AaronTheBox

Long and possibly slightly confusing post, but bear with me. First off, if you’re a PSN user, set up passkeys ASAP! Set up two, one on your PC/laptop and one on your mobile device! About an hour ago someone managed to break into my PlayStation Network account. I was incredibly lucky to be able to combat it right away. I’ll explain how in a bit of a timeline of what happened below. - Luckily I was looking at my phone when I got a text through saying 2FA had been disabled. I don’t have phone number 2FA, only a passkey, so that’s weird in itself. (First screenshot) - I jumped straight onto my PC and tried to sign in on the web. No luck, I was locked out of my account and my PC-based passkey wasn’t working. - I was still signed into the mobile app, so in there I went straight to “Settings” then “Your Information”, which took me to a browser-based version of the PSN account settings on my phone. - Went in there and noticed my PC passkey had been removed but my phone one hadn’t (it won’t let you remove all your passkeys, you still have to have one enabled after you’ve first configured it). I immediately went to “Security” and hit "sign out of all devices" at the bottom, so it kicked me and whoever else was in there out. - Tried to sign back into the PS App but no luck, it just kept saying “Something went wrong”. (Second screenshot) - Went back to the PSN site in my phone’s web browser and managed to sign in with my phone passkey. I then changed the email address associated with the account (I’ve got the email address they changed it to, but it’s a random-word throwaway one) to something brand new. - They also changed the phone number on my account, so I’ve changed that back. I think I’m secure now and have set up a new PC passkey, as well as keeping my phone passkey in place. So realistically there are two things that managed to “save” me here. The first is that I had two passkeys set up, one PC-based and one mobile phone-based. I STRONGLY recommend every single PSN user does that as soon as possible. Secondly, and probably the biggest factor, I was extremely, and I mean extremely, lucky that I saw that text message as soon as it came through and could act fast, because I also got a password change email and didn’t see that at the time. Like seriously, I cannot stress how lucky I got here. If I wasn’t looking at my phone at that exact moment and had missed that message by 5 or 10 mins, I probably wouldn’t have my PSN account right now and would be at the mercy of Sony’s god-awful support agents.

Another PS user has had their account taken through the support agent exploit. The account thief then changed the personal information (possibly phone number and email) tied to the account and now @PlayStation support won’t even talk to him to fix this. Since then he has had the account thieves contact him and attempt to exploit him for money. @Sony this needs to be resolved asap. You have previously been made aware of the exploitation happening off the back of your support procedures and the lack of action only further enables this.