Creating and securing an account

The short version. Registration for an online game usually means an email address, a password and a confirmation link. Spend the extra three minutes on a unique passphrase, a second authentication factor and a look at the privacy settings, because a game account gathers value over time and becomes worth stealing.

An account in a persistent online game is not a login. Over months it accumulates earned parts, purchases, a match history and a name other players recognise. That is exactly the profile that makes game accounts a steady target for credential theft, and the protections that matter are all available on the day you register.

What registration asks for

The usual sequence is short. A publisher asks for an email address, a password and a display name, sometimes a date of birth, and sometimes a country. The email address is the recovery route for the account, so it should be one you control and expect to keep. The display name is visible to other players in matches, so it should not be your full name, and it should not be a name you use for anything that matters elsewhere.

Date of birth is generally used to determine which features and content are available to the account. Entering it accurately is the sensible course, particularly on an account used by a young person, because the restrictions attached to it are the ones intended to apply.

The email confirmation step

Most publishers send a confirmation link before the account becomes fully usable. This serves two purposes: it establishes that the address exists and belongs to whoever registered, and it gives the publisher a verified route for password resets and security notices. An unconfirmed account frequently has reduced access, and an account with an address you cannot open is an account you will eventually lose.

The confirmation message is also the shape most commonly imitated by phishing. Two habits handle nearly all of it. Confirm the account immediately after registering, so that a message arriving days later is inherently suspicious. And when a message asks you to sign in, reach the site by typing the address or using your own bookmark rather than by following the link in the message.

Choosing a passphrase

The Australian Cyber Security Centre, part of the Australian Signals Directorate, publishes guidance for individuals on account security that recommends long, unique passphrases rather than short complicated passwords. Its material is short and worth reading directly; the practical points that follow from it are these.

Length beats complexity. A passphrase of several unrelated words is easier to remember and harder to guess than a short string of substituted characters.
Uniqueness matters more than either. A password reused from another service is only as safe as the weakest place you have used it, and a game account is often where reuse is discovered.
A password manager removes the trade-off. It stores a different long passphrase for every account, so you are only remembering one.
Never reuse the password of the email address attached to the account. That address is the recovery route, which makes it the more valuable of the two.

Adding a second factor

Multi-factor authentication requires something in addition to the password, typically a code from an authenticator application on your phone. Where a publisher offers it, switching it on is the single most effective thing available in the account settings, because it means a stolen password on its own is not enough.

Find the security section of the account settings, usually on the publisher's website rather than inside the game client.
Prefer an authenticator application over codes sent by SMS where both are offered, since SMS can be intercepted or redirected.
Save the recovery codes somewhere that is not the phone generating the codes. A printed copy in a drawer is a perfectly good answer.
Protect the email account the same way. Multi-factor authentication on the game and not on the recovery address leaves the easier door open.

What the publisher learns about you

Registering creates a relationship in which a company holds personal information about you: at minimum an email address, and in practice also an IP address, device details and a record of how you play. Game publishers are frequently based outside Australia, which means the information may be stored or processed overseas.

The Office of the Australian Information Commissioner is Australia's privacy regulator and publishes guidance on the Australian Privacy Principles, on access and correction rights, and on making a privacy complaint. Before you register anywhere, the publisher's own privacy policy will tell you what is collected, why, and where it is held; the OAIC's material tells you what you are entitled to ask for. If you want to know what this site itself collects, the answer is on our privacy policy and the short version is that we operate no form and set no cookie.

Other players, chat and reporting

Team-based matches involve strangers, voice or text chat, and the behaviour that follows. Learn where the mute and report controls are before you need them, not during the match in which you need them. Publishers generally provide both, and using the in-game report is what puts behaviour in front of the moderation team.

For serious cases, Australia has a regulator. The eSafety Commissioner is the national online safety regulator and operates complaints schemes for material such as serious adult cyber abuse and child cyberbullying, alongside guidance for parents about online games. Its site explains which schemes exist and what each one covers, which is the detail worth reading before deciding where a complaint belongs.

Offers that arrive by message

Once an account has any value, offers start arriving. The recurring patterns are worth recognising in advance.

Free currency or parts in exchange for signing in. The sign-in page is the point of the exercise. No legitimate promotion needs your password.
Trades arranged through an outside chat app. Anything conducted outside the game's own systems sits outside the publisher's rules and outside most avenues of recourse.
Account buying and selling. Usually prohibited by the terms of service, and the account can be recovered by its original owner afterwards.
Urgent messages about a suspension or a violation. Urgency is the tool. Close the message and sign in through your own bookmark to check whether anything is actually wrong.

Scams of this kind can be reported to Scamwatch, which is run by the National Anti-Scam Centre and publishes current warnings alongside its reporting form.

The first ten minutes

Register with an email address you control and expect to keep.
Set a long, unique passphrase stored in a password manager.
Open the confirmation message and complete the confirmation straight away.
Switch on multi-factor authentication and store the recovery codes offline.
Choose a display name that is not your real name or a name reused elsewhere.
Read the privacy policy far enough to know where the data is held.
Find the mute, block and report controls before your first match.
Leave the payment method off the account until you have read Step 2.

Where this goes next

The account is secure and the game runs. The remaining question is one for households rather than for individuals: who in the home is playing, what the classification says about the title, and what arrangement stops a shared computer becoming a shared bank card.

Step 5: classification and household rules covers how classification works in Australia, how to look a title up, and the conversation worth having before anyone links a payment method.