Protect OSRS Account: Hacks, Rollbacks, Lost Progress

Updated 7 November 2026 · Standard formula, shown below

This guide shows you how to secure your Old School RuneScape (OSRS) account against hacking, rollbacks, and lost progress. You’ll learn concrete steps to lock down your login, safeguard your authenticator, and back up your game data, so a compromised email or a phishing link doesn’t cost you years of progress.

What You’ll Need

Access to the email address associated with your RuneScape account
A mobile phone (for the authenticator app or SMS)
A password manager (recommended, but not required)
Your OSRS login name or email

Step-by-Step

Secure your email account first. Your RuneScape account is only as safe as the email linked to it. Enable two-factor authentication (2FA) on your email provider (Gmail, Outlook, etc.). Use a unique, strong password that you don’t use anywhere else. If your email is compromised, an attacker can reset your OSRS password and disable your authenticator.
Enable the Jagex Authenticator on your OSRS account. Log in to the official RuneScape website, go to Account Settings, then Authenticator. Follow the prompts to set up the authenticator app (Google Authenticator, Authy, etc.). This adds a time-based one-time password (TOTP) that changes every 30 seconds. Never share this code with anyone, and never enter it on a third-party website.
Set up a bank PIN in-game. In OSRS, go to any bank booth and select “Bank PIN” from the banker’s menu. Choose a 4-digit PIN that you can remember but is not obvious (avoid birthdays, years, or sequences). This PIN is required to access your bank, and it provides a crucial delay if your account is hijacked. Do not write it down in a note on your computer or phone.
Use a unique, strong password for your RuneScape account. Your password should be at least 12 characters long, mixing uppercase, lowercase, numbers, and symbols. Do not reuse passwords from other sites. Use a password manager to generate and store it. Change it periodically, especially if you suspect any unusual activity.
Never click links from unofficial sources. Phishing is the most common way accounts are compromised. Always navigate to the RuneScape website by typing the URL directly (runescape.com) or using a bookmark. Check the URL carefully—look for “runescape.com” and not variations like “rune-scape.com” or “runescape-login.com”. Jagex will never ask for your password or authenticator code via email, Discord, or Twitch.
Check for active sessions and linked accounts. On the RuneScape website, go to Account Settings and look for “Linked Accounts” or “Connected Accounts”. Remove any that you don’t recognize. Also check “Active Sessions” or “Recent Logins” to see if any unknown devices have accessed your account. If you see something suspicious, log out all sessions and change your password immediately.
Enable backup codes and write them down securely. When you set up the authenticator, Jagex gives you backup codes. Store these in a safe place (like a password manager or a physical safe). If you lose your phone, these codes are the only way to regain access without going through a lengthy recovery process.
Keep your recovery questions updated. In Account Settings, review your recovery questions and answers. Make sure they are accurate and not guessable. If you’ve changed your email or phone number, update them so that recovery is possible if you ever need it.
Do not share your account. Account sharing violates the rules and is a common way accounts get compromised. Even if you trust the person, they might fall for a phishing scam, or their device might be infected. Keep your credentials to yourself.
Use a VPN on public Wi-Fi. If you play OSRS on public networks (coffee shops, airports), use a reputable VPN to encrypt your traffic. This prevents attackers on the same network from intercepting your login data. However, note that using a VPN with a different IP might trigger a security check, so be prepared to enter a code sent to your email.

Common Mistakes

Using the same password everywhere. If one site you use is breached, attackers will try that password on your RuneScape account. Always use a unique password.
Disabling the authenticator for convenience. Some players turn off the authenticator when they switch devices. This leaves your account vulnerable. Keep it on at all times.
Ignoring email alerts. Jagex sends emails for login attempts from new devices. If you ignore these, you might miss a hijacker trying to get in. Check your email regularly and act on any alerts.
Clicking on “Double XP” or “Free Gold” links. These are almost always phishing scams. Never enter your credentials on a site that isn’t the official RuneScape website.
Not logging out after playing on a shared computer. If you use a library or friend’s computer, always log out completely. Also clear the browser cache and cookies.

Tips

Use a separate email for your RuneScape account. This isolates your gaming account from your personal email, reducing the risk of cross-contamination if one is compromised.
Take screenshots of your stats and bank. While this doesn’t prevent a rollback, it gives you evidence of your progress in case you need to contact Jagex support for a rollback claim.
Keep a record of your account creation details. Knowing the exact date you created your account, the original email, and other details can help you recover your account if you are locked out.
Enable two-factor authentication on any linked accounts (like Steam or Google). If you log in through a third-party, secure that account as well.
Regularly review your account security settings. Make it a habit to check your linked accounts, active sessions, and recovery questions every few months.

Troubleshooting

What if I think my account has been hacked?

Immediately try to log in and change your password. If you can’t, use the “Forgot password” link on the RuneScape website.
If you cannot recover your account, go to the RuneScape support page and file an account recovery request. Provide as much information as possible, including your creation date, previous passwords, and any payment details (if you’ve ever bought membership).
Check your email for any suspicious activity. If your email is compromised, secure it first.

What if I lost progress due to a rollback?

Rollbacks are rare and usually happen due to a server issue. If you believe you’ve lost progress, contact Jagex support via the official website. Provide screenshots or video evidence of your previous stats and bank.
Be aware that Jagex may not be able to restore progress in all cases. Prevention is the best strategy.

What if I lost my authenticator code?

Use your backup codes to log in. If you don’t have them, you’ll need to go through the account recovery process.
Once you’re in, disable the authenticator and set it up again with a new app.

Frequently Asked Questions

Q: Can Jagex refund items lost to a hack?
A: Jagex generally does not refund items lost due to a hack, especially if you were compromised. They may restore accounts in cases of a server rollback, but not for player-caused security breaches.

Q: Is the authenticator mandatory?
A: No, but it is strongly recommended. It adds a significant layer of security that makes it much harder for attackers to access your account.

Q: What should I do if I get an email from “Jagex” asking for my password?
A: Delete it immediately. Jagex will never ask for your password via email. Report it as phishing to your email provider.

Q: Can I play OSRS without an authenticator?
A: Yes, you can. But you are at a higher risk. If you choose not to use one, ensure your email is extremely secure and you have a strong, unique password.

Q: How do I know if my account has been compromised?
A: Signs include items missing, bank PIN reset, unfamiliar logins in your account settings, or being logged out unexpectedly. If you notice any of these, secure your account immediately.

Q: Does using a VPN get me banned?
A: No, using a VPN is not against the rules. However, it may trigger a security check, and you might be asked to verify your login via email.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.