PlayStation and Xbox Phishing Messages: How to Spot Them

Which route is yours?

Choose how far the message got. The first route is for a message you only received; the others are for when you already typed something.

Check the message against your own account

You never have to decide whether a message is genuine by reading it. Every signal below is something you can check in your own inbox, your messages or your account, without touching a link in the message.

A suspension notice with a deadline

Fake notices threaten a ban "in 24 hours unless you verify" and offer a link to restore the account. PlayStation describes a real suspension differently: it usually emails you why you were suspended and how long it lasts, to the email address that is your sign-in ID. It also says you can check your account status in My Support. Sign in there yourself rather than through the email.

A sender address that doesn't match

A display name can say Microsoft or Xbox while the real sender is something else. Microsoft says email from the Microsoft account team that comes from the @accountprotection.microsoft.com domain is safe to trust. A lookalike spelling is easy to miss on a phone, so open the full sender details, and when in doubt sign in at account.microsoft.com yourself instead of replying.

A link that hides another address

Microsoft suggests hovering over a link without clicking to see where it really goes, or long-pressing it on Android. If the address isn't the site the button names, the message is a lure. Outlook also shows a banner when it could not verify the sender.

A sign-in page you reached from a message or a QR code

PlayStation tells players never to scan a QR code sent by another person, even when they say it will help you get into your account. Close any sign-in page you opened from a message and type the address yourself.

Messages from "support" or prize accounts

PlayStation's security page lists the lures it sees in messages: invitations to game betas or tournaments, claims that your account was reported by mistake and can be restored, requests to sign in with a link, and offers of free vouchers, gift cards or in-game items. A friend's account can send these too if it was taken over; Microsoft suggests contacting the person another way before you trust it.

Already clicked or typed your details? Do this in order

Work from the top. If you can no longer sign in at all, skip to the last route in the console above: PlayStation's Recover Your Account, or Microsoft's Sign-in Helper first.

1. Secure your email first. Do this before the account password. PlayStation's help for phished accounts tells you to change the password on your email account when account details changed without you.
2. Change the account password from an address you typed. Go to playstation.com or account.microsoft.com yourself, never through the message. Microsoft advises changing the password on every affected account, and anywhere else you used the same one.
3. Sign out other devices. On PlayStation, select Security in the left sidebar of Account Management.Account Management → Security → Sign Out on All Devices On Microsoft, this can take up to 24 hours and doesn't reach an Xbox console, so also sign out on the console itself.Advanced security options → Sign out everywhere → Sign out
4. Check Recent activity on your Microsoft account. Open account.live.com/Activity. "This wasn't me" is only offered under Unusual activity; for anything odd under Recent activity, choose Secure your account.
5. Report the fake email and the message. In Outlook, report it as phishing; in other mail apps, send it as an attachment to [email protected].Outlook: Report → Report phishing Report a PSN message on PS5 from the Messages icon, or in the PlayStation App.PS5: Game Base → Messages → highlight the message → Options → ReportPlayStation App: Chats → press and hold the message → Report Message On Xbox, report the message, or the sender's profile, from the guide.Xbox button → Parties & chats → Chats → the conversation → More → Report personXbox button → People → the player's gamertag → Report or block → Report
6. Watch payments over the next weeks. If you typed card or bank details, Microsoft suggests contacting those companies. PlayStation suggests considering removing all payment methods from a compromised account to stop unwanted purchases; on a Microsoft account, open Payment options, find the card and select Remove.PS5: Settings → Users and Accounts → Account → Payment and Subscriptions → Payment Methods → Remove

How long signing out takes

On PlayStation, signing out is not the same as deactivating a console. PlayStation says you can't remotely deactivate individual consoles, and you can only deactivate your consoles once every six months, so read signing out of PSN on all devices before you use it.

What fake notices claim, and how the platforms work

On the left, what a fake message says; on the right, what PlayStation or Microsoft actually publish.

What a real notice never needs from you

No genuine fix needs your password typed into a link, a 2-step code read out in voice chat, or a chat moved to another app. Treat any of these as the scam itself, whoever the sender claims to be. You can cut most lures off at the source: PlayStation lets you stop messages from players you don't know through your account's privacy settings.

If someone in PS5 voice chat claims to be staff, you can report the chat with a clip. Paid "account recovery" and "unban" offers are covered in recovery and unban sellers, and code lures in free code generators.