{"id":4303,"date":"2026-05-22T14:31:20","date_gmt":"2026-05-22T11:31:20","guid":{"rendered":"https:\/\/www.gamermarkt.com\/blog\/?p=4303"},"modified":"2026-05-22T14:32:41","modified_gmt":"2026-05-22T11:32:41","slug":"psn-accounts-stolen-despite-2fa-sony-support-vulnerability","status":"publish","type":"post","link":"https:\/\/www.gamermarkt.com\/blog\/psn-accounts-stolen-despite-2fa-sony-support-vulnerability\/","title":{"rendered":"PSN Accounts Are Being Stolen Despite 2FA: How Sony’s Support Loophole Works"},"content":{"rendered":"\n
\n

Hackers are hijacking PSN accounts by exploiting Sony’s customer support verification process. A single old transaction number is enough to bypass 2FA, passkeys, and every other security measure.<\/p>\n<\/blockquote>\n\n\n\n

A critical security vulnerability in PlayStation Network’s customer support process is allowing hackers to take over PSN accounts even when two-factor authentication (2FA) and passkeys are enabled. The exploit does not rely on malware, phishing, or brute force. Instead, attackers use social engineering to convince Sony’s support staff to hand over account access using minimal personal information. On May 18, 2026, former IGN editor and Sacred Symbols podcast host Colin Moriarty confirmed that his account was stolen through this exact method.<\/p>\n\n\n\n

How the PSN Account Hijack Works<\/h2>\n\n\n\n

The attack targets Sony’s account recovery and customer support workflow rather than any software-level weakness. Hackers need only two pieces of information: a user’s PSN ID and one piece of old transaction data. That transaction data can be an order number from any past PlayStation Store purchase, the first and last four digits of a credit card used on the account, or the serial number of the first console linked to the account.<\/p>\n\n\n\n

Armed with these details, the attacker contacts Sony’s support system, either through the PlayStation Online Assistant chatbot or a human agent, and claims ownership of the account. Sony’s support then changes the linked email address and disables 2FA without requiring the real owner’s confirmation. According to PCMag’s investigation, the chatbot even asks attackers if they need help disabling “extra security measures,” and upon confirmation, removes passkeys and 2FA instantly.<\/p>\n\n\n\n

The support team does not verify the requester’s full name, date of birth, or answer to a security question. A single transaction number from a receipt that could be years old is considered sufficient proof of ownership.<\/p>\n\n\n\n

Colin Moriarty’s Account Was Stolen Despite a Warning<\/h2>\n\n\n\n

Moriarty received a direct warning from another hacking victim two days before the attack: “They have your information and they are going to try to take your account today.” He immediately changed his password and took precautions but could not prevent the breach.<\/p>\n\n\n\n

Hours later, his email inbox was flooded with hundreds of spam messages from services like EA, AliExpress, Slack, and Substack. This spam bombing was designed to bury the notification from Sony confirming that his account email had been changed. Shortly after, he received a text message confirming that 2FA had been disabled. The hackers then used his compromised account to send a PSN message to his co-host Dustin Furman reading, “You’re next.”<\/p>\n\n\n\n

PlayStation Support told Moriarty the recovery process could take up to three weeks. Thanks to his industry connections and contacts inside Sony’s first-party studios, he was able to reclaim his account within days. He openly acknowledged this was a privilege most players do not have, stating: “These are absolutely not privileges many other people have. I simply must acknowledge that.”<\/p>\n\n\n\n

A Pattern of Attacks Going Back to December 2025<\/h2>\n\n\n\n

This vulnerability was first publicly documented in December 2025, when French Numerama journalist Nicolas Lellouche reported that his passkey-protected PSN account had been compromised. The attacker changed his email and password and made unauthorized purchases using a linked payment method. Lellouche recovered his account through Sony support, only for it to be hijacked again within an hour using the same exploit.<\/p>\n\n\n\n

When Lellouche directly contacted the hacker, they revealed that the breach was made possible by a transaction number visible in a screenshot Lellouche had posted online back in 2023. Lellouche described the flaw as “a fatal security flaw with Sony’s security systems” and noted that Sony’s support staff have an internal tool that can reset an email address “even if it’s protected by a password or a passkey.”<\/p>\n\n\n\n

Sony reportedly marked Lellouche’s account as high-risk and instructed customer service not to intervene. That protection lasted roughly six months before the account was compromised a third time in May 2026, proving the underlying vulnerability remains unpatched.<\/p>\n\n\n\n

Record-Holding Trophy Hunter Permanently Banned After Hack<\/h2>\n\n\n\n

Five-time Guinness World Record holder David Tremblay experienced one of the most severe consequences of this exploit. His PSN account, dav1d_123, was hijacked in October 2025 using the same social engineering method. While inside the account, the hacker sent messages violating PlayStation’s terms of service to their own alt accounts and hid them.<\/p>\n\n\n\n

Tremblay eventually regained access, but the hidden messages stayed in Sony’s system. In March 2026, after Tremblay participated in a PCMag investigation about PSN security flaws, the hacker retaliated by unhiding those old messages and reporting them to Sony. The result was a permanent ban that erased over 432,000 trophies and 16,352 platinums. Sony cited “attempt to sell items, accounts, or services” as the ban reason. Tremblay has filed an appeal, but Sony has not publicly commented.<\/p>\n\n\n\n

Stolen Accounts Are Being Sold on Black Markets<\/h2>\n\n\n\n

According to multiple reports, hijacked PSN accounts with large game libraries or desirable usernames are being resold on Telegram and underground forums. Prices range from hundreds to thousands of dollars depending on the account’s content and age. Hackers are specifically targeting accounts created during PSN’s earliest years, when short and distinctive usernames were still available. In some cases, attackers publish stolen account credentials freely to demonstrate the exploit’s effectiveness.<\/p>\n\n\n\n

Pete Wenzler, a user profiled by PCMag, reported losing access to a digital game library worth approximately $20,000. Sony’s support response was described as “unable to assist,” leaving Wenzler with what he called a “boat anchor” console and no way to access his purchased content.<\/p>\n\n\n\n

Why Sony Has Not Fixed It Yet<\/h2>\n\n\n\n

Despite repeated public reporting since December 2025, Sony has not issued a public statement about the vulnerability or announced changes to its customer support verification process. Multiple journalists and security researchers have shared their findings directly with Sony’s management. Moriarty confirmed on May 20, 2026 that he had spent days gathering information and exchanging extensive emails with Sony contacts.<\/p>\n\n\n\n

The core issue is a policy problem, not a technical one. Sony’s support system prioritises analog identity verification, such as old order numbers and partial card digits, over the digital security measures users have configured on their accounts. Until Sony fundamentally changes how account ownership is verified during recovery requests, the vulnerability will remain exploitable regardless of how many security layers a user enables.<\/p>\n\n\n\n

How to Reduce Your Risk Right Now<\/h2>\n\n\n\n

Because this exploit targets Sony’s internal support process, no user-side security configuration can fully prevent it. However, you can significantly reduce your exposure:<\/p>\n\n\n\n