Use a unique account password
Do not reuse the child's game password for email, school or another game. Protect the linked adult or recovery email just as carefully.
BASTIONHOST / FREE COINS, LINKS & ACCOUNT THEFT
FREE COINS, LINKS & ACCOUNT THEFT
Protect the account before the free offer appears.
Free currency, rare items and urgent account warnings are common ways to steal a password or push a child onto a false site. Secure the account first and make every outside link a reason to pause.
START HERE
Set the boundary before you test it.
The safest lesson is not how to spot every fake page. It is that a child never needs an outside generator, player link or direct message to claim official currency or protect an account.
Add two-step verification
Turn on the platform's strongest practical sign-in protection. Keep recovery codes with the adult, not in the child's messages or photo library.
Use the official app or typed address
Open account settings from the installed app, console or a saved official address. Do not follow a warning or prize link to sign in.
PRACTICAL SETUP
Work through the real account and device.
Do not rely on what a parent dashboard appears to show. Apply the control, then check the result while signed in as the child.
Secure the linked email account first
Use a unique password and two-step verification on the email that can reset the game account. Check the recovery phone number and remove old addresses or devices.
Give the game account its own password
Use a password manager on the adult device if appropriate. Do not share the password with friends, clans, trading partners or anyone offering to improve the account.
Turn on two-step verification
Use an authenticator, passkey or the strongest option the platform supports. Store recovery codes privately and check which devices are already signed in.
Remove unknown sessions and linked apps
Review active devices, browser sessions, console links and third-party connections. Sign out anything you cannot place and revoke old apps that no longer need access.
Set the official-currency rule
Buy or redeem currency only inside the official game, console store or known account page. Treat generators, giveaways that need a login and trades requiring a code as attempts to take the account.
Practise opening the safe route
Show the child how to close a message and open the real app or saved website separately. An urgent account warning should be checked from settings, not from the warning link.
Prepare for a mistake
If a password or code is entered into a doubtful page, change the email password first, then the game password. End sessions, check purchases, contact official support and keep the child involved without blame.
TEN-MINUTE TEST
Check what your child actually sees.
- The linked email has a unique password and two-step verification
- The game account uses a different password
- Recovery details belong to the family and are current
- Unknown devices and connected apps have been removed
- The child can reach account settings without following a message link
- The child knows a mistake should be reported quickly
The family rule
Free currency, rare items and urgent account warnings do not get our password or login code. Close the message and check through the official app or website with a grown-up.
What the settings cannot promise
Two-step verification cannot protect an account if a child approves a false login or gives away a recovery code. Platform support may be the only route after an account is stolen, so keep receipts, account IDs and recovery details available to the adult.
Current official instructionsNCSC guidance on phishing ↗NCSC top tips for staying secure online ↗Epic Games account security ↗
Written by Kevin Turnbull. Last reviewed 21 August 2026. Services, settings and menu names change. Check the current official instructions while applying this guide. This is practical parent-to-parent guidance, not emergency safeguarding advice. Find UK help and reporting services.
PARENT-WRITTEN GUIDANCE
Make the safe route familiar.
A child is less likely to follow the false route when they already know how to open the real account page and bring an urgent message to you.
Suggest an improvement →