a twelve-year-old wants most.
- The free currency generator. A site or video promises free in-game currency if you enter your username and password. There is no generator. There is a form that emails your password to somebody.
- The giveaway that needs your login. A streamer or a helpful stranger is giving away rare items and just needs you to sign in through their link, which goes to a copy of the real login page.
- The trade that goes first. Send your item and they will send theirs right after. They will not.
- The fake moderator. Someone claims the account is under review and asks for the password to verify it. Roblox’s own guidance states it directly: Roblox administrators will never ask you for your password. Every major platform says the same about its staff.
- The friend who is not your friend. An account your kid knows gets stolen first, then messages everyone on its list. The message comes from a real friend’s name, which is why it works.
This is the same machinery that hits adults at work every day, just wearing a different costume, and it succeeds for the same reasons we described in why phishing keeps getting through. The one rule that covers all of it: you never type your password anywhere except the official app or the official site you opened yourself.
Account Sharing Is the Quiet One
Kids share logins the way earlier generations shared bikes. A friend wants to play a game they do not own. A cousin keeps the daily streak alive during vacation. Somebody good at a hard level offers to beat it for them. It feels generous, and it is, and it is also how a password ends up on four devices in three houses.
Once a password leaves your kid’s hands, they cannot control what happens to it. The friend types it into a phone that already has something nasty on it, or repeats it to somebody else, or the two fall out in six months. None of this requires a villain.
The conversation that works is not a lecture. It is a comparison. A password is a house key, not a video game. If a friend wants to play, they play on your couch, on your account, with you there.
Fifteen Minutes of Settings
Sit down with your kid and do these together. Doing it with them rather than to them is most of why it sticks.
- Turn on stronger login. Every major platform offers a second step at sign-in, usually called two-step verification, two-factor authentication, or a login approval. An app-based code or a security key beats a text message. We laid out the differences in YubiKey vs passkey vs MFA.
- Give the account its own password. Different from email, different from school, different from every other game. A password manager makes this realistic instead of aspirational.
- Use a parent-controlled recovery email. Whoever controls the recovery address controls the account. That should be an adult.
- Remove the saved card. The CFPB’s 2024 advisory recommends using gift cards rather than storing a payment method. This is the single best change on the list. Allowance arrives as a gift card, the balance is finite, and a stolen account cannot drain a checking account.
- Set purchases to require approval. The Federal Trade Commission’s consumer alert on kids, video games, and unexpected payments recommends using device-level parental controls to disable in-app purchases entirely or require password authentication for every purchase.
- Sign out of devices you do not recognize. Most platforms list active sessions. Clear out the old tablet and the friend’s console.
While you are there, talk about spending. In a 2025 consumer alert, the FTC noted that games marketed as ad free often still push ads for in-app purchases, that each click is a payment, and that its case against Epic Games, the maker of Fortnite, ended in a $245 million settlement. The FTC also suggests something simpler than any setting: talk about family rules for apps and games.
If the Account Is Already Gone
Move fast, and skip the lecture. A kid who is afraid of getting in trouble will hide it, and hidden hours are the expensive ones.
- Call the card first. Before anything else, contact the bank or card issuer, dispute unauthorized charges, and get a new card number.
- Start the platform’s recovery process. Every major service has one. Use the official site, not a search result promising instant recovery, since those are scams targeting exactly this moment.
- Secure the email account. If the game password matched the email password, the email is the real emergency. Change it and turn on multifactor authentication there today.
- Change that password everywhere it was reused. Make a list with your kid. They will remember more than you expect.
- Set expectations honestly. Per the CFPB advisory, publishers generally do not consider themselves obligated to make players whole. The card charges are usually recoverable. The inventory often is not.
The Bottom Line
Treat a game account like a small bank account that a child is learning to manage. Unique password, stronger login turned on, recovery email in a parent’s hands, no card saved, gift cards for allowance, and a household rule that nobody ever shares a login. That is it. Fifteen minutes, once.
And make it easy for your kid to tell you when something goes wrong. The families who recover quickly are the ones where a kid speaks up in the first hour instead of the third day. If you are cleaning up after one and want a second set of eyes, we are happy to help. Contact us today.
Sources:
Comments are closed