Riot MFA Guide: How to Set Up, Get Rewards, and Fix Problems
Riot MFA (multi-factor authentication) adds a second check to your Riot account login: after the password, you confirm with an email code, a Riot Mobile notification or an authenticator app code. You turn it on at account.riotgames.com in a few minutes. In Valorant, Riot Mobile MFA is required for Competitive once an account reaches Ascendant or higher.
What is Riot MFA?
Think of it as a second lock on the one login that opens every Riot game you play. League, Valorant, TFT and the rest all sit behind the same Riot account, so a stolen password used to mean losing all of them at once. With MFA on, the password alone isn’t enough: whoever signs in also has to pass a check that only you can complete.
Riot offers three ways to do that check. Pick one. All are described on its MFA support page (last updated May 15, 2026):
| Method | How you confirm | Good for |
|---|---|---|
| A code sent to the account’s email address | Everyone; it’s the required first step | |
| Riot Mobile | A notification in the Riot Mobile app that you approve | Fastest login, needed for Valorant ranked at Ascendant+ |
| Authenticator app | A code from Google Authenticator or Microsoft Authenticator | People who already use one for other accounts |
One detail surprises people: you can’t start with Riot Mobile or an authenticator. Email MFA comes first. That order makes sense once you think about recovery: the verified email is what gets you back in if you lose the phone.
Why does Riot MFA matter so much?
Because the account is worth more than it looks. Years of skins, champions and ranked history sit behind one email and one password, and passwords leak: reused on an old forum, typed into a fake “free RP” site, saved in a browser on a shared PC. Do you use the same password anywhere else? Then assume someone, somewhere, has it.
With a second step, a leaked password is just a string of characters. The attacker gets to the code screen and stops there, while you get an alert (an email code or a Riot Mobile request you never asked for) that tells you to change the password. That early warning is half the value of MFA, and it costs nothing.
How do you turn on Riot MFA?
From a browser, not from inside a game. The whole thing takes about as long as a loading screen.
- Go to account.riotgames.com and sign in.
- Find the Multi-Factor Authentication card on the account page.
- Click Enable. Riot sends an email to the address on the account.
- Open that email and click the Enable Multi-Factor Authentication button.
- You land back on the account page with email MFA active.
If the email doesn’t arrive, check the spam folder, then check which address the account actually uses. That second one matters more than you’d think (old school emails and long-dead Hotmail addresses are a classic), and it’s covered further down.
How do you set up Riot Mobile?
Riot Mobile is the free Riot app for iOS and Android, and it turns the second step into a single tap.
- Install Riot Mobile and sign in. On a new phone, the first sign-in asks for your email MFA code.
- On the account page in your browser, click Activate next to Riot Mobile. A QR code appears.
- In the app, tap the QR code button and scan the code on your screen.
- Tap the red Enable button when the app asks to turn on MFA.
- The app confirms that Riot Mobile is enabled. From now on, sign-ins send an approval request to your phone.
Honestly, if you play ranked Valorant at a high level, just do this now. You’ll need it anyway (see the ranked section below), and approving a notification is quicker than typing a code every time.
Can you use Google or Microsoft Authenticator?
Yes. Riot supports Google Authenticator and Microsoft Authenticator as a method, with setup steps in their own support articles. You add the Riot account in the authenticator app, and from then on it shows a code that changes every few seconds, which you type at login.
The catch is Valorant ranked. Riot’s Valorant FAQ says ranked verification needs Riot Mobile MFA specifically; an authenticator app protects the account just as well, but it doesn’t count for the Competitive requirement. If you play League or TFT only, an authenticator is a perfectly good choice.
Is Riot Mobile required for Valorant ranked?
For some players, yes. Riot Mobile MFA is required to play Competitive for accounts ranked Ascendant or above, and for accounts that Riot suspects are shared between people. Once an account reaches Ascendant, the requirement stays, with no expiry, even if the rank drops later.
| Region | Requirement in force from |
|---|---|
| BR, KR, LATAM, NA | October 28, 2025 |
| EU | January 21, 2026 |
| APAC | February 18, 2026 |
The dates come from Riot’s Valorant FAQ on Riot Mobile MFA verification, updated May 23, 2026. Riot’s stated aim is fewer smurfs and shared accounts in high-rank lobbies, which is why a phone-based method is required rather than a code anyone could pass along. Want to know how rare Ascendant is? Our Valorant rank distribution shows the share of players in each tier.
Do you have to enter a code every time?
No. Not on your own PC, anyway. When you confirm a login, you can tick “Remember this app for 30 days,” and that device won’t ask again for a month. Use it on your own PC, never on a shared or public one.
A new device, a reinstalled system or a cleared browser will ask again, which is the point. Put simply, MFA should bother you on new machines and stay quiet on your own.
How do you turn off two-step login?
On the account page, find the Multi-Factor Authentication card and click Disable. Riot itself warns that this removes a major layer of protection, and we’d say the same. Real talk: the only good reason to switch it off is a short, deliberate change, like moving to a new email, and then switching it straight back on.
Common Riot MFA problems and fixes
Most issues come down to the email address or the phone. Rarely anything else.
- Codes go to an old email. MFA uses the address on the account. Change it on the account page first (Riot verifies the change), then enable MFA.
- The code never arrives. Check spam and any email filters, wait a minute, and request a new code rather than spamming the button.
- Riot Mobile notifications don’t show. Allow notifications for the app in your phone settings and make sure you’re signed in to the right Riot account in the app.
- You get codes you didn’t ask for. Someone has your password. Change it now, keep MFA on, and check the account’s email address.
- Lost phone. Sign in with email MFA if it’s still on, then remove the old phone and activate Riot Mobile again on the new one. If you can’t get in at all, contact Riot Support.
If you’ve already lost access, our guide to Riot account recovery covers the steps and what support asks for.
Should you use Riot MFA on a bought account?
Yes, and do it in the right order. When you buy an account from us, the email isn’t verified, so the first job is to set your own email and a new password, as the welcome email explains. After that, enable email MFA, then Riot Mobile or an authenticator. Turning on MFA before the email is yours would send every code to an address you don’t control, which is exactly what you want to avoid.
For what it’s worth, this is also part of how our warranty works: changing the email and password before the first game is one of the conditions in our Terms. MFA is the natural next step after that. And if you’re still choosing, our guide to creating a LoL account covers making a fresh one from scratch.
Look, it costs five minutes once. It saves you from the worst kind of support ticket, the one that starts with “someone changed my email and I can’t get in”. Turn on email first, add Riot Mobile, tick “remember” only on your own PC, and your Riot MFA setup is done.
FAQ
How do I enable Riot MFA?
Sign in at account.riotgames.com, click Enable on the Multi-Factor Authentication card, then click the Enable Multi-Factor Authentication button in the email Riot sends you.
Which login methods can I use?
Email codes, Riot Mobile notifications, and codes from Google Authenticator or Microsoft Authenticator. Email MFA must be enabled before the other methods.
Is Riot Mobile required for Valorant ranked?
Yes for accounts ranked Ascendant or above and for accounts suspected of being shared. Authenticator apps do not count for this requirement.
Do I need a code every time I log in?
No. You can tick “Remember this app for 30 days” on a trusted device, and it won’t ask again for that period.
Can I switch off two-step login?
Yes, with the Disable button on the Multi-Factor Authentication card of your account page, though Riot warns it removes a major layer of protection.
Do I get rewards for enabling Riot MFA?
Riot has offered in-game rewards as thanks for enabling MFA. The specific items depend on the game and the current offer, so check Riot Support for the details.
