Epic Pays You to Do the Right Thing
Most companies just recommend two-factor authentication and hope you get around to it eventually. Epic Games did something smarter: it bribed players. Turn on 2FA and you get the Boogie Down emote free in Fortnite, and 2FA becomes a hard requirement to gift items to friends and to enter many competitive tournaments. It is one of the only cases anywhere where enabling real security gets you loot instead of just a warm feeling, and Epic built the incentive because Fortnite account theft was, and still is, a genuine epidemic rather than a rare edge case.
Setting It Up (Five Minutes, One Free Emote)
- Go to epicgames.com and sign in.
- Hover over your display name in the top corner and open Account.
- Click Password & Security.
- Scroll down to Two-Factor Authentication.
- Choose your method. Authenticator App is the strongest choice, with SMS and email as weaker fallbacks.
- For the app method, scan the QR code with Google Authenticator, Authy, or any TOTP app, then enter the six digit code it produces to confirm.
- Save the backup codes Epic displays on screen immediately, since that window does not reopen the same codes later.
The reward lands on its own. Log into Fortnite after enabling any 2FA method and check your locker, where the Boogie Down emote should already be waiting. It is granted once per account for life, so if you turned 2FA on years ago and forgot, you likely already have it sitting there unused.
Picking the Right Method
| Method | Security | Notes |
|---|---|---|
| Authenticator app | Best | Codes generate offline, immune to SIM swaps and email compromise |
| Email codes | Acceptable | Only as strong as the email account behind it, so protect that first |
| SMS codes | Weakest | Vulnerable to phone number hijacking, covered in our SMS 2FA article |
New to authenticator apps generally? The concept takes about two minutes to understand, and our 2FA beginner guide walks through it, while our free code generator shows live TOTP codes right in your browser if you want to see one working before committing to an app.
Why Fortnite Accounts Specifically Get Targeted So Often
- Skins carry real resale value. Accounts holding rare or original seasonal cosmetics, especially early Chapter 1 items that can no longer be obtained any other way, sell openly on gray market sites for serious money.
- The player base skews young, and kids fall for "free V-Bucks generator" sites and account checker tools at a much higher rate than adults, and every single one of those sites exists purely to harvest passwords.
- Reused passwords get hammered constantly. Epic logins face nonstop credential stuffing from old breach lists, since bots simply try known leaked passwords against millions of accounts around the clock.
- Saved payment methods get drained fast. A stolen account buys V-Bucks against the saved card within minutes, often before the real owner has even noticed the login.
- Competitive integrity requirements add a second incentive to steal accounts, since a stolen account with an established competitive rank or tournament history can itself be valuable to someone looking to skip the grind.
One house rule covers most of it in a single sentence: there is no such thing as free V-Bucks, and any site or Discord message offering them wants your password, not your happiness. Pair that rule with 2FA and you have closed off almost every common path into a Fortnite account.
The Part People Forget: Everything Epic Is Linked To
Turning on 2FA at epicgames.com protects the Epic account itself, but that account is rarely standing alone. Under Account, then Connections, check what is linked, since Epic commonly connects to PlayStation, Xbox, Nintendo Switch, and sometimes a Google or Apple account for cross platform play and progress syncing. Each linked platform is effectively another door into the same Epic account, so securing Fortnite properly means securing the console accounts behind it too, covered in our console 2FA guide. A common and easily missed scenario: a player secures their Epic login perfectly but leaves an old, weak, reused password sitting on a childhood PlayStation account that is still linked for cross save progress, and that becomes the actual entry point.
The linked email account matters just as much, since it is Epic's primary recovery path if anything goes wrong. That inbox needs its own real 2FA, not just a memorable password, and our Gmail 2FA guide covers securing the most common provider people use for this. A unique password on the Epic account itself matters too, especially if the one you are currently using has ever appeared anywhere else, which our password generator solves in under a minute. Finally, review active sessions under Account, then Password & Security, and revoke anything you do not recognize, since a stranger's still-active session is worth more to them than your password alone.
If the Account Is Already Gone
- Reset the password immediately through the linked email account, which is the fastest path if the thief has not yet changed it themselves.
- If the recovery email was already changed by the attacker, use Epic's account recovery form at help.epicgames.com and supply as much proof as possible, since original transaction IDs, console link history, and account creation details carry the most weight with support.
- Once you are back in, enable 2FA the same session, sign out of every active session, and unlink any console or platform connection you do not personally recognize.
- Dispute any unauthorized V-Bucks purchases through both Epic support and your card issuer, and do it the same day rather than waiting to see if it resolves itself.
Frequently Asked Questions
I turned on 2FA but the Boogie Down emote never showed up. What is wrong?
The emote is delivered inside Fortnite itself, so log into the game after enabling 2FA and check your locker directly. It occasionally takes a session or two to appear after enabling. It is a lifetime, one time grant per account, so if you already enabled 2FA at some point in the past, you may already have it sitting unused.
Do I actually need 2FA just to gift a skin to a friend?
Yes, and this is intentional on Epic's side. 2FA is a hard requirement on the gifting account specifically because stolen accounts were historically used to launder purchases by gifting stolen currency's spending power to other accounts.
Does 2FA prompt on every single Fortnite login now?
No. Devices and consoles you have already verified once stay trusted, and Epic also lets you mark a device as trusted the first time you confirm the code, so future logins on that device skip the prompt. New codes mainly appear on unfamiliar devices or fresh web logins.
My kid only plays on a Nintendo Switch. Does any of this still matter?
Yes, and this is the part most parents miss. The Epic account behind that Switch login can still be attacked directly through the epicgames.com website regardless of what console the game is actually played on, so enable 2FA through a browser as described above even if the child never touches a computer to play.
What about Rocket League or other games under the same Epic account?
Same Epic account, same protection, no extra setup required. 2FA covers everything tied to that single login, including your entire Epic Games Store library on PC and any other Epic published title you own.
