Xbox Live account security

The steps that actually close the ways a Xbox Live account gets taken — in the order worth doing them.

7 steps · about 5 minutes Microsoft Authenticator

What an attacker gets with your Xbox Live account

Games Library Friends Achievements Gamerscore Real Name

How Xbox Live accounts are taken

Fake Game Pass Codes
Enforcement Scams
Fake Microsoft Support

Already lost the account? Start Xbox Live account recovery → — go there first. Nothing on this page recovers an account that’s already gone.

The checklist

critical

Turn on two-step verification

An Xbox account is a Microsoft account. The security settings live there and cover both.
high

Read your recent sign-in activity

Microsoft records where and when each sign-in happened. Anything you do not recognise is worth acting on.
high

Remove devices you no longer use

A console you sold can still hold a signed-in account.
high

Treat your gamertag as public

Gamertags are searchable and permanent. If yours is also your username elsewhere, that is a thread somebody can pull.
medium

Set privacy and online safety

Controls who sees your profile, your activity and your friends.
medium

Check the recovery email and phone

These are the routes back in. Stale ones are a way for somebody else to take that route.
medium

Use family settings for a child account

Spending limits and contact restrictions belong to the adult account.

What this guide can’t do

Every step above hardens the account from here on. None of them touch the data that has already leaked — the email, password and phone number sitting in someone else’s breach dump, which is where most Xbox Live takeovers actually start. You can’t unleak a breach. You can find out what’s in there and take away what it’s worth.

See what’s already exposed — free scan

Checks 13.1B+ leaked records. No card, no account to look.