Genshin Impact account security: HoYoverse 2FA, PlayStation links, account trading and phishing

Yes, in HoYoverse’s sense of the word. HoYoverse’s help center calls it two-factor authentication: you link an email address or phone number under Personal Information, confirm it with a code, and from then on a sign-in needs your password plus a code sent to that email or phone.

What it does not offer, in any help article we checked, is an authenticator app option or a list of backup codes. That changes your priorities. On platforms with backup codes, a lost phone is a short detour. On HoYoverse, your linked email is the lifeline, so the inbox’s own password and 2FA matter as much as your Genshin password.

PlayStation is the link to plan. The first time a PSN account opens Genshin, after you accept the Terms of Service, a pop-up offers to link an existing HoYoverse Account, and it does not come back. Skip it and the PSN account registers a new HoYoverse Account, which can no longer be linked to an email that already belongs to another HoYoverse Account. Genshin’s cross-save notice, which HoYoverse’s help center still points to, also says the link does not support unlinking.

The same notice says progress only syncs on the same server, and that only the America, Europe and Asia servers have PlayStation counterparts, so TW, HK, MO progress can’t be shared with a PSN account. One PSN account links to one email, and one email to one PSN account.

If you started on PlayStation, HoYoverse created your account automatically. To play that save on PC or mobile, link an email and set a password under Settings, Account, User Center on the console first.

Phone sign-ins have limits of their own. Google login works on Android and PC but not iOS, and Apple login works on iOS and PC but not Android. An account linked only to Google or Apple can be hard to open on a new device, which is why HoYoverse tells those players to link an email. Before you unlink any sign-in method, keep at least one active login such as email or phone.

Genshin’s Terms of Service are direct. You may not transfer or share your account or use anyone else’s, and selling it or otherwise handing over control can get it terminated immediately with no refund. HoYoverse’s help center sums it up in one line: do not buy, sell, or share accounts.

The same terms say virtual currency and virtual goods are licensed to you, not sold, and can’t be transferred, sold, gifted or traded except as the terms allow. Paying through channels HoYoverse hasn’t approved is listed as prohibited conduct as well.

For buyers, a “starter account” with rare characters has a catch: someone else created it, linked its first email and knows its purchase history, which are exactly the details HoYoverse’s recovery form asks for.

On October 30, 2026, Genshin Impact posted a fresh warning: accounts in certain regions are being stolen through phishing websites. HoYoverse says these sites lure players with free rewards, prize draws, cashback offers or warnings of unusual account activity.

HoYoverse lists the warning signs: login notifications you didn’t expect, trusted devices you don’t recognize, a password that suddenly stops working, and missing items, currency or account changes you didn’t make.

Reset your password first. If you can’t, submit the HoYoverse Account Issues Application Form, report the unauthorized access, and give as much accurate detail as you can: account email, username, character details, previous purchases and recent security changes. Watch the email you gave for updates. Customer Support may ask for more to confirm it’s you, and HoYoverse says it reviews every case carefully but cannot promise recovery.

Write down what HoYoverse’s forms ask for, long before you need them.