Account Security Tips: Protecting Your Progress
By Expos.GG Team · 2026-01-29
Protect your OSRS account from hackers and phishing with these essential security measures and best practices.
Why Security Matters
Accounts get stolen every day. Years of progress can vanish instantly. These tips keep you safe.
Essential Security Measures
1. Authenticator
What It Is: A phone app that generates codes for login.
How to Set Up: 1. Download Google Authenticator or Authy 2. Go to RuneScape account settings 3. Enable Authenticator 4. Scan QR code 5. Save backup codes!
Why Essential: - Blocks most hijacking attempts - Even with password, they can't log in - Takes 30 seconds to set up
2. Two-Factor Email
What It Is: Authenticator on your email too.
Why Essential: - Email access = account access - Hackers target email first - Double protection
3. Bank PIN
What It Is: 4-digit code to access your bank.
How to Set Up: - Talk to banker - Set unique PIN - Remember it!
Why Essential: - Last line of defense - 7-day delay to remove - Saves your items
4. Unique Password
Best Practices: - 12+ characters - Mix of letters, numbers, symbols - Not used anywhere else - Not related to username
Password Manager: - Use one (Bitwarden, 1Password) - Generate random passwords - Never forget them
Common Attacks
Phishing
What It Is: Fake websites/emails that steal credentials.
Red Flags: - "Double XP weekend" links - "You've won a giveaway" - Fake Jagex emails - Misspelled URLs (jagax, runecsape)
Protection: - Only use official site - Check URL carefully - Never click email links - Jagex doesn't email for password
Fake Streamers
What It Is: "Quitting streams" with fake giveaways.
How They Work: - Stolen/fake Twitch accounts - "Enter to win billions" - Links to phishing sites
Protection: - Official streamers don't do this - If it seems too good, it is - Never enter credentials
Recovery System Abuse
What It Is: Using personal info to recover accounts.
Information They Need: - Creation date - ISP history - Payment info - Previous passwords
Protection: - Don't share account history - Don't share real name - Create with VPN (controversial)
Social Engineering
What It Is Tricking you into giving up info.
Common Tactics - "I'm a mod, give password" - Friends asking for info - "Doubling money" scams - Fake trust trades
Protection - Jagex never asks for password - Real friends don't need your info - If in doubt, don't do it
Recovery Email
Set It Up - Different from login email - Has 2FA enabled - You control it
Why Important - Backup access method - Notification of changes - Recovery option
What to Do If Hacked
Immediate Steps 1. Change email password FIRST 2. Change RuneScape password 3. Remove old authenticator 4. Add new authenticator 5. Scan for malware 6. Check account settings
Contact Jagex - Submit recovery if locked out - Check for unauthorized changes - Report the incident
Prevention - Figure out how it happened - Fix the vulnerability - Learn from it
Regular Checkups
Monthly Tasks - Check login history - Verify email is correct - Test authenticator works - Change password if shared
Yearly Tasks - Update passwords - Review account security - Check connected accounts
Red Flags
Be Suspicious Of: - Anyone asking for account info - Links in game/Discord - "Free" offers - Sharing accounts - Real-world trading sites
Summary Checklist
- [ ] Authenticator enabled - [ ] Email has 2FA - [ ] Bank PIN set - [ ] Unique password - [ ] Recovery email set - [ ] Know the scams
Secure Your Investment
Your account is valuable. Protect it like you would anything else of value.
