Step 3 of 5

Accounts, email and what you hand over

An account is the part of a game that outlives your computer. This step is about setting one up so that you keep control of it, and about understanding what the publisher learns in the process.

What an account actually is

When you create an account with a game publisher, you are asking a company to keep a record about you on its own servers. That record holds a login name, an email address, a stored form of your password, and everything the game knows you have earned, built or bought. It is not stored on your computer, which is why you can sign in from a different machine and find your things where you left them.

Two consequences follow. The first is that losing access to the account means losing everything in it, and the usual way people lose access is by losing control of the email address attached to it. The second is that the account is a relationship with a company, governed by that company's terms, and continuing for as long as both sides keep it. Treat it with roughly the seriousness you would give a loyalty account at a retailer: not a banking login, but not nothing.

Choosing the email address

Decide which address the account will use before you start, not in the middle of a sign-up form. Three considerations, in order of how often they cause trouble.

Can you get into it in two years? An address from an old internet provider, a former workplace or a school is the wrong choice, because access to it tends to end without warning. Account recovery almost always runs through email, so an address you have lost is an account you have lost.

Who else reads it? A shared family address means everyone in the household can reset the password on that account. Sometimes that is exactly what you want — a parent holding recovery for a younger player's account is reasonable — and sometimes it is not. Decide deliberately.

Do you want this mail mixed with the rest? Game publishers send operational mail and, if you allow it, promotional mail. Some people use a separate address for hobby accounts purely to keep their main inbox quiet. That is a preference, not a security measure.

Passwords, passphrases and the second factor

Use a different password for this account than for your email. That one habit does more than any other single measure, because it stops a password exposed in one place from opening the account that controls recovery for everything else.

Length matters more than symbols. A passphrase made of several unrelated words is both easier to remember and harder to guess than a short string with a capital letter and an exclamation mark bolted on. The Australian Cyber Security Centre, the federal government body that publishes free cyber security guidance for the public, sets out its current advice on passphrases and on password managers on its own site, and it is worth reading there rather than in a paraphrase.

If the publisher offers two-factor authentication — a second step at login, usually a code from an app or a message — turn it on. It means that a stolen password alone is not enough to get into your account. It also means you need a plan for what happens if you change phones, so save any recovery codes the publisher gives you somewhere outside the account itself.

The sign-up sequence, in general terms

Sign-up pages differ in layout and wording, so what follows is the general shape rather than a walkthrough of any particular company's screens. Nearly every online game follows this sequence.

Visit the Crossout website Paid affiliate link. Quiet Concept's publisher receives a commission if an account is created and confirmed after this link is followed. The sequence described above is the ordinary one for any publisher and was not written to suit that arrangement.

Why the confirmation email matters

The message that arrives after you register is not a formality, and it catches people out because they close the browser before it appears.

Confirming an address proves to the publisher that the address exists and that you can read it. That is what makes account recovery possible later, and it is the reason an unconfirmed account often cannot do very much: it may not be able to sign in, join a match, or receive a password reset. If you register and then cannot work out why nothing happens, an unopened confirmation email is the first thing to check, including in the spam or junk folder.

It is also worth signing in at least once immediately after confirming. An account that was created, confirmed and then never used sits in an odd state, and problems are far easier to sort out in the ten minutes after you make it than six weeks later.

Messages that pretend to be the publisher

Once an address is attached to a game account, it may receive messages claiming to be from that publisher. Most are genuine. Some are not, and the fraudulent ones follow a recognisable pattern: a warning that the account will be closed, an offer of items, or a notice of suspicious activity, each with a link to a page that asks for your password.

The general defence is the same for any online account. Do not sign in through a link in an email; open the publisher's site the way you normally do and sign in there. If an offer seems unusually generous, treat that as a reason for suspicion rather than excitement. Scamwatch, operated by the National Anti-Scam Centre, publishes current information about scams in Australia and takes reports, and is the right place to look if something seems off.

This is ordinary caution about email, not a suggestion that anything has happened to you. Nothing on this page can tell you anything about your own accounts.

Reading the publisher's privacy terms

Every publisher has a privacy policy, and nobody reads them end to end. You can get most of the value in five minutes by looking for four things.

What is collected. Beyond the account details you typed, online games typically record technical information about your device and your sessions. The policy should say so.

Who else receives it. Look for the section about third parties, service providers and advertising partners. This is where policies differ most.

Where it is stored. Game publishers are frequently based outside Australia, so personal information often leaves the country. A policy should tell you that it may.

How to ask for a copy or deletion. There is usually a contact address or a form for this. Note it now, while you are calm and curious, rather than later when you want something done.

In Australia, the Office of the Australian Information Commissioner is the national privacy regulator and publishes guidance about the Australian Privacy Principles and about complaints. Whether a given overseas publisher is covered by Australian privacy law depends on circumstances we cannot assess for you; the OAIC's own material is the place to start. Quiet Concept's own handling of information is set out in our Privacy Policy, which is short because this site collects almost nothing.

Shared computers and younger players

On a shared machine, decide who the account belongs to and who holds recovery. The common arrangement in a household with a teenager is that the young person uses the account and an adult controls the email address it was registered with. That is a conversation to have at the start, because changing a registered address later is more fiddly than setting it correctly once.

Publishers also set minimum ages in their terms, and those ages differ between companies and countries. Check the actual terms of the game in question rather than assuming a number. The eSafety Commissioner, Australia's independent regulator for online safety, publishes free material for parents and carers about online games, communication features and reporting, and is more useful than general advice from us.