I am sharing my experience because account theft seems to be happening more often, and the official support process is far less clear than it should be.
My Pokémon GO account was compromised earlier this week.
I played for a while that morning. When I opened the app again at lunchtime, I had been logged out. I tried to sign back in through both Google and Facebook, but received this message:
“Unable to sign in. Please check that this Pokémon GO account exists and that you have correctly selected New or Returning Player.”
At first, I assumed it was a temporary error.
I then used Account Recovery and entered my email address, but it said that no Pokémon GO account was connected to it. When I entered my Trainer name instead, the recovery code was sent to a partially hidden email address that I did not recognise.
That was the moment I realised someone had accessed my account and changed its login details.
It is genuinely distressing to be locked out of an account in which you have invested years of time, money and effort, without knowing what the other person might be doing. I had no idea whether they were changing my details, transferring Pokémon, deleting friends, spending coins or attempting to sell the account.
Contacting support was unnecessarily difficult
Finding the correct support form was harder than it should have been. Many support pages directed me towards in game support, which was useless because I could not access the game.
I eventually submitted a compromised account request through the Pokémon GO support website.
I accidentally submitted more than one request because I did not receive a clear confirmation for the first one. One request was then closed as a duplicate, which created even more confusion. I strongly recommend keeping everything within one support request whenever possible.
Campfire may have helped prove that the account was mine
Thankfully, I was still logged into Campfire.
My Campfire profile continued to display the connected Pokémon GO account. I took a screenshot showing that connection and sent it to Niantic as additional evidence.
Seeing the Pokémon GO profile still connected gave me some peace of mind. At the same time, I had no way of knowing what was happening to my Pokémon, items, coins or friends.
If you are locked out of Pokémon GO but still have access to Campfire, do not log out. Take screenshots of your profile and the connected game account immediately.
The support timeline
Support took an average of around six or seven hours to reply to each interaction.
They eventually confirmed that they could restore the account to either my oldest or longest used login method. They showed me a partially hidden email address and asked me to confirm the complete address and whether I wanted to use Google or Facebook.
I replied immediately and selected Google.
The waiting was probably the worst part.
Even after support confirmed that the account could be restored, I kept wondering what might be happening in the meantime. Had the account been sold? Were rare Pokémon being transferred? Was someone changing the login method again?
Fortunately, I regained access around 24 hours after I first reported the account as compromised.
Everything appeared to be exactly as I had left it. My Pokémon, items, coins, friends and account details were all still there. I almost cried from relief.
I believe Pokémon Trainer Club was the point of entry
I cannot prove exactly how the attacker gained access, but I strongly suspect that my Pokémon Trainer Club login was involved.
I could no longer access my Pokémon Trainer Club account either. The password I had previously used no longer worked, and I received no email warning me that the password, email address or linked account details had been changed.
I contacted Pokémon Support separately about the Pokémon Trainer Club account.
I will not link Pokémon Trainer Club to Pokémon GO again unless stronger security protections are introduced. Changes of this importance should require email confirmation or proper two factor authentication.
Important warning from Niantic
After restoring my account, Niantic warned me that this was the only time they would restore access and that future recovery attempts could be denied.
That makes the situation even more serious.
If someone compromises the account again, Niantic may refuse to restore it a second time. After recovery, I immediately changed my passwords, reviewed the devices connected to Google and Facebook, activated two factor authentication and removed login methods I no longer needed.
Information that may help with recovery
Have the following information ready:
• Your exact Trainer name
• Your Niantic ID
• Screenshots of your Campfire profile
• Your Trainer level and team
• Access to the original email address
• Previous login methods
• Old screenshots
• Purchase receipts
• Devices previously used to access the game
Support may not request every detail, but having the evidence ready can save valuable time.
Do not publish this information publicly. Only send it directly to official support.
What Niantic and The Pokémon Company need to improve
There need to be proper security alerts whenever an email address, password or login method is changed.
There should also be a way to temporarily freeze a compromised account while ownership is verified. Victims should not have to spend hours wondering whether their Pokémon are being transferred or their account is being sold.
The recovery process also needs to be easier to find without access to the game.
I was lucky. I recovered my account within approximately 24 hours, and nothing appeared to be missing. Others may not be so fortunate.
Secure every login method connected to your account, activate two factor authentication wherever possible, keep screenshots and receipts, and be cautious about linking Pokémon Trainer Club until its account security improves.
