Account security check before launch: passwords, 2FA, and purchase approvals

Staying safe · Updated October 2026 · 7 min read

Four checks. About fifteen minutes per account, done in a set order: password first, then a passkey or authenticator app, then backup codes, then purchase approvals. That order matters more than any single setting, because each step protects the one after it — a strong second factor cannot rescue a reused password, and backup codes are useless if they are generated and then lost.

Why launch week is phishing week

A big launch concentrates everything a scammer wants in one place: millions of players expecting order emails, store messages, and subscription offers, all of them in a hurry. A fake pre-order message or a bogus subscription offer lands differently in launch week than it does in a quiet month — it looks like one more genuine notification in a pile of them. The defence is boring and it works: an account that is already locked down before the rush starts, so a rushed click has less to steal.

Do this pass now, while nothing is urgent. Every step below uses settings paths documented for PlayStation Network and Microsoft accounts.

Step 1: Passwords worth protecting

Start with the password itself. The platform account deserves a password used nowhere else — not the email password, not a variation of a shopping password. If the email account tied to the platform account shares that password, change the email password too: account recovery runs through email, so the two accounts protect each other or expose each other.

Short version: unique beats clever. A long password stored in a password manager beats a short, memorable one reused in five places.

Step 2: Passkey or authenticator — and why SMS is last

Second factors are not equal, and the documented ranking is clear. Passkeys are phishing-resistant. Authenticator-app codes — the rotating six-digit codes often called TOTP — are strong. SMS codes are the weakest of the three because of SIM-swap risk, where an attacker takes over the phone number itself and receives the codes meant for the owner.

On PlayStation, the documented route runs through Account Management, then Security, where a passkey can be set up or 2-Step Verification enabled. The 2-Step Verification setup itself sits under Account settings, Security, 2-Step Verification, Edit — choose the authenticator app option where possible, scan the QR code or type the manual setup key, and enter the generated code to confirm.

On Xbox, the account side lives at account.microsoft.com, under Security, then Advanced security options. Xbox also supports passwordless sign-in through the Microsoft Authenticator app, approving sign-ins with a notification, fingerprint, face, or PIN. One habit follows from that: an approval request that arrives when no sign-in was just started is a request to refuse, not to tap through.

Step 3: Backup codes, stored offline

Every 2FA setup produces backup codes for the day the phone is lost, replaced, or reset. The guidance that comes with the setup process is simple: save the backup codes somewhere safe when enabling 2FA. Safe, in practice, means offline and separate — printed and filed, or written into a notebook kept at home — rather than a screenshot sitting in the same phone's photo roll.

Think of the failure case. The codes exist for the moment the authenticator app is gone. Codes stored only inside that phone are gone at the same moment.

Step 4: Purchase approvals on the family console

The last step is the one security roundups skip, and it is the step a shared family console needs most. Editions, subscriptions, and in-game currency are all bought through the platform account, so the purchase settings decide who can spend, and how much, before launch marketing starts doing the persuading.

Menu names for family and purchase settings change as console software updates, so this step is a verification list rather than a fixed path. Open the family settings for the account and answer three questions on screen:

1. Can a child account complete a purchase on its own? If the answer is yes and that is not the household's intention, turn on the setting that requires an adult's approval for purchases.
2. Is there a spending limit? Read the limit shown for each child account and set one deliberately, even if the deliberate number is generous.
3. Does checkout ask for the account password or approval? If purchases complete with no confirmation step at all, change that before launch week, not during it.

If a setting is not where it is expected to be, search the console maker's own help pages for the current wording rather than following a stranger's video — menu labels are exactly the detail that goes stale.

The 15-minute final check

1. Sign in to the PlayStation or Microsoft account on the web and confirm the password works.
2. Open the Security page and confirm a passkey or 2-Step Verification shows as on, with the authenticator app — not SMS — as the method where a choice exists.
3. Find the backup codes, offline, and confirm they are the codes for the current setup, not an older one.
4. Open the family settings and re-read the three purchase answers from Step 4.
5. Check that the email address on the account is one that can still be opened today.

What success looks like: sign-in asks for the passkey or the authenticator code, not just the password; the backup codes sit offline where they can be found without the phone; and a purchase started from a child account stops at an approval step instead of completing. When all three are true, the account is ready — and launch week can be about the game.

— Rex Bennett, Entertainment Writer