How to Secure Your Mobile Legends Account From Hackers and Recover It if It's Stolen
A safe Mobile Legends account has three layers: it’s bound to a Moonton Account with a recovery email only you control, New Device Verification and a Secondary Password are switched on, and the Account Center is free of devices and third-party platforms you don’t recognize. You can set all three up in under ten minutes from Account Settings. This guide covers the order to do it in, what to check every month, and what to do if someone has already taken your account.
Why MLBB Accounts Get Targeted
The 10th anniversary events running until November make “free skin” and “free diamonds” links the most believable phishing bait around. Indonesian outlet Esports.id (February 2026) summarized the three most common routes: fake login pages disguised as giveaways, people posing as admins or sellers who ask for account details, and modded APKs and cheat scripts that slip in a password stealer. Add two habits of players themselves: handing the account to a rank booster, and buying diamonds from sellers who ask to log in. All of these exploit the same gap: an account tied to a single platform with no extra verification.
1. Bind a Moonton Account and Add a Recovery Email
The Moonton Account is the main binding because Moonton handles its recovery directly, not through Facebook or Google.
- Tap your avatar in the top-left corner of the lobby, then open Account Settings.
- Choose the option to link a Moonton Account and register with an active email that only you have access to.
- Open the email from Moonton and activate the account. Until it’s activated, the Moonton Account can’t be used to log in.
- Add a recovery email. This is the route used when you forget your password or need to take the account back.
Use a gaming-only email that has its own two-step verification. Sharing the email with your social media or shopping accounts makes the damage bigger if one of them leaks.
2. Turn On New Device Verification and a Secondary Password
Once the Moonton Account is bound, open the Security section in Account Settings. Two features need to be switched on:
- New Device Verification: every login from an unrecognized device triggers a six-digit code sent to your registered email. Without that code the login fails, even if the thief already has your password.
- Secondary Password: an extra PIN requested for sensitive actions such as sending gifts or changing account settings.
The same screen shows a security score on a scale up to 100. It goes up each time you bind another platform or enable a verification, so aim for 100 before you consider the account safe.
One note: verification codes sometimes arrive late or land in spam. Before you switch phones, make sure your recovery email can be opened from another device so you don’t lock yourself out.
3. Bind More Than One Platform
The Mobile Legends Account Center accepts bindings to a Moonton Account, Google Play, Facebook and VK, plus Apple Game Center on iOS. Bind at least two besides Moonton. If one platform has a problem, for example an old Facebook account you can no longer open, you still have another way to log in, and Moonton support has more proof of ownership to match.
4. A Genuinely Strong Password and Email
- A Moonton Account password must contain letters and numbers. Don’t stop at the minimum: use 12 to 16 characters with upper and lower case letters, numbers and symbols, and never reuse a password from another service.
- Change your password in Account Settings under Change Password. The system sends a code to your registered email before the new password can be saved.
- Turn on two-step verification for the email itself. A thief who gets into your email can reset the Moonton password and receive the new device verification codes at the same time.
5. Clean Up the Account Center Every Month
Open Account Settings, then Account Center. The two most important buttons:
- Sign Out All Devices: ends every active login session. Use it after lending your phone, after selling an old phone, or whenever you see a device you don’t recognize.
- Disconnect Third Party Account: removes Facebook, Google Play or VK bindings that aren’t yours. If you have ever bought an account or used a rank booster, check this first, because a third-party binding owned by someone else means that person can still get in at any time.
Make it a monthly habit: review the connected devices and platforms, and disconnect anything you don’t recognize.
6. Don’t Hand Your Account to Anyone
This is the cheapest protection and the one most often ignored.
- Rank boosters need full access to your account. When they’re done there’s no guarantee their session is really gone, and third-party bindings can be added quietly.
- “Top up via login” at prices far below market works by logging in to your account and buying diamonds with a problematic card, or filing a fake refund with Google or Apple. Garudaku (February 2026) reported that once the transaction is reversed, the diamonds are pulled back and the account balance can go negative, with a Ranked ban until the difference is paid. Moonton has never officially detailed the sanction, but the reports are consistent.
- A real top up only needs your User ID and Zone ID, the two numbers shown under your nickname in the format
12345678 (1234). If you need diamonds for anniversary skins, top up through a page that only asks for those two numbers, never a password: Indonesia, Malaysia or Philippines, matching your account’s country. For the skins that really are free this season, see our guide to the MLBB 10th anniversary free skins so you’re not tempted by “claim your skin” links from outside the game.
If Your Account Has Already Been Stolen
The order matters, because every minute the thief is still inside, they can add new bindings.
- Change your Moonton Account password from your device, or use the forgot password option if it has already been changed.
- Sign Out All Devices in the Account Center, then Disconnect Third Party Accounts you don’t recognize.
- If you can’t log in at all, open the game to the login screen, tap the headset icon (customer service), choose the account issues category, then account recovery, and fill in the form.
- Prepare the details Moonton support usually asks for: nickname and server, User ID and Zone ID, the approximate account creation date, account level, number of heroes and skins, the devices you normally use, and proof of your first top up. According to Indonesian outlets Selular (November 2025) and VCGamers (August 2026), proof of a diamond purchase is the strongest verification in hijacking cases, so keep your top up invoices even for small amounts.
- Don’t report through social media accounts claiming to be “Moonton admin” in your DMs. The only official routes are in-game customer service and Moonton’s official channels.
MLBB Account Security Checklist
| Step | Menu | How often |
|---|---|---|
| Bind a Moonton Account + recovery email | Account Settings | Once, now |
| New Device Verification + Secondary Password | Account Settings, Security | Once, recheck when you change phones |
| Bind 2 extra platforms | Account Center | Once |
| Security score = 100 | Account Settings, Security | Check monthly |
| Sign Out All Devices | Account Center | Monthly and after lending or selling a phone |
| Disconnect unknown third parties | Account Center | Monthly |
| Keep top up invoices | Every transaction |
Menu names follow the English Mobile Legends client. Button positions can shift slightly between versions, but everything lives inside Account Settings.
Once every row in the table is ticked, only one risk is left: you handing over the account yourself. As long as you top up with just your User ID and Zone ID, nobody outside needs to know your password.
