Sony support loophole lets scammers seize PS5 accounts

A flaw in Sony’s PlayStation support process is allowing scammers to take over PS5 accounts by impersonating owners and supplying recent PlayStation Store purchase details to support staff, who then restore or reset access.

Attackers typically provide a username or email address plus transaction dates and item specifics. PlayStation support agents sometimes rely on matching recent purchases to confirm identity; when an agent accepts the supplied purchase details, they can override existing security settings. That process can bypass two-factor authentication and passkeys tied to the original account because the change is made through the support channel.

The technique has been reproduced in tests and reported by users. One user arranged a test with a family member’s consent and had support recover the account after providing the requested purchase information. PlayStation commentator Colin Moriarty discussed being targeted during a podcast. A longtime player who tracked trophies reported losing a decade-old account and being unable to recover it, and multiple other users have reported similar losses.

The purchase details used by attackers are often public or easily found: players post about new game purchases, share screenshots of store receipts, or mention transaction dates. Some incidents indicate attackers can assemble enough publicly available information without a direct transaction screenshot.

Sony has acknowledged awareness of the problem but has not announced changes to how support verifies account ownership.

Multiple reported incidents show that relying on purchase-history checks for account recovery can allow account takeover through social-engineering tactics directed at support staff.