Injustice WBID Account Guide: Securing It Before You Share It

If an Injustice order requires account access, the thing being accessed is your Injustice WBID. Most people handing one over have never thought about what it actually controls, which is the wrong order to do things in. This guide is the part that should happen before any of that.

We run a service that sometimes requires this access, so we have an obvious interest in you feeling comfortable sharing it. Notice that the advice below is mostly about limiting what a service — including ours — can do with it.

What a WBID is

A Warner Bros. ID is the publisher account layer sitting above the game itself. Injustice Mobile uses it to store your progress server-side and tie it to you rather than to a particular handset.

That is what lets you reinstall the game, switch phones, or recover after a factory reset without losing a roster you spent months building. It is a genuinely useful system. It is also, for exactly the same reason, the single point of failure for everything you have accumulated.

The row that matters most is the fourth one, and it is the one almost nobody thinks about.

Secure the email first

This is the step people skip, and it inverts the entire risk picture when done properly.

Before considering any order, make sure the email address your WBID is registered under is one you fully control, can access right now, and has two-factor authentication enabled. If the registered address is an old account you have not opened in years, or one attached to a former employer, or one sharing a password with anything else — fix that before anything else happens.

Why this matters more than the WBID password: if you retain sole control of the recovery email, you can reclaim the account under essentially any circumstance. If you do not, a password change by someone else can lock you out permanently.

Spend ten minutes on this. It is the highest-value thing in this guide.

Before you share it

Assuming your order genuinely requires access, here is the sequence.

1. Confirm it is actually required. Not every order needs credentials. Ask which category yours falls into and why. A seller who asks reflexively, without explanation, has told you something about how they operate.
2. Verify the recovery email is secured, per the section above.
3. Change the WBID password to something temporary and unique — not a variation of anything you use elsewhere, and not something you will keep afterwards.
4. Note what is on the account. Roster, currency, purchase history. You want a record of the starting state.
5. Share nothing beyond the game account. No payment details, no recovery codes for other services, no identity documents. There is no legitimate reason a game service needs any of those, and being asked ends the conversation.

After the work is done

1. Change the password again, immediately, to something permanent and unique.
2. Check for active sessions and sign out of everything you do not recognise, if the option is available.
3. Verify the recovery email is unchanged. If it has been altered, act immediately — that is the one modification that costs you the account.
4. Confirm the account state against the record you took beforehand.

Step three is the one worth being deliberate about. A changed recovery email is the difference between a service that did a job and a service that kept a key.

What sharing genuinely exposes

Being accurate rather than alarming, because both overstatement and understatement are unhelpful here.

What is exposed: your game progress, your purchase history, and the ability to change the account password. If the WBID is linked to other Warner Bros. properties, those become reachable as well.

What is not directly exposed: stored payment card numbers. Storefronts do not surface full card details in account views. This is a real limit on the damage, and it is worth knowing.

What is exposed if you have reused passwords: considerably more than the game. If your WBID password is also your email password, or your password anywhere else, then sharing it shares those too. This is the most common way a contained risk becomes an uncontained one, and it has nothing to do with the seller's intentions.

Credential requests that should end the conversation

Some requests are simply not legitimate, whatever the explanation offered.

• Your email account password. Never required. Ever.
• Two-factor codes beyond a single login. Repeated code requests mean sustained access, not a one-time job.
• Identity documents. No game service needs a passport or driving licence.
• Payment card details given directly rather than through a payment processor.
• A request not to change your password afterwards. Stated plainly, this means retaining access.
• Recovery codes for any service at all.

Each of these has exactly one interpretation. There is no scenario where a request for your email password is anything other than an attempt to take the account permanently.

Recovering a WBID you have lost

If access is already gone, the recovery path runs through the registered email address. Use the official Warner Bros. recovery flow — not a third party offering to do it for you, which is its own category of scam.

If the email itself is lost, recovery becomes a support conversation where you supply whatever evidence you can: purchase receipts, the approximate creation date, device history, transaction identifiers from app store records. Receipts are the strongest evidence because they are independently verifiable.

Success is not guaranteed and the process is slow. Which returns to the point made at the start: securing the recovery email in advance is worth more than every other precaution combined.

The realistic summary

Sharing a WBID is a real trust decision and no amount of process removes that. What process does is bound the damage — it determines whether a bad outcome costs you a game account or costs you your email, and those are very different days.

Secure the recovery email. Use a temporary unique password. Share nothing beyond the game. Change it back afterwards and verify the recovery address survived.

Before any of that, read whether modding is safe at all and how the work actually functions, so you are deciding with the full picture rather than half of it. The scam patterns guide covers what illegitimate credential requests look like.