Your Minecraft account is a Microsoft account. The same email and password that open the game can also open your inbox, your saved files and anything else tied to that login. Stolen Minecraft accounts are resold in bulk, so attackers target players of every age with scams built around servers, ranks and Discord communities. Most of these attacks are easy to spot once you know what they look like.
Know what a server can and cannot ask for
A Minecraft server never needs your Microsoft email or password. When you join a premium server, the game proves your identity to Mojang's session service and the server only receives a yes or no answer. Your password stays between you and Microsoft.
That gives you a simple rule. Anyone asking for your Microsoft login, including someone who claims to be server staff, a moderator, a Mojang employee or a friend, is trying to take the account. Real staff do not need it to give you a rank, fix a ban, restore items or check that you own the game.
The same applies to verification codes. If someone asks you to read out a code that Microsoft just sent to your email or phone, they are usually in the middle of resetting your password or signing in as you. Never share these codes.
Fake free rank and giveaway links
The most common trap promises something valuable for free: a top rank on a popular server, in-game currency, a cape, or a gift code. You are sent a link to claim it, and the page asks you to "sign in with Microsoft" or to "verify your Minecraft account".
Signs that a link is a phishing page:
- The page asks for your Microsoft email and password to claim a reward on a game server. Servers deliver ranks in-game or through their own store, not through your Microsoft login.
- The address in your browser is not Microsoft's real sign-in domain, even if the page looks exactly like it. Copies are easy to make, and some even show a fake browser window inside the page.
- There is a short deadline, such as "only 10 minutes left" or "first 50 players".
- The offer arrived from a stranger, or from a friend who suddenly sends links they would not normally send. Their account may already be compromised.
If you want to check a server's offer, open the server's own website or announcement channel yourself instead of using the link you were sent.
Mods, clients and launchers from unofficial sources
A mod or client runs on your computer with the same access as any other program. Malicious ones can read the session token from your launcher, which lets someone use your account without knowing your password, or steal saved browser passwords and Discord logins.
- Download mods only from well-known mod hosting sites or from the author's official page. Avoid re-uploads on file-sharing sites and video descriptions.
- Be careful with "cracked" versions of paid clients, "free" cosmetics mods and anything promising hacks for a server. These are a common delivery route for account stealers.
- If a server requires its own launcher or client, make sure the download comes from the server's official site and that other players use it too.
- Do not run files a stranger sends you on Discord, whether they call it a mod, a texture pack, a "map download" or a game they want you to test.
Resource packs and data packs are generally safe because they contain textures and game data, not executable code. The risk lies in anything you have to run as a program, such as .exe or .jar files, and in archives that contain them.
Discord scams around Minecraft servers
Most Minecraft communities live on Discord, so many scams start there. Typical patterns include:
- Fake staff applications or "verification". A bot or user asks you to verify by signing in to Microsoft or scanning a QR code. Scanning a login QR code with your phone can sign the scammer in as you.
- "I accidentally reported you". Someone claims your account was reported by mistake and sends you to a "support agent" who asks for your login details.
- Test my game or mod. A friendly stranger, or a friend's hacked account, asks you to try a file. It contains malware.
- Trading with middlemen. When buying items or accounts, a fake middleman takes payment or details and disappears.
Keep your direct messages limited to friends if you join large servers, and confirm unusual requests from friends through a different channel before acting on them.
Turn on two-step verification
Two-step verification on your Microsoft account is the strongest single protection you can add. With it enabled, a stolen password alone is not enough to sign in, because Microsoft also asks for a code from an authenticator app, a text message or an email to a separate address.
- Sign in to your Microsoft account on Microsoft's official account page.
- Open the security section and choose the advanced security options.
- Turn on two-step verification and follow the steps to add an authenticator app or a phone number.
- Save the recovery code Microsoft shows you somewhere safe and offline.
While you are there, check that the recovery email and phone number are current and belong to you. Those are what Microsoft uses to help you get back in later.
Use a unique password on cracked servers
Non-premium servers ask you to /register a password that the server stores itself. You cannot know how well it is protected, and small servers are hacked, sold or shut down regularly. Leaked password lists from game servers are then tried against Microsoft accounts and email providers.
- Never use your Microsoft password, or your email password, on any server.
- Use a different password for every server, so a leak on one does not unlock the others.
- A password manager makes this easy, but even a written list kept at home is better than reusing one password everywhere.
The premium server filter on the home page shows servers where no extra password is needed at all. Each listing also shows a premium or non-premium badge, so you know in advance which kind you are joining.
Check a server before you join
Most servers are run by people who simply want players. Still, a few minutes of checking helps you avoid the ones that are not. Read player reviews on the server's listing and check its live player count and votes. Be wary of servers that require you to install a custom launcher with no clear reason, or whose staff pressure you to move to private messages. If you have questions about how the list itself works, the FAQ covers the basics.
If your account is stolen
Act quickly. The sooner you start, the more likely you are to recover it before the thief changes all the recovery details.
- Try to sign in to your Microsoft account. If the password still works, change it immediately, sign out of all other sessions from the security page, and turn on two-step verification.
- If you cannot sign in, use Microsoft's account recovery form from the official sign-in page. Fill it in from a device and network you have used before, and include as much detail as you can, such as old passwords, the date you bought Minecraft and email subjects you sent from the account.
- Change the password of the email address linked to the account, and any other account where you used the same password.
- Scan your computer for malware, especially if you recently ran a mod, client or file from an unofficial source. Without that, the thief may take the account again.
- Tell the staff of servers where you have ranks or items, and warn your friends on Discord in case the attacker messages them from your profile.
If the recovery form is rejected, you can submit it again with more detail. Be careful of people offering to recover your account for a fee. That is another common scam.
A short checklist
- Nobody legitimate needs your Microsoft password or verification codes.
- Two-step verification is on, and recovery details are current.
- Every server password is unique and different from your Microsoft and email passwords.
- Mods and clients come only from official sources.
- Links promising free ranks or items are ignored.