Step 4 — The account, and the first few sessions

Step 4 of 5 · about nine minutes to read

Start with the address bar

Game accounts are a steady target for people who want to take them, and the most common method is not technical. It is a page that looks like the publisher's sign-in page and is not.

So the first habit, before any of the rest, is this: reach the sign-up page by typing the publisher's address yourself or by following a link you understand, and then look at the address bar before you type anything into the page. A page asking for your game password should be on the publisher's own domain. Every time.

Scamwatch, run by the National Anti-Scam Centre, publishes current examples of this kind of impersonation and a reporting process. The Australian Cyber Security Centre publishes the Australian Government's own guidance on account security, including passwords and multi-factor authentication, and is worth reading once in full rather than in fragments.

The procedure, in nine parts

This is written in general terms that apply to any online game account on a desktop computer, because publishers redesign their sign-up flows regularly and a screen-by-screen walkthrough would be wrong within months.

1. Reach the publisher's site deliberately. Type the address or follow a link whose destination you can see in the status bar, then check the address bar on arrival.
2. Decide which email address to use. A dedicated address used only for games keeps game-related mail separate and makes a fake "account alert" easier to spot.
3. Generate a long, unique password. Unique means used on no other service at all. Use a password manager so you do not have to remember it.
4. Choose a display name that is not your real name. It is visible to strangers in every match and generally hard to change later.
5. Read the consent boxes before ticking. Separate the box you must tick to have an account from the ones about marketing. Leave the marketing ones alone unless you want the mail.
6. Confirm the email. Most publishers send a confirmation link; the account is usually not fully active until it is followed.
7. Turn on two-factor authentication immediately. In the account or security settings. Prefer an authenticator application over SMS where both are offered.
8. Save the recovery codes. Two-factor setup produces one-time backup codes. Write them on paper and keep them away from the computer.
9. Do not save a payment method. Not on day one. You have no reason to, and an account without stored payment details cannot be used to spend by anyone who gets into it.

Why the password matters more here than most places

A game account accumulates two things attackers want: time, in the form of progress someone else would rather not earn, and often a payment method. That makes these accounts worth stealing in a way a recipe site login is not.

The single most effective protection is a password used nowhere else. Most takeovers at this scale are not clever: someone takes email addresses and passwords exposed in an unrelated breach and tries them elsewhere. A password used in only one place cannot be reused against you that way.

Two-factor authentication is the second layer: knowing the password is no longer enough, because a code from your phone or an authenticator app is also needed. The ACSC's published advice treats multi-factor authentication as one of the most useful things an individual can do, and it takes about two minutes to enable.

Keep the recovery codes on paper. People lose phones, and an account you cannot get back into is a poor return on a precaution.

Installing the client without surprises

Download the client only from the publisher's own site or from a recognised platform the publisher names. Search results and video descriptions are not sources. A file that arrives from anywhere else is not the game, whatever it is called.

Expect the download to be large — several gigabytes is ordinary — and expect an update immediately after installing, because the version in the installer is older than the live one. Both are normal.

During installation, read each screen rather than clicking through, and note where it proposes to install, because that drive needs the space you measured in Step 2. If anything additional is offered — a toolbar, another program, a "system optimiser" — decline it.

Afterwards, open the game's own settings before the first match and set graphics to a low preset. Starting low and raising settings beats starting high and wondering why everything stutters.

What the first three sessions usually feel like

Knowing the shape of the first few hours makes them much less disorienting, and the shape is fairly consistent across games in this category.

The first session is mostly orientation. There is usually a tutorial or a set of introductory matches, the controls will feel awkward, and you will lose. That is the expected outcome and not a signal about your aptitude. Treat the first session as a test of whether the game runs properly, not of whether you are good at it.

The second session is where the controls start to settle and where the game begins explaining its progression — what you earn, what becomes available, what the currencies are. This is the point to take the sheet from Step 1 and check whether the earning rate matches what you decided you wanted.

By the third session you will have an honest opinion. If the half-hour did not go quickly, stopping costs you nothing, which is the one genuine advantage of a game with no purchase price. If it did, Step 5 is about keeping it that way. Through all three sessions, buy nothing: a decision made before you understand the currencies is not really a decision.

Two decisions to make before you use chat

Online multiplayer games put you in a team with strangers, usually with text chat and sometimes voice. Two decisions, made in advance, prevent most of the unpleasantness.

First, decide what you will not share. A display name that is not your real name, no school or workplace, no suburb, no other contact details. This applies with particular force to a young person in the household, and the eSafety Commissioner publishes material for families on exactly this.

Second, learn where the mute, block and report controls are before you need them. Every game in this category has them. Using mute early and often is normal behaviour, not an admission of anything, and it is far better than arguing with someone whose name you will never see again.

If abuse becomes serious or targeted, the eSafety Commissioner is Australia's independent regulator for online safety and has a complaints process for seriously harmful online content and abuse.

Paid shortcuts in the first week

This course's position, stated plainly, is to spend nothing for the first month. That is guidance, not a rule, and the reason is in the right-hand column: the information you need to judge the offer arrives later than the offer does.

Before you move on

Checklist 4 — account and first sessions