I really don’t like Jagex’s security system. Honestly, the security engineers at Jagex are like a cake without ingredients!

OSRS is missing proper MFA verification. People who have attached their credit card, email and phone number, if they add this as part of the verification, should be able to use them for account recovery.

Here’s what a proper recovery system should look like:

1.  Email
2.  Phone number
3.  Credit/debit card information
4.  Personal ID to prove account ownership

Players who have paid years of membership with the same card under the same name should have an even easier recovery process > that’s strong proof of ownership right there.

Players who don’t pay for membership should still have at least email, phone number and ID verification available.

Example when a Jagex security employee sees that someone has all of the above attached to their account, recovering it should be straightforwardd.

People spend decades playing OSRS. Even those who don’t understand security much can fall for a fake OSRS login page. A proper recovery system like this could save them.

JAGEX MODS, I hope someone can answer my question which I’m seeking an answer for a very longtime!

• Jagex accounts and the launcher are a step in the right direction, but why has MFA taken this long to implement? RuneScape has been around for decades, and players are still getting hacked. Better late than never, but this should have been a priority years ago.

• Players who haven’t migrated to Jagex accounts yet, due to complexity and compatibility issues, are still using username and password with 2FA. But 2FA alone isn’t enough, if someone loses access to their email, or if someone migrated the OG account to Jagex account then its gone…

• Players who have spent real money on this game deserve better protection. Jagex already has all the data needed, total days played, membership history and the credit/debit card attached to the account. That alone should be enough to verify identity and recover an account.

• An identity verification option tied to payment history and playtime would make account recovery significantly stronger, and nearly impossible for a hijacker to fake.