Xbox scams
Last updated September 18, 2026
The short answer
Xbox scams target the Microsoft account behind the gamertag, which also holds Outlook email, OneDrive files and any saved payment method. Free Game Pass offers and verification-code requests are the usual routes in.
An Xbox compromise is broader than a gaming one. The gamertag sits on a Microsoft account that may also hold your email, your files, your Office subscription and your saved cards — so a code shared in a party chat can cost far more than a game library. Rare or short gamertags have their own resale market, which means some accounts are targeted for the name alone.
How Xbox scams work
- 1
Free Game Pass and currency phishing
Links promising free Game Pass, gift cards or Microsoft Points lead to a fake Microsoft login that captures credentials.
- 2
Verification code requests
A request in a party chat or DM to read back a code, which is the two-factor prompt for your own account.
- 3
Gamertag theft
Short or desirable gamertags are targeted specifically for resale, sometimes through social engineering aimed at Microsoft support rather than at you.
- 4
Fake support and refund calls
Callers claiming to be Xbox support offering refunds for subscriptions, requesting remote access or bank details.
Warning signs
- An offer of free Game Pass, points or gift cards
- Anyone asks for a verification code
- A login page is not on login.microsoftonline.com or xbox.com
- A friend's account sends a link out of character
- You receive Microsoft security alerts you did not trigger
- A caller offers an Xbox subscription refund
- Your gamertag or account details change without you doing it
Examples
One code, three accounts
A player reads back a code requested in a party chat. It is the two-factor prompt for his Microsoft account — which also holds his Outlook email and OneDrive. The attacker resets two shopping accounts through the email before he notices, and the actual gaming loss is the smallest part of it.
The gamertag worth stealing
A player with a rare three-character gamertag is targeted through a support-impersonation approach. The account is taken, the gamertag transferred, and the library abandoned. The tag was the entire objective.
What to do
- Turn on two-factor authentication on the Microsoft account, ideally with the Authenticator app.
- Never share a verification code, with anyone, for any reason.
- Remove saved payment methods from accounts children use.
- Check recent activity at account.microsoft.com after any suspicion.
- Use a unique password — reuse is the most common cause of compromise.
Report it to Xbox
Recover a compromised account at account.microsoft.com and report through support.xbox.com. Check recent security activity while you are there.
Getting your money back
Recover the Microsoft account first at account.microsoft.com, then treat it as a full account compromise rather than a gaming one: check Outlook for forwarding rules and filters, review OneDrive sharing, revoke app access, and sign out of all sessions. Dispute unauthorised charges with your card issuer. Then reset anything that uses the Outlook address for password recovery, because that is usually what the takeover was for.
Frequently asked questions
Why is an Xbox account compromise worse than it sounds?
Because the gamertag is attached to a Microsoft account that may also hold Outlook email, OneDrive files, an Office subscription and saved cards. An attacker who gets in through a game chat can reset your other accounts through that email. Treat it as an email compromise, not a gaming one.
Is free Game Pass ever offered?
Microsoft runs genuine promotions, but they are redeemed through the Xbox app or account.microsoft.com, never through a link sent in a chat. Anything asking you to log in on an outside page to claim free Game Pass is phishing.
Someone asked for a code to verify my account. Why?
Because they already have your password and the code is the last step. Two-factor codes exist to prove your identity to Microsoft, never to another person. No friend, moderator or support agent will ever have a reason to ask for one.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Xbox, these are the guides worth reading next.