How to secure your Riot account: 2FA, phishing and getting it back

Everything that matters in Teamfight Tactics lives in one place: the Riot account. Rank and LP, the collection of Little Legends and arenas, pass progress, purchases, and the same account opens League of Legends. It follows you from a phone to a PC to a Mac, and it came through patch 18.1 without a scratch. What loses an account is almost never a sophisticated hack. It is a password typed into a page that copies Riot’s sign-in screen, a mailbox whose password you forgot years ago, or a login lent to a friend. Here is what actually protects it, in the order that matters.

What a Riot account is worth, and why someone wants yours

Before talking about protection, it helps to measure what sits behind a username and a password. It is more than a TFT profile.

• Your rank, LP and match history, which belong to the account and not to the machine, as our article on TFT ranks and the ladder explains.
• The collection: Little Legends, arenas, booms and emotes, some of which can no longer be obtained once their set is over. That is what gives an account resale value, and that is why it gets targeted.
• The current set’s pass, purchases made in the game’s currency, and everything paid for over the years.
• The same Riot account opens League of Legends and the publisher’s other games: a password stolen through TFT takes everything else with it.

Accounts get stolen to be resold, to serve as a throwaway for someone who lost their own, or simply to be emptied. In every case the thief did not break a lock. Someone handed over the key.

Patch 18.1 removed macOS, not your account

A useful reminder, because the question keeps coming back in a worried form. Patch 18.1, the one that opens Set 18 by moving Teamfight Tactics from Riot’s in-house engine to Unreal Engine, removed macOS support: no support, no fixes. Riot describes the removal as temporary and says it is working to support the system in a future update, without giving a date. The same patch also dropped the older Android and iOS devices with the least memory.

But no account was reset or deleted along the way. Rank, collection and purchases stayed exactly where they were, attached to the Riot account. What changed is the machine: on a Mac, the game now runs through the Android client, which Riot still fully supports, and signing in happens on Riot’s own sign-in screen inside the game. The full picture is in our article on macOS support being removed at patch 18.1. For account security, remember one thing: any message claiming that “your Mac account will be deleted” or must be “verified” because of the patch is lying. There was never a Mac account. There is only a Riot account.

Two-factor authentication: ten minutes that change everything

Two-factor authentication, which Riot calls multi-factor authentication, asks for a second proof at every sign-in: a one-time code on top of the password. A thief who has the password stops there. It is switched on from the Riot account page, on Riot’s website, not from inside the game.

1. 1Sign in to your Riot account page, on the riotgames.com domain, and find the card dedicated to multi-factor authentication.
2. 2Click the enable button. Riot sends an email to the account’s address, and the button that actually turns the protection on is inside that email. If it does not arrive, check the spam folder, then ask for it to be resent.
3. 3From then on, every sign-in asks for the password and then a six-digit code sent to the account’s email address, which you type into the game or the website.
4. 4A checkbox lets a trusted device skip the code for a limited period. Do not tick it on a computer that is not yours.

The important part, and the one most people skip: the code arrives by email. That means the mailbox is the real key to the Riot account. Anyone who gets into your email can receive the codes, reset the password and, in the end, change the account’s address to lock you out. The first protection for a Riot account is therefore two-factor authentication on the mailbox itself, with a password used nowhere else. And if you sign in to Riot through a Google or Apple account, that account’s security becomes your Riot account’s security.

Password, username and email: three things not to mix up

• The password must be unique. The most common scenario is not Riot being hacked, it is a leak at some other service where you used the same password. The macOS keychain or a password manager remembers it for you.
• The login username is not the Riot ID. The Riot ID, the one written with a hash and a tagline, is public: it shows in games and on stats sites, and nobody can sign in with it. The login username never appears in the game, and there is no reason to share it.
• The account’s email address must be one you still control. An account created as a teenager on an abandoned mailbox is an account you will not get back the day a code needs to land somewhere.
• The sign-in method must stay the same. An account opened with Google and later reached with a Riot password does not lead to the same place: our article on the three identities that overlap on a Mac explains why that detail looks like a lost account.

Phishing: free cosmetics do not exist

The theft of a Riot account almost always starts with a message. It lands on Discord, in the post-game chat, by email or in a comment under a video, and it promises something: free RP, a gifted skin, a rare Little Legend, early access. The link leads to a page that reproduces Riot’s sign-in screen. The player types a username and a password, the page says thank you, and the account changes hands within the hour.

• Riot’s sign-in page lives on the riotgames.com domain. A page asking for your Riot password on any other domain is a copy, however good it looks. Read the address bar before typing anything.
• Riot never asks for a password by message, not on Discord, not by email, not in the game. A “Riot employee” writing to verify your account is not one.
• A gift that requires signing in is not a gift. Real creator giveaways hand out codes or gift cards, never a login form.
• The fear version works as well as the gift version: “your account will be suspended, verify it within 24 hours”. Urgency is the tell, not the exception.
• Since patch 18.1, a page promising an official “TFT for Mac client” to download is wrong at best. Riot removed macOS; the only supported route on a Mac is the Android client. A package picked up outside the Play Store is the real risk, as our article on what Riot actually punishes explains.

What a stats site never asks for

The sites that show your match history, your rank and your most played comps read public data. The Riot ID, the one with the hash, is all they need to find everything. They do not need your password, and they will never have it.

• Some offer “Sign in with Riot” to link your profile. That button sends you to a page on the riotgames.com domain, which states what the site will be allowed to read, then brings you back. The password is typed at Riot, never on the site.
• A site, an overlay or an app that shows its own “Riot password” field in its own window has crossed the line. Leave it.
• What these sites know about you is what anyone can see in a lobby: the Riot ID, the rank, the history. Nothing that would let anyone sign in.

What these tools can and cannot do when you play on a Mac, and why the desktop overlay does not exist in that case, is covered in our article on TFT stats and overlays on a Mac.

Lending your account: what it really costs

Giving your username and password to a friend, a Double Up partner or a service that promises to climb the ladder for you costs two things, and the first is worse than the second.

• Control. Whoever has your login can change the email address and the password. From then on, Riot sees two people claiming the same account, and recovery becomes a dispute to prove, not a click.
• The account itself. Account sharing and boosting are among the offences that actually cost an account, regardless of any hardware question.
• On a Mac shared with the family, the game stays signed in from one session to the next. Signing out is done from the game’s settings, and that is the only step needed so that another player does not inherit your account.
• On a Mac, where the game has run through the Android client since 18.1, sign-in happens on Riot’s screen inside the game: OSFT Launcher never sees or stores the Riot password, and the Play Store’s Google account is a separate identity that does not open the Riot account.

Hacked account: the steps in order

If you can no longer sign in, or if games you never played show up in your history, the order of the steps matters more than their speed.

1. 1Take back the mailbox first. Change its password, turn on its two-factor authentication, and check that no automatic forwarding rule has been added: that is how a thief keeps receiving your codes after you have been through.
2. 2Reset the Riot password from the “forgot password” page on Riot’s website, on the riotgames.com domain, never from a link received by message.
3. 3Turn on two-factor authentication if it was not on, and change the password on every other service where you used the same one.
4. 4If the account’s email address has already been changed, the reset will not reach you. What remains is Riot Support, through an account recovery ticket, where you will be asked to prove the account is yours: creation date and place, play region, purchases made.
5. 5Never pay a “recovery service” that promises to return the account for money. That is the second scam, built on top of the first.

The routine, in five lines

• Two-factor authentication on the Riot account and on the mailbox that receives its codes.
• One unique password, kept by the keychain or a manager, never reused anywhere.
• The Riot password is only ever typed on the riotgames.com domain, nowhere else.
• A gift, a giveaway or an alert that asks you to sign in is a scam, without exception.
• On a shared Mac, sign out from the game’s settings at the end of the session.

The account survived the removal of macOS and it will survive the next set. What it does not survive is a password given away, and that is the only thing these five lines prevent. How the account works across platforms, what syncs and what does not, is described in our article on the Riot account and cross-progression.