How do I keep a new game account and email address safe?

Why a game account is worth protecting

It's easy to treat a game account as low stakes. You haven't paid anything, so what's to lose? Quite a bit, as it turns out. Accounts build up value over time: hours of progress, items you've earned or bought, sometimes a saved payment method. Accounts with value get stolen and resold. And the password you choose for a game is often the same one people use elsewhere, which turns a small breach into a big one.

None of this is a reason to be anxious about signing up. It's a reason to spend five minutes doing it properly.

Registering step by step

1. Check you're on the real site. Look at the address bar before you type anything. Be wary of look-alike addresses with extra words or odd spellings. If you followed a link from anywhere, including this site, it's fair to check where you've landed.
2. Choose an email you control and check. Many games, Crossout included, ask you to confirm your email address with a link sent to your inbox. Use an address you can get into, and secure it first.
3. Create a unique passphrase. A few unrelated words strung together is long, hard to guess and easier to remember than a jumble. The Australian Cyber Security Centre has practical guidance on passphrases.
4. Turn on multi-factor authentication if it's offered. This adds a second check, such as a code from an app, when you log in from a new device.
5. Give only the details the form requires. If a field is optional, you can usually leave it blank.
6. Hold off on saving a card. You can add a payment method later if you ever decide to buy something.

The email address is the real key

Almost every online account lets you reset a forgotten password by email. That's convenient, and it means that anyone who gets into your inbox can get into everything linked to it. Before you link a game account to an email address, make sure that email account has its own unique password and multi-factor authentication switched on.

Some people prefer a separate email address for games and online sign-ups. That keeps promotional mail out of your main inbox and limits the damage if one address is ever exposed. It's a reasonable choice, as long as you still secure that address properly and check it occasionally.

Password managers

If remembering a unique passphrase for every site sounds impossible, that's because it is. A password manager generates and stores them for you, so you only need to remember one strong master passphrase. Many browsers and operating systems include one. The point isn't any particular product; it's that every account gets its own password, so a breach at one company doesn't open the door to the rest.

If something goes wrong

If you can't log in, or you notice activity you didn't do, act in this order:

1. Secure your email first. Change its password and check its recovery settings and forwarding rules.
2. Reset the game password from the official site, and log out of other sessions if the game allows it.
3. Contact the game's support team through the vendor's official website. Have your account name and any purchase receipts ready.
4. If a card was charged without your permission, contact your bank or card provider straight away.
5. Change the password anywhere else you used the same one.

The Australian Cyber Security Centre also has step-by-step help for recovering hacked accounts.

Shared and family computers

If the computer is shared, two habits are worth keeping. Use separate user accounts on the computer itself, so a game login and a saved password are not sitting open for whoever sits down next. And log out of the game, or at least lock the screen, rather than leaving a session open. Most account trouble on shared machines is not an attack from outside; it is someone in the house clicking something they should not have.

Privacy: what the game knows about you

When you create an account, the game company collects some personal information: at least your email address, and usually details about your device and how you play. Its privacy policy should explain what it collects, why, and how to ask for a copy or deletion. Reading the summary section of that policy before you register is worth the two minutes.

If you have concerns about how a company operating in Australia handles your personal information, the Office of the Australian Information Commissioner explains your rights and how to make a complaint. This site, for what it's worth, collects nothing from you; our Privacy Policy explains the little that happens when you visit.

Multi-factor login, briefly

Multi-factor authentication means a password alone is not enough to get in. The second step is usually a code from an app on your phone, a code by text message, or a prompt you approve. An app-based code is generally considered stronger than a text message, because text messages can be redirected in some circumstances.

Two practical points. First, save the recovery or backup codes a service gives you when you turn it on, somewhere you can reach without your phone. People lock themselves out far more often than they get hacked. Second, if you ever receive a code you did not request, treat it as a sign someone has your password and change it.

Closing an account later

Before you register, find out how to close the account if you stop playing. Some games have a self-service option in the settings; others need a request to support. An account you no longer use is one more thing that could be breached, so closing it when you're done is good housekeeping.

Common questions