How to Enable 2FA on Your Game Account (Riot, Epic, Steam, Rockstar)

To enable two-factor authentication (2FA) on a game account, open the security settings of the publisher account (Riot, Epic, Steam or Rockstar), choose an authenticator app where it's offered, scan the QR code and confirm the six-digit code. After buying an account, do it right after you've changed the email and password: that sequence is what locks out anyone who had access before. This guide walks through the exact steps for Riot, Epic Games, Steam and Rockstar.

Why 2FA matters, and the correct order of operations

When you take ownership of a new account, the previous holder still knows the login they created. Even after you change the password, a determined person can attempt recovery through the original email address, a linked phone number, or a platform's recovery flow. Two-factor authentication breaks that chain: without the code from your authenticator or phone, a new sign-in fails.

The correct sequence every time you acquire an account is:

1. Change the email address to one you own and have never shared. This severs the most common recovery route immediately.
2. Change the password to a long, unique passphrase you have not used anywhere else.
3. Enable 2FA, using an authenticator app wherever possible. This is the final lock on the door.

Skipping step one and jumping straight to a password change leaves the original email in place, so a "forgot password" flow can still route recovery codes to an inbox you don't control. Always start with the email. The complete post-purchase routine, including devices, phone numbers and linked logins, is in our after-purchase security checklist, and our guide to buying game accounts safely covers what to verify before you pay.

Riot (League of Legends, Valorant, TFT)

All Riot titles, including League of Legends, Valorant and Teamfight Tactics, share a single Riot account. Securing it once secures all of them. Riot's multi-factor authentication supports three methods: a six-digit code sent by email, a third-party authenticator app such as Google Authenticator or Microsoft Authenticator, and the Riot Mobile app.

1. Sign in to your Riot account page with the account credentials.
2. Open the security (sign-in) section of the account settings.
3. Turn on email verification first. Riot will then send a code to the registered email when you sign in from an unrecognized device.
4. For a stronger setup, add an authenticator app: scan the QR code shown on screen with your app, then enter the code it generates to confirm the link. Riot Mobile can also act as your authenticator once email verification is on.
5. Sign out and back in to confirm that the code is being requested.

Because Riot ties recovery closely to the registered email, completing the email change first is especially important; our step-by-step guide on changing your Riot email shows where that setting lives. If you ever lose access, the Riot account recovery guide explains the support route.

Epic Games (Fortnite)

Epic offers three 2FA methods: an authenticator app, SMS and email codes. It also gives you a reason to switch it on: enabling 2FA unlocks the Boogie Down emote in Fortnite, and 2FA is required for gifting and for Fortnite tournaments.

1. Sign in on the Epic Games website, click your account name and choose Account.
2. Select the Password & Security tab.
3. Scroll to Two-Factor Authentication, where the available methods are listed.
4. To use an authenticator app (recommended): choose the authenticator option, scan the QR code with your app, enter the six-digit code and save.
5. To use SMS or email instead: choose that option and confirm the code Epic sends.
6. Store the backup codes Epic offers somewhere secure and offline.

If you just bought a Fortnite account, change the email first (our guide to changing your Fortnite email walks through it) and prefer the authenticator app over SMS: phone numbers can be hijacked through SIM swaps, while an authenticator code never leaves your device. For a lost or hacked Epic account, see Epic Games account recovery.

Steam (CS2)

Steam offers two levels of Steam Guard: codes by email, and the stronger Steam Guard Mobile Authenticator built into the Steam mobile app. For anyone holding a CS2 account, there's a trading trade-off to understand before you choose.

1. Install the Steam mobile app on your phone.
2. Sign in to the app with the account credentials.
3. Open Steam Guard in the app and select Add Authenticator.
4. Confirm your phone number with the SMS code Steam sends.
5. Write down the recovery code Steam shows you. Without it, losing your phone means a slow recovery process.
6. Once active, the app shows a rotating code, and sign-ins and trades are confirmed through it.

The trade-hold implication: Steam holds trades for up to 15 days unless the Steam Guard Mobile Authenticator has been active on the account for at least seven days. That hold exists to give the real owner time to cancel a fraudulent trade, so plan around it if you intend to move CS2 items soon after buying. Email-only Steam Guard keeps you in the longer hold, which is another reason to use the mobile authenticator. If you still need to take over the email, start with how to change your Steam email.

Rockstar Games (GTA Online)

Rockstar's 2-Step Verification uses an authenticator app, either on your phone or a browser-based one, and it requires the account's email address to be verified first.

1. Sign in to your Rockstar Games account and verify the email address if prompted.
2. Open the 2-Step Verification settings and choose Setup to reveal a QR code and secret key.
3. Scan the QR code with your authenticator app, or type in the secret key, then enter the code the app generates.
4. Turn on your authenticator app's cloud backup, as Rockstar recommends, so a lost phone doesn't lock you out.

For a bought GTA account, pair this with the checks in our guide on whether it's safe to buy a GTA 5 modded account.

Authenticator app vs SMS: which is safer?

An authenticator app is more secure than SMS. SMS codes travel through your mobile carrier, and attackers with enough persistence can perform a SIM-swap attack, convincing the carrier to move your number to a SIM they control and intercepting every code meant for you.

Authenticator apps generate codes locally on your device from a secret set up when you scan the QR code. Nothing is sent over the network to produce a code, so there's nothing to intercept in transit; someone would need your unlocked device.

Widely used options include Google Authenticator, Microsoft Authenticator and Authy, and most major apps now offer an encrypted backup or sync option. Turn it on, so replacing your phone doesn't mean losing access to every account at once.

Recovery codes: most platforms give you single-use recovery or backup codes when you enable 2FA. Print them or write them down, and don't store them in a cloud note protected by the same email you're trying to secure, or you've created a circular weakness.

Frequently Asked Questions

Why does the order matter: email, password, then 2FA?

Because every platform's recovery flow runs through the registered email. If the original email is still attached, the previous owner can reset the password and may even get 2FA removed through support. Changing the email first closes that route, the new password invalidates what they knew, and 2FA then blocks any new sign-in without your code.

Is an authenticator app really that much safer than SMS?

Yes. SMS codes can be intercepted through SIM swapping, which targets your mobile carrier rather than the game platform. Authenticator apps generate time-based codes on your device and never send them anywhere. For a valuable account, SMS is better than nothing, but an app is the right choice.

What happens if I lose the phone my authenticator is on?

Use one of the backup or recovery codes you saved to sign in, then re-link the authenticator on your new device. If you have no codes and no backup, each platform has a support-based identity check to restore access, which can take days and requires proof of ownership. Our Steam account recovery guide covers what Valve typically asks for.

Does 2FA stop the original seller from getting the account back?

It raises the barrier a lot: they can't sign in from a new device without your code. It isn't the whole answer, though. With the email changed to one you control, the seller loses the main recovery route; with 2FA on, they can't sign in even if they remember the old password. Together those steps close the normal routes back in, which is why buying listings that include the original email matters so much.

Account security isn't a one-time task, but these four steps, done in order, are the difference between an account you own and one you merely borrowed: change the email, change the password, enable 2FA with an authenticator app, and keep your recovery codes offline. If you're shopping for an account now, browse Fortnite accounts and other games on BuyAccount knowing exactly how you'll lock them down.