Platform security hub

Xbox account security

Xbox accounts are targeted because they hold games, payment methods, and — for many players — years of progress. This page lists the official domains, the two-factor options, the recovery path, and the scams that most often cost Xbox players their accounts.

Quick security checklist

  1. Enable two-factor authentication. Xbox accounts use Microsoft two-step verification (authenticator app or passwordless).
  2. Only trust the official domains below for sign-in and support.
  3. Save the recovery path before you need it — recovery is fastest when you already know the official process.
  4. Learn the common scams listed below so you recognise them before they cost you the account.

Official domains

Only trust these domains for Xbox sign-in and support. Lookalike domains are a common phishing trick.

xbox.commicrosoft.comlive.com

Two-factor authentication

Supported — Xbox accounts use Microsoft two-step verification (authenticator app or passwordless).

Account recovery

If your account is stolen, follow our verified, step-by-step guide:

Xbox account recovery guide →

Official links

Account recovery ↗Microsoft security ↗Sign in ↗

Known scam patterns

Frequently asked

How do I avoid Xbox phishing scams?
Only sign in on the official domains listed above. Xbox will never ask for your password or two-factor codes over chat, email or DM. Any message claiming your account is "limited" or "deactivated" with a login link is phishing.
Is my Xbox account at risk?
Account-takeover risk is highest when two-factor authentication is off, when you reuse a password, or when you click a fake login link. The single highest-impact fix is enabling 2FA and using a unique password.
What do I do if my Xbox account is hacked?
Secure your email first, then follow the official Xbox recovery guide. Never pay a third party to recover it — recovery is always free through Xbox support.

Reviewed for accuracy; always confirm on the official Xbox site. Capabilities not listed are not asserted here.