TL;DR: My Rockstar Games (Social Club) account was stolen three times within a year. Despite recovering it twice, support no longer recognizes me as the owner after the third theft, and my account is gone for good. Email login was changed, and 2FA was removed by Rockstar Support, even though my email account was never compromised. Personal and billing information was leaked, and thieves may use my account to phish my friends. I'm outraged that Rockstar handed my account over to someone else without even notifying me, leaving me to deal with the fallout.
Detailed timeline with ticket screenshots:
- 2008: Account created at the release of Grand Theft Auto 4 on PC (still got the box with cdkey). Never moved to a different email nor changed account name.
- 2010: Bought Grand Theft Auto: Episodes from Liberty City on Steam, linked accounts
- 2012: Bought L.A. Noire on Steam
- 2015: Bought Grand Theft Auto 5, still got original box with the receipt and cdkey
- 2015 to 2024: over 120 random friend requests. Probably just normal phishing, never accepted any.
- 2020: linked Amazon account with my real name
- January to April 2024: got 22 emails from Rockstar Support asking me if I wish to make changes to my account: ticket. Sometimes I would try asking who and what information do they want to change on my account: ticket. I was doing my best to close every ticket asap, but sadly had life to live, also it wasn’t necessary on my part because they were supposed to autoclose if left unanswered: email
- April 2024: 1st time the account got stolen: email
- I immediately opened the ticket to restore my account and got it back. Thief couldn’t log in because 2FA was still active.
- April 2024 to July 2024: 6 more emails with requests to change my information
- July 2024: account taken over second time: email
- I instantly followed up with a ticket to restore the account and 5 hours later got it back successfully. This time the thief managed to remove 2FA and changed my account name, no other damage done, besides my personal information being leaked.
- I pursued to have my account name restored aswell. From the beginning to the end I was still referred to as my original account name which would be funny if wasn’t so sad: ticket
- After this whole ordeal there were no attempts to steal my account.
- March 2025: GTA5 Enhanced was released on PC, I bought GTA+ subscription, played a bunch.
- April 2025: in the middle of the night got an email saying 2FA on my account was removed. Woke up and tried to log into my account to re-add 2FA, but I could no longer log in. Password reset link wouldn’t arrive. Account seemingly gone.
- 7 minutes later I opened a ticket
- I contacted support 6 more times, 2 tickets looked like the one above, both of them refused to acknowledge I’m the owner of the account and 4 other tickets automatically refused to help and got closed.
- I tried following up a closed ticket but it didn’t work
- Ticket in which support says email wasn't changed.
Notes:
- I never received any email warnings of my account being logged in in a new location (except for when I personally did it)
- Me being paranoid I have never clicked any links inside the Rockstar Support emails. I was always going directly to their support site.
- In every email I’m being referred to by my original account name with my original avatar.
- My email account is secure and has never been compromised.
- Support agent's names seemed randomised or everytime a different person was responding
What I think might have happened with 1st and 2nd hack:
Scammers spammed Rockstar Support with “can’t log in, change email” requests:
- hoping support person would grant their wish
- the owner of the account (me) would reply to the ticket mistakenly approving the changes
- it was an inside job: somebody (maybe even just the support person) was spamming with tickets until one landed on their “desk” and they just approved the change
What I think might have happened with 3rd hack: I have no clue, it blows my mind. If I’m no longer recognised as an owner when providing the same proofs then the cdkeys etc attached to this account must have been altered. I can only assume Rockstar Games suffered a hack where thieves were able to manually change my account’s information, or just a support person did it. The weirdest (and scariest) part is the only notification I received was 2-FA removal.
Isn’t the point of 2FA to avoid such situations? I get that it’s just an account for silly video games, but my money and personal information are real. How can somebody just get support to change email login and remove 2FA? Why is it harder to get it back than to steal it? I think the thieves were only after my account name, because you can get GTAV for like $10. With Grand Theft Auto VI approaching, a $70 game, every account will be a target.
22 Comments
I kinda doubt Rockstar did this.
I’d virus scan your computer
Wild. Support shouldn’t be able to remove 2FA without overwhelming evidence. I lost access to my authenticator because of a smash phone and no backup codes. Uber made it so difficult to remove my 2FA that I gave up for 2 mmonths. Which is honestly the way it should be.
Unfortunately, this isn’t new. It happens frequently.
And this is why I pirate rockstar games, just to avoid the launcher
This happened to my Google account. It randomly voided my two step and the account backup email which was my backup has been removed. Subsequently, the account once I tried to log in, ended sending my forgot password to an account with different language and reset pass page was chibbirish. Crazy experience but I lost that account. I now have auth app, 2FA, and email/number for account just not to lose an account
this wasnt rockstar
I don’t believe this.
I’ve used 2FA with them for years and never had an issue.
Likely follow the link in next steps to secure your account
Rockstar isn’t disabling someone’s 2FA lol someone’s hacked your shit again or there’s passwords you haven’t changed that has to do with that account which they can use to socially engineer some poor CS agent.
Rockstar sucks ass, and you should be pirating their games anyway, but i find it pretty hard to believe that your account was stolen three times in a year and it isn’t your own fault for doing something stupid or being cavalier about internet security.
I’ve been in a similar situation recently, not sure what lead them to my treasure trove of personal data, but I was well and truly pwned. Most of my 2FA accounts served no purpose, and the only value they’ve ever served was to annoy me when logging in. Been well and truly disillusioned to the security of any online service, no matter what their password requirements, ID level, or 2FA type used.
They managed to get into a lot of accounts without even flagging the “logged in from difference device” messages, let alone different locations. Despite me then getting said messages when restoring my account(s), and often times showing a clearly violating login in the recents lists where they had them. Luckily the only thing I’ve lost so far as is most of my Steam inventory, but I don’t play any of the Valve titles that use them, so it was a lot of random fluff from over the years. Still fighting with Epic over that account though, their system is somehow even worse than their client.
Worst experience I’ve ever had was with Microsoft though, my og Minecraft account was targeted for having a badass name, and because I’d used it somewhat publically, they were able to tie it to some of my emails. I had a few requests to buy it for insane BTC sums, not that I took any of them. Then eventually it was hacked, which I got resolved through blood sweat and tears. Only for it to be re-hacked, and they basically told me to go fuck myself. Since that time my account has (clearly) been sold to some mega whale, who has put a load of really expensive codes on it, so I get the odd email from those who still find what ever information links it to me, talking about all these expensive things that are now more valuable than the name ever was. Part of me has wanted to play Minecraft all these years, but that little part of what Totalbiscuit left in my brain is telling me not to let the company win. Knowing I’ll never be able to get the account back through MS, specially with their ever more enshitified CS, and not wanting to pay for that crap again.
Just keep trying dude, you clearly love GTA, and I imagine you’d have got GTA6 on that account. I wish I could give you advice beyond “keep messaging them”, but unfortunately that’s all you can realistically do. The world is great now we don’t own our games, and companies can give them to who ever they feel like, and treat security like it’s not their problem when it’s clearly flawed.
Weird all my 2-fa uses a authentication app or I get a text message with a code
Are you sure you aren’t being phished or that you weren’t hacked regardless of the 2fa? Shit passwords or backup methods can be hacked and lead to account takeover.
R* is trash when it comes to logins. I gave up on gtao and rdo years ago because of it.
How did you manage to get your account compromised 3 times in one year *despite* having 2fa configured?
I don’t want to be victim blaming, but I work in IT and this seems really unlikely. What kind of 2fa were you using? Something with known vulnerabilities like SMS? Or email without the email account being protected by MFA?
Is there any possibility that someone close to you, meaning someone you live with, was involved? It would certainly make it easier/make more sense. Because if you’re using complex passwords AND MFA, then you’re either being really stupid on the internet and giving up your info over and over, or you have a compromised system somewhere that’s enabling these folks to keep regaining access.
They won’t even reply to my emails to get my account back.
bro somebody stole your account and changed its details rockstar as this shitty securrity i lost one account to somebody from china
Is possible that the hackers have access to your email account. When my epic games account got hacked it was because they got into my email and changed my epic games account password using the email address. Check in your email under filters and see if rockstar is filtered from showing in your inbox.
There was 0 sign that they got into my email at all. It was weird
GTA is heavily targeted by hackers for various reasons.
Gosh this shit is so annoying. I couldn’t get rdr2 to launch for like 2 days. BS.
They have the weakest account protection i have ever seen. My account got hacked because I reused the password from some other site that had a data leak. Fair enough, I should be smarter, but when person that hacked my account tried to change email they just send me emails in Russian, which I don’t speak, that if I don’t do anything my email will change. Like WTF, I should agree to email change, not be informed I have to decline in a language that I have never used before.
Repot them to the federal trade commission fuck em