MFA useless
My Riot Games account had already been compromised once before, but I managed to recover it through Riot’s account recovery system without much trouble. Some of my other accounts were also targeted around the same time, some successfully and some not, but that’s not really relevant here. Today (August 19, 2026), someone successfully gained access to my Riot account. They changed the original email address linked to the account, changed my username, and most importantly, removed the Microsoft Authenticator two-factor authentication that I had enabled. What doesn’t make sense to me is how this was even possible. The entire point of enabling 2FA is to prevent this exact kind of situation. Yet in less than 10 minutes, the attacker was somehow able to remove my authenticator, change the account email, and take control of everything. From my perspective, all of these changes were approved by Riot’s own security system, even though my account was protected with 2FA. I simply don’t understand how someone could disable my 2FA and take over the account so quickly without any additional verification.