First minute: are you actually hacked?
The moment you suspect something is wrong with your Fortnite account, slow down for two minutes. A surprising number of "my account was hacked" incidents turn out to be routine — an expired session, a different launcher window, or a password you updated last month and then forgot. Filing a formal recovery request and later realising you had the right password all along wastes your time and Epic’s, and pushes legitimate compromise tickets further down the queue.
Open a private browser window and go to epicgames.com. If the password simply does not work, request a password reset to the email address on file. If that email lands and you can sign in normally, there was no attacker — just a login state that needed refreshing. If the reset email never arrives, if your inbox shows unfamiliar login alerts, or if your Fortnite client has been signed into a username you do not recognise, treat this as a real compromise and work through the rest of the checklist in order.
- Try signing in through a private browser window at epicgames.com.
- Request a password reset to the email address you expect on the account.
- Check that inbox for Epic login alerts from an unfamiliar city or device.
- Open the Fortnite client — is it signed in as someone you do not recognise?
Reset your Epic password — after locking the email
Go straight to Epic Games Support and open the compromised-account guide linked below. The shortest route from the home page is the "I cannot sign in" option, which walks you through confirming the email address on the account, requesting a password reset and starting a formal recovery ticket if the reset flow fails.
Before you reset the Epic password, lock down the email account behind it. If an attacker has your Fortnite login, there is a real chance they also have the email, and resetting the Epic password is pointless if the next reset message gets intercepted. Change the email password, sign out of every active session and revoke any third-party app you do not recognise from the provider’s security settings. Turn on 2FA on the email account at the same time if it is not already there.
Then request the Epic password reset. Choose a passphrase you have never used anywhere else and do not reuse security answers across accounts. If Epic’s reset flow reports that the address on file is not yours any more, do not keep retrying — skip straight to the formal support request covered below. Repeated resets against a changed email only trigger a temporary rate-limit.
Turn on two-factor authentication immediately
Two-factor authentication is the single change that most reliably stops the same attacker getting back in. Epic supports an authenticator app, SMS codes and email codes. Set up the authenticator option first: SIM-swap attacks and intercepted texts are the most common way SMS-based 2FA fails in practice, and authenticator apps are not vulnerable to either.
In the Epic account portal, open Password & Security and enable "Two-Factor Authentication App". Scan the QR code with Google Authenticator, Authy, 1Password or whichever app already holds your other 2FA seeds. Save the backup codes Epic shows you to a password manager or a paper envelope — those are what get you back in if you lose the phone that holds the authenticator seed.
SMS 2FA is better than no 2FA, so if an authenticator app is not practical today, add SMS now and upgrade later. The one thing not to do is skip 2FA because you want to play immediately. The Fortnite account you just recovered is now worth more to an attacker than it was yesterday: they know it is a real account tied to real purchases.
Check your linked consoles and platforms
Fortnite accounts live in an ecosystem of linked platforms — PlayStation Network, Xbox, Nintendo, Steam, Google, Apple. An attacker who gets into your Epic account may change those links, detach them or attach their own, and that alone can keep you locked out of the actual Fortnite client even after the Epic password is yours again. Some console links, once made, are permanent in a way only Epic support can unwind.
Open the Connections page in your Epic account settings and read every entry. If a PlayStation, Xbox or Nintendo tag looks unfamiliar, that is a link the attacker either created or hijacked. Unlink anything you do not recognise. If the attacker has detached your legitimate console and attached their own, Epic’s recovery team will have to put the original back; write down the platform and the gamertag you expect to see before you open the ticket, because that detail is one of the things the agent will look for.
The flip side also matters. If your personal PlayStation or Xbox account was compromised in parallel, resetting only the Epic password will not keep the attacker out — they can walk back in through the console link. Reset the console-account password, enable its own 2FA and re-check Epic’s connections once that is done.
Open a formal Epic support request
If you no longer control the email on the account, the password reset will not work and the formal recovery request takes over. From the same compromised-account wizard, choose the option for "I cannot access the email on my Epic account" and start a support ticket. Epic’s recovery agents compare what you tell them against what they can see in their own records, so specifics matter and vague claims do not.
Gather proof before you type anything. The strongest items are the original email address on the account, an approximate creation date, the display name you used most, any linked console gamertags and purchase receipts. Emailed receipts from Epic Games or Fortnite in-game purchases are the single strongest proof — search your inbox and your Google Play or Apple App Store history for "Epic Games" and "Fortnite", and pull the specific amounts and dates.
Write the ticket plainly. State what happened, when you noticed, what you have already tried, and attach the proof. Do not round numbers up or guess at dates — a receipt for $9.99 on a date Epic can match in their own records is worth more than "I spent a hundred dollars last year". Submit once and wait. Sending three duplicate tickets pushes your case to the back of the queue; a single polite follow-up on the existing ticket after four or five business days is reasonable, a parallel one is not.
- The original email address that was on the account.
- Approximate account creation date and the display name you used most.
- Any linked console tags — PSN ID, Xbox gamertag, Nintendo account.
- Purchase receipts from Epic Games, Google Play or the Apple App Store.
- A short, factual description of what changed and when you first noticed.
If Epic cannot restore access
Epic restores the majority of accounts where the owner can prove original creation and at least one purchase. But there are real cases where recovery fails — the original email was a long-dead address, there are no receipts, or the account has been chained through enough attackers that proving first ownership is no longer practical. If Epic’s final answer is that they cannot restore access, that answer is final. Continuing to open fresh tickets will not change it, and arguing with support will not change it either.
A fresh start is a reasonable fallback. A new Epic account is free and takes three minutes to create — if your motivation was simply playing Fortnite with friends again, that gets you back in the game today. Plan it as a clean break: new email, new password, authenticator-app 2FA from the first login. If what you actually want is a specific locker or a particular era of outfits, a storefront that lists exact contents and backs delivery with a replacement window is the fastest path. Read the Fortnite buying guide linked below before spending money, so you know what a safe listing looks like and what to check on first login.
Frequently asked
How fast does Epic respond to a Fortnite recovery request?
Epic does not publish a service-level target for recovery tickets. In practice, straightforward cases where the original email still works tend to resolve within a day or two; complex requests with a changed email, changed region or missing receipts can take one to two weeks. Keep the original ticket open and reply promptly to any follow-up questions. Opening a second duplicate ticket pushes your case to the back of the queue rather than speeding it up.
What proof should I include in my Epic support ticket?
The most useful items are the original email address on the account, an approximate creation date, the display name you used most, any linked console gamertags, and purchase receipts — Epic’s own emailed receipts, Google Play, Apple App Store or console-store receipts for Fortnite purchases. A receipt that matches a specific dated transaction Epic can see in its own records is the single strongest proof of ownership.
What if I do not have any purchase receipts?
Free-to-play accounts with no real-money purchase history are harder to recover, because Epic has less verifiable data to match against. The recovery team may still accept a combination of weaker proofs: original email access, console link history, consistent display names and the account creation details you remember. Be honest about what you have. Inventing receipts or claiming purchases you did not make guarantees the ticket is closed and can bar future recovery attempts.
Will Epic restore my V-Bucks if the attacker spent them?
Epic does not guarantee V-Bucks restoration and does not routinely refund currency that an attacker spent on cosmetics. Mention the loss in your support ticket for the record, but treat getting the login back as the primary goal; item and currency restoration is a separate conversation that often does not resolve in the account owner’s favour. Enabling 2FA immediately after recovery is the most reliable way to protect whatever balance remains.
How do I prevent this from happening again?
Three habits do most of the work. Enable authenticator-app 2FA on both your Epic account and the email address behind it. Use a password manager so every account has a unique, long passphrase you never reuse. Treat any email, Discord DM or in-game message asking for your login or a verification code as an attack — Epic will never ask for your password in chat, and no legitimate giveaway asks for your 2FA code.
Can Epic recover an account tied to a dead email address?
Sometimes. If you can prove original ownership through purchase receipts and linked consoles, Epic’s recovery team can update the email on the account to one you control. If the original email is dead and no payment history exists, the practical answer is usually no. In that case, the fastest path back to playing Fortnite is a new account rather than another round with support.
