One switch, every Riot game
MFA protects the Riot Account itself, and that single login opens VALORANT, League of Legends, TFT and the rest.
Riot 2FA
How to enable Riot 2FA (MFA) for Valorant, League of Legends and TFT
Riot calls it multi-factor authentication (MFA), and you switch it on once for your whole Riot Account, not per game. Email comes first, Riot Mobile goes on top, and an authenticator app is optional. Here is the exact order, what changes when you sign in, and how to plan for the day you lose the phone or the inbox.
Last checked against official sources on November 1, 2026.
Riot multi-factor authentication at a glance
Each row links to the Riot Games page it comes from.
- Methods Riot offers
- A six-digit email code, Riot Mobile (approve a notification), or an authenticator app such as Google Authenticator, Microsoft Authenticator or Duo. Source
- Where to switch it on
- The Multi-Factor Authentication card on your Riot account page, account.riotgames.com. Source
- Setup order
- Email MFA first. Riot Mobile can only be activated once email MFA is enabled. Source
- At sign-in
- A six-digit code from Riot Mobile or your account email. “Remember this app for 30 days” skips it on a trusted device. Source
- Backup codes
- None described. If the MFA emails go to an inbox you lost, Riot says a Player Support ticket is the only option. Source
- One-time rewards
- VALORANT “Keep it Safer” gun buddy, League Taliyah “Very Cool” emote, 100 TFT Treasure Tokens and a Rare Prismatic Chest in Legends of Runeterra. Source
- Ranked VALORANT
- Ascendant and above, and suspected shared accounts, must verify with Riot Mobile MFA. An authenticator app does not count. Source
- SMS
- Not one of Riot’s MFA methods. Riot’s SMS check is for tournament modes like Clash and Premier, one Riot account per number. Source
How to enable Riot MFA, start to finish
Step 1
Make sure the account email is one you control
Riot sends the setup link and every email code to your account address, and a verified email stops anyone changing your password or email without approval from that inbox. If it is old or shared, fix that first.
Step 2
Open the Multi-Factor Authentication card
Sign in at account.riotgames.com in a browser, find the Multi-Factor Authentication card and click its Enable (or Resend) button. Riot shows a hint of the address it is emailing.
Step 3
Confirm from Riot’s email
Open the Multi-Factor Authentication email from Riot Games (check spam) and press Enable Multi-Factor Authentication. The account page now shows MFA as enabled, and email codes are live.
Step 4
Add Riot Mobile on your phone
Install Riot Mobile from the App Store or Google Play and sign in; a new phone asks for an email code first. On the account page, click Activate next to Riot Mobile, scan the QR code with the QR button in the app, then tap the red Enable button.
Step 5
Allow notifications and watch for the confirmation
Riot Mobile approves sign-ins through notifications, so let it send them. Riot confirms the new method on the website and by email. A confirmation like that when you changed nothing is your cue to secure the account.
Step 6
Add an authenticator app if you want a third option
Riot names Google Authenticator and Microsoft Authenticator, and its rewards page adds Duo. Riot’s FAQ does not show the pairing screens; it sends you to each app’s own help pages instead.
Why Riot MFA is worth a few minutes
A cosmetic in four games
Your first Riot Mobile setup drops a reward in four Riot games at once. Had Riot’s email 2FA on before? You already got them.
Ready for high-rank VALORANT
Ascendant and higher accounts must verify with Riot Mobile before queuing Competitive, so setting it up early avoids a surprise Verify Account button.
Riot’s Terms expect it
Riot’s Terms of Service hold you responsible for losses when you did not do everything reasonable to secure your account, and give enabling multi-factor authentication as the example.
Email, Riot Mobile or authenticator app: which to use
Riot introduced two-factor authentication in 2022 and widened it to three multi-factor methods in 2025. Think of them as layers rather than alternatives.
- Email code. The first method you enable, and required before Riot Mobile. It is only as strong as the inbox, so that mailbox needs a unique password and its own 2FA.
- Riot Mobile. Riot’s companion app. It asks you to approve each new sign-in, can log you in to the Riot Client by QR code, and is the only method that clears ranked verification in VALORANT.
- Authenticator app. Google Authenticator or Microsoft Authenticator, with Duo also named by Riot. Codes are generated on your phone instead of arriving in your inbox.
What signing in looks like with MFA on
After your username and password, Riot asks for a six-digit code from Riot Mobile or your account email. Type it in and the client carries on.
Under the code box sits a “Remember this app for 30 days” checkbox, separate from the one that keeps you signed in. Ticked, that device is not asked again for a month, so use it only on your own PC or phone.
Riot Mobile can skip the typing: choose QR Code next to Sign-in on the Riot Client, scan it in the app and confirm. A confirmation request you did not start means somebody may be trying to get in, Riot warns.
Even with MFA off, Riot adds an MFA check to big changes such as a new email, a new password or a different linked social sign-in. Authentication emails you did not trigger are a warning, not spam.
Riot ID or username: what goes in the sign-in box
A Riot Account has two names. Your username is the private login: only you and Player Support agents can see it, it is unique worldwide, and it cannot be changed outside rare exceptions.
Your Riot ID is the public game name and tagline, like Name#TAG, that friends add. You can change it without affecting how you log in. If the client rejects your details, check you typed the username, not the Riot ID, before resetting anything.
Lost your phone, or lost the email?
Riot’s MFA pages describe no backup or recovery codes, so plan the fallback yourself. Email MFA must be on before Riot Mobile, and Riot says sign-in codes come from Riot Mobile or the account email, so that inbox is your second way in. Keep it protected.
If the MFA emails go to an address you can no longer open, Riot says your only option is a Player Support ticket. Try your email provider’s recovery first, since a working inbox gets you past the code prompt again.
Phone lost or stolen? Once you are signed in, press Log Out Everywhere on the Login Management card, which also strips every device of its trusted status. Then disable Riot Mobile on the account page and activate it again on the new phone. If someone else switched MFA on or changed your email, treat it as a takeover and go to Riot’s account recovery.
What to write down once MFA is on
A lost phone is far less stressful when the details are written down. LoginScout keeps them on one encrypted card per Riot Account:
- Your sign-in username and your Riot ID with its tagline, labelled so you never mix them up.
- The email on the account, and where that inbox’s own 2FA lives.
- Which Riot MFA methods are on, and which phone runs Riot Mobile.
- Linked Google, Apple, Xbox or PlayStation accounts.
- A transaction ID from a Riot receipt, plus roughly when and where you created the account.
Keep going with your Riot account
Valorant account security Ranked verification, Vanguard, region rules and VP scams. League of Legends account security Region transfers, RP scams and Riot’s sharing rules. Valorant account recovery Forgot the username, lost the email or stuck on a code. Recover a hacked Riot account When the password or email was changed without you. How to make a Valorant account A new Riot Account, with MFA from day one. Authenticator codes in LoginScout How LoginScout stores authenticator (TOTP) codes.
Questions people ask
Does Riot have 2FA for Valorant and League?
Yes. Riot calls it multi-factor authentication (MFA). You enable it once at account.riotgames.com and it covers the whole Riot Account, every Riot game included.
Can I use Google Authenticator for Riot Games?
Yes. Riot’s MFA FAQ names Google Authenticator and Microsoft Authenticator, and its rewards page also lists Duo. For ranked verification in VALORANT, though, only Riot Mobile counts.
Does Riot MFA send codes by text message?
No. Riot’s MFA methods are email, Riot Mobile and an authenticator app. The phone number step you may have seen is SMS verification for Clash and Premier, a separate system.
How do I stop Riot asking for a code every time?
Tick “Remember this app for 30 days” under the code field when you sign in, and only on your own PC or phone. It is a different box from staying signed in.
Does Riot give you backup codes?
Riot’s MFA pages do not describe any. Keep email MFA working, since Riot Mobile sits on top of it, and if your MFA emails go to an address you lost, open a Player Support ticket.
Can LoginScout turn on Riot MFA for me?
No. Only you can, from your Riot account page. LoginScout keeps the username, Riot ID, account email and your MFA notes together for the day you change phones or write a ticket.
Sources
Checked against these official pages on November 1, 2026. Platforms change their settings and menus often. If something here no longer matches what you see, email [email protected] and we will fix the page. LoginScout is independent and not affiliated with the companies named here.
- Riot Games Support: Multi-Factor Authentication How-to & FAQ (support.riotgames.com)
- Riot Games Support: Multi-Factor Authentication In-Game Rewards (support.riotgames.com)
- Riot Games: Get rewarded for enabling MFA (riotgames.com)
- Riot Games: Download Riot Mobile (riotgames.com)
- Riot Games Support: Logging into the Riot Client with a QR code (support.riotgames.com)
- Riot Games Support: Protecting Your Account (support.riotgames.com)
- Riot Games Support: Riot Accounts, Social Sign-In, and Player Support (support.riotgames.com)
- Riot Games Support: Social Sign-in FAQ (support.riotgames.com)
- Riot Games Support: Unlinking third party accounts (support.riotgames.com)
- Riot Games Support: Console Access Guide (support.riotgames.com)
- Riot Games Support: Riot Account Names FAQ (support.riotgames.com)
- VALORANT Support: Riot Mobile MFA Verification FAQ (support.riotgames.com)
- Riot Games Support: Tournament Modes SMS Verification (support.riotgames.com)
- Riot Games: Terms of Service (riotgames.com)
Related guides
Keep the identity with the login.
Create a free vault, then upgrade for a private temp mailbox and burner numbers when the library grows.
Google, Apple, Xbox and PlayStation sign-in
Riot accepts Google Sign-In, Sign in with Apple and Facebook Login on desktop; Android offers Google and Facebook, and iOS offers Apple and Facebook. Xbox and PlayStation accounts connect to a Riot Account too, and playing Riot games on console requires one.
Riot documents that changing your linked social sign-in triggers an MFA check, and that one Riot Account can have several social platforms linked. It does not spell out whether a code is requested when you sign in through Google, Apple, Xbox or PlayStation. So give each linked account its own 2FA, because it can open your Riot Account.
Lose the Google, Apple or Facebook account itself and Riot sends you to that company. Review Connected Accounts on the account page, remove strangers with the minus button, and remember a PlayStation account can only be relinked to the Riot Account it was linked to before.