[2022] Riot Account Security

Hi!

The only reason you would be getting login code emails is if someone has guessed your username and password, and is either attempting to log into the account management portal with your username and password or you have multi-factor authentication enabled and they are trying to log into the game.

I know you mentioned elsewhere in the thread you've already changed your password, so it may be possible that these are just emails that are 'queued' , but it's unlikely.

Over the past few days we've significant increases in accounts being blocked from logging in due to MFA, to the point where it looks a lot like previously compromised accounts, like yours, have enabled MFA and have stopped automated attackers from actually being able to log in to the account, but because the username and password are the same, the attackers are just getting stuck over and over on the MFA screen, which sends you a token.

I wanna be clear: This is how it is supposed to work and is exactly what we were hoping for when we enabled MFA - that account holders that were using a compromised account, but did not know it, would enable MFA and lock out the people who compromised them. However, the email volume is not so intended. Either way, if you are getting these emails, it means that someone has your username and password, somewhere. If you still see them even after disabling MFA (which you should not do in this situation), it's probably just a lingering effect that will go away.

If you could please send me your Riot Account ID (it looks like this: Riot danhonks#NVB94) in DM, I can take a look at your account specifically to make sure that there's nothing funky going on with the p/w reset.

In the mean time, we are also deploying changes to modify how we block MFA attacks to make it so that players who are seeing a high volume of emails due to automated attacks see less of that.