League of Legends account security: regions, RP, ranked rules and Riot support

League runs more than a dozen regional servers, from North America and Europe West to Japan, Taiwan and the Middle East, and your account belongs to one of them. Before a username or password recovery, Riot suggests confirming which server the account is on, since an account cannot sign in on another region’s site or client.

Moving costs 2600 RP one way, bought from the account button next to Purchase RP in the store. Free transfer tokens only appear during Riot promotions and vanish when they end. Each transfer starts a 90-day cooldown, and Riot will not reverse or refund an accidental one, even when a friend pressed the button.

Theft is the exception: if a hijacker moved your account, Riot restores it to your previous region at no cost. A transfer keeps champions, skins, Blue Essence, leftover RP, Honor level, Riot ID and a globally unique username, but you replay ranked placements on the new server. Accounts with a very large RP balance get a short manual review first, which Riot says protects them from malicious transfers.

RP is League’s paid currency: Riot says it only comes from buying it in the store or receiving it as a gift from a friend. Blue Essence is the earned one, mostly from Battle Pass progress, and you spend it crafting or buying champions.

That makes every free RP offer a lie. Riot’s phishing page describes the script: someone claims to work at Riot, or promises RP to a “nice player”, then asks for your credentials. Riot also warns against sites selling low-cost RP packages. The official routes are the in-game store and prepaid cards from real shops, redeemed in the store under Account, then Redeem Codes.

Cheap RP has a second trap. When a payment for RP is reversed, Riot suspends the Riot Account until it is repaid. A reversed gift suspends both the sender and the receiver, and several chargebacks give Riot the right to ban the account permanently.

Riot’s Terms of Service forbid sharing your account or login with anyone, and forbid selling or transferring it. Since Patch 25.18 on September 9, 2025, Riot actively penalizes account sharing, purchased and botted accounts, and boosting in League.

Riot’s FAQ draws the line at ranked. Lending your account for one normal game or a game of TFT will likely go unpunished, though it still breaks the rules. Sharing Riot can tie to boosting or ranked manipulation brings a suspension, reverted gains and lost Ranked Rewards, however rarely it happened. Riot’s boosting page adds that any ranked game played by someone other than the account’s creator may count as boosting, that both players are punished, and that repeat offenders are banned permanently.

Since Patch 25.23 on November 19, 2025, queue delays, suspensions, bans and chat restrictions apply across every account Riot is confident is yours. A second account is still allowed, Riot says, if you created and leveled it yourself, play placements honestly, never share it and never use it to manipulate ranked. Bought accounts are almost certain to be banned.

League now shows your Riot ID, which replaced Summoner Names: a game name of 3 to 16 characters plus a tagline of 3 to 5. In the client, open the Shop, click Account, choose the Riot ID Change offer and finish on account.riotgames.com. Changes are free every 90 days with no paid option, though Player Support can help sooner if a recent name is attracting harassment.

For security, remember that your Riot ID is not your login: the username you sign in with stays private and cannot be changed. Once you swap away from a default region tagline such as NA1 or EUW, you cannot go back to a region code. A Riot ID change you did not make is a sign someone else is in the account. Riot also blocks the word Riot in player names and can rename accounts that impersonate esports pros, worth remembering when a “Riot” profile messages you.

The classic League scam is a message from “Riot staff” saying they found a problem with your account and need your details to fix it. Riot says no staff member will ever request your information or contact you directly through the client, the game or a social network. When Riot needs you, it emails the address on your account.

Riot lists its email domains, such as riotgames.com, leagueoflegends.com, email.leagueoflegends.com and mail.accounts.riotgames.com, and says not to open a Riot-looking email from any other domain. Unusual Login Activity alerts come from [email protected] or [email protected], and their reset button only works for 24 hours.

“Account verification” works as a hook because a real version exists: Riot’s mandatory email verification gives its instructions inside the League client and confirms your email address, not your password. A Discord DM, friend request or web form asking you to “verify” with your login is not Riot. The only page that should see your Riot password is authenticate.riotgames.com.

Riot points you to its Account Recovery Tool at recovery.riotgames.com first, and to a ticket if that fails. Recovery cannot restore a deleted account or a permanently banned one. A deletion request completes after 30 days, and Riot can only stop it if you reply to its email at least five days before.

When Player Support needs to confirm the account is yours, Riot’s locked-out help lists the details it asks for:

Every detail in that list is easy to save while you still have access and hard to dig up after a takeover. A LoginScout card keeps them next to the login, encrypted on your device: