Step 4 of 5

Step 4 — Registering, confirming an email address and signing in

Almost every online game asks the same three things of a new player: make an account, prove the email address is yours, then sign in. This step covers all three in general terms, so the advice holds whichever game you choose.

Why a game wants an account at all

Step 1 explained that an online game is a service running on somebody else's servers. The account is how that service knows which progress, which vehicles and which purchases belong to you. Without it there is nowhere for your side of the game to live.

The email confirmation serves a narrower purpose. It establishes that the address typed into the form is an address you can actually open, which matters mostly on the day you need to recover the account. An unconfirmed address is a locked door with no key behind it.

The three actions — register, confirm, sign in — are also, as it happens, the point at which this site's own commercial arrangement takes effect. If you reach a game through one of our affiliate links and complete those actions, we are paid. That is said here rather than buried, and it does not change a word of the advice below.

Choosing the email address first

Decide the address before you open the registration page, not while you are looking at it. There are three reasonable options and one poor one.

Your ordinary personal address is fine and is what most people use. It means the recovery messages arrive somewhere you actually read.

A separate address used for hobby accounts is tidier. It keeps game newsletters away from the mailbox where your bills arrive, and it limits what a breach at a game company reveals about the rest of your life. The cost is that you have to remember to check it.

An address you share with the household works where a parent needs visibility over a young player's account, which is the common arrangement when the player is a minor.

The poor option is the address you use for internet banking or for your main identity provider. Not because a game is dangerous, but because reusing that address spreads it to more places than it needs to be. The Australian Cyber Security Centre publishes general guidance on protecting personal accounts at cyber.gov.au, and it is written for ordinary people rather than professionals.

Choosing a password you will still have in two years

Two properties matter: the password should be hard for somebody else to guess or compute, and it should be unique to this account.

Uniqueness is the one that does the real work. If a password you use elsewhere is exposed in a breach somewhere else entirely, attackers try the same combination on other services. A password used in exactly one place cannot cost you anything beyond that one place.

Length matters more than decoration. A long passphrase made of several unrelated words is both stronger and easier to type than a short string of substituted symbols. If your browser or operating system offers to generate and store a password for you, that is a reasonable thing to accept, provided the thing storing it is itself protected by a password or a device passcode you trust.

If the game offers two-factor authentication — a second code from an app or a message, required alongside the password — turn it on during registration rather than later. Later rarely arrives.

The registration itself, step by step

1. Go to the game's own website by typing the address or following a link you trust, and look for the account or registration area. Confirm the address in the browser's bar is the vendor's own domain before typing anything.
2. Enter the email address you decided on above.
3. Enter a password that is long and used nowhere else, and let your password manager or browser store it if you use one.
4. Choose a display name. This is what other players see. Pick something that does not contain your real name, your suburb, your school or your year of birth.
5. Read what the form asks beyond those fields. If it asks for a date of birth, that is usually for age gating. If it asks for a phone number, check whether it is optional.
6. Look for the tick boxes near the submit button. One of them is usually marketing consent, and it is often pre-ticked. Decide deliberately rather than by default.
7. Note the link to the game's own privacy policy and terms, and keep it. Those documents, not this course, govern what the game does with your information.
8. Submit the form. Expect a message telling you to check your email.

Confirming the email address

Open the mailbox for the address you used and look for a message from the game. If it has not arrived within a few minutes, check the spam or junk folder before requesting another one; a second request sometimes invalidates the first link and leaves you worse off.

Before clicking the link, glance at two things. The sender's address should belong to the game's own domain or a domain the vendor names. And the link itself, which you can see by resting the pointer over it without clicking, should go somewhere consistent with that. If either looks unrelated, stop and go back to the game's website directly instead.

Clicking the link opens a page confirming the address is verified. That is the whole of it. There is no document to download and no program to install at this stage; if a confirmation email asks you to run something, it is not a confirmation email.

Signing in for the first time

Return to the game's site or to the client you installed, and sign in with the address and password you just used. If you turned on two-factor authentication, you will be asked for the second code here.

Three things are worth doing in the first session, while you are still in a careful frame of mind rather than a playing one. Find the account settings and check what is shown publicly. Find the privacy and communication settings and decide who may contact you. And find the mute, block and report controls that Step 3 mentioned, so you know where they are before the moment you need them.

Then stop and look at the clock. Step 5 is about what happens next, and the first session is where its habits are set.

The messages that are not from the game

Once an account exists, messages about it start to arrive, and not all of them come from the company. The common pattern is a message that appears to be from the game, reports a problem with the account, and asks you to sign in through a link to fix it. The link leads to a convincing copy of the sign-in page, and what you type goes to somebody else.

The defence is a habit rather than a skill: never sign in through a link in a message. If a message says there is a problem with your account, close it, open the game's site by typing the address yourself, and look for the problem there. If it is real, it will be there.

Offers of free items, currency or early access in exchange for your sign-in details follow the same shape. Scams of this kind can be reported to Scamwatch, operated by the National Anti-Scam Centre, at scamwatch.gov.au. If the account belongs to a young person and the contact involved harassment or worse, the eSafety Commissioner at esafety.gov.au is the body that handles that.

The household makes an account

The Adelaide household decides on a shared hobby address rather than either adult's personal one, so that recovery messages are visible to both of them. They generate a password in the browser's own manager and let it store it.

The display name is chosen to contain nothing identifying, which takes a minute of negotiation with a teenager who wanted their own name in it. The marketing tick box comes off. The confirmation message goes to spam, is retrieved, and the sender's domain is checked before anybody clicks.

Then they sign in once, check the privacy settings, locate the report button, and close it for the night. Playing starts tomorrow, which was the plan.

Before you move on

You should now have an account whose email address is confirmed, a password stored somewhere you can retrieve it, a display name that identifies nobody, and a clear rule about never signing in through a link in a message. Step 5 is about the months after the first week.