Part S-03 · Course file SM-FTP-5

Step 3 — Accounts, email confirmation and signing in

Step 3 of 5

An account is the part of this that outlives the game. The computer will be replaced, the title may be deleted in a fortnight, but the email address and password you choose today will still be attached to something in five years. This step is about making that choice once, properly, and about recognising the confirmation email when it arrives — along with the fakes that imitate it.

What the account is actually for

In an online game, your progress does not live on your computer. It lives on the publisher's servers, and the account is the label on it. That is why you can sign in on a different machine and find everything where you left it, and it is also why losing access to the account means losing the progress, regardless of what is installed locally.

The email confirmation step exists for two reasons that are both in your interest. It proves the address works, so that a password reset can reach you later. And it discourages people from creating accounts in bulk, which is a real nuisance in multiplayer games. The example title in this course, Crossout, follows that ordinary pattern: register, confirm the email address, then sign in for the first time.

Choosing the email address

There are three sensible options and one poor one.

A separate free address used only for games is the tidiest. Marketing messages stay out of the inbox you use for work and government correspondence, and if the address ever appears in a leak, it is not the address your bank uses. The cost is remembering to check it, which matters because password resets and confirmations arrive there.

Your ordinary personal address is perfectly workable if you would rather not run two inboxes. You will receive more promotional email, which you can unsubscribe from.

A shared household address can make sense for a family account, as long as everybody understands that whoever controls the inbox controls the account.

The poor option is a work address, or an address attached to an employer or school you may one day leave. When you lose the address, you lose the recovery path, and getting an account back without it is tedious at best.

The password, and why a passphrase is easier

A passphrase is simply a password made of several unrelated words rather than one word with substitutions in it. It is longer, which is what actually matters, and it is far easier to remember than a short string of symbols. The Australian Cyber Security Centre publishes general guidance on passphrases and on keeping accounts secure at cyber.gov.au, and it is worth ten minutes of reading once in your life.

Two rules cover most of the risk. Do not reuse a password across sites, because a leak at one service then opens the others. And do not build it out of things that are published about you — a pet's name and a birth year is a weak choice no matter how many exclamation marks follow it.

If keeping unique passwords in your head is unrealistic, that is normal, and a password manager is the ordinary answer. Most browsers now include one. A written list kept somewhere physically safe is also a legitimate approach for a home computer, and it is far better than reusing one password everywhere.

Multi-factor authentication, in plain terms

Multi-factor authentication means that knowing the password is not enough on its own; a second thing is needed, usually a code from an app on your phone. Game publishers vary in whether they offer it, and some offer small in-game rewards for switching it on.

If the publisher offers it, switching it on is a reasonable habit. If it is not offered, that is not a reason for alarm — it simply means the password is doing all the work, which raises the value of not having reused it. Whichever way it goes, write down or store the recovery codes if any are issued, because the common way people lose an account is losing the phone, not being attacked.

The confirmation email, and the fakes

A genuine confirmation email has a few ordinary features. It arrives within a few minutes of you registering, because you caused it. It refers to the account you just created. It contains a link whose address, when you hover over it without clicking, belongs to the publisher's own domain. And it asks you only to confirm — not to pay, not to verify a card, not to install anything.

Fakes imitate this pattern, usually some time later and usually with a reason to hurry: an account will be closed, a reward will expire, a payment has failed. Scamwatch, run by the National Anti-Scam Centre, publishes current descriptions of these approaches at scamwatch.gov.au, and the general shape rarely changes even when the details do.

The habit worth forming is simple and costs nothing: if a message about an account surprises you, do not use its links. Open the service yourself, the way you normally would, and look. If there is a genuine problem, it will be visible there. If there is nothing, the message was not genuine.

The registration sequence, in general terms

The order below applies across this whole category of games. Individual publishers arrange their pages differently and we are not describing any one of them; this is the shape, not a walkthrough.

1. Decide the email address and the passphrase before you open the registration page. Deciding under time pressure, with a form in front of you, is how passwords get reused.
2. Reach the publisher's own site by typing its address or by following a link you trust, and check that the address in the bar is the publisher's.
3. Complete the registration form with the address and passphrase you chose. Give only what is marked as required.
4. Read what you are agreeing to, at least to the extent of finding out whether you are opting into marketing email. That tick box is usually optional and often pre-ticked.
5. Open the inbox and wait a few minutes for the confirmation message. Check the junk folder before concluding it has not arrived.
6. Confirm by following the link in that message, having first checked that it points at the publisher's domain.
7. Sign in once, immediately, to prove the whole path works while you still remember what you typed.
8. If multi-factor authentication is offered in the account settings, switch it on and store any recovery codes.
9. Only then download the client, from the publisher's own site or an established shop.

Visit the Crossout website Paid link — Soft Margin is paid a commission if you create an account and confirm your email address after following it. The sequence above works for any title in this category. How this works.

What the publisher keeps about you

Every publisher holds some information about its players: the address you registered with, when you sign in, what you have bought, and usually some technical details about the machine the client runs on. What they do with it is set out in their own privacy policy, which is a different document from the one on this site and which we have no part in.

If you want a frame for reading it, the Office of the Australian Information Commissioner publishes the Australian Privacy Principles at oaic.gov.au. They are the national rules about how personal information is collected, used, disclosed and corrected, and they give you a vocabulary for the questions worth asking: what is collected, why, who else sees it, and how you ask for a copy or a correction.

One thing to look for specifically is whether the publisher discloses information overseas, and to where. Many game companies are not Australian, and their servers are not either. That is normal and lawful; it is simply a fact you are entitled to know before you register rather than after.

Before you move on

You should have an account whose email address you can actually open, a passphrase you have not used anywhere else, and a confirmed address proved by signing in at least once. You should know what a genuine confirmation message looks like and what to do with a surprising one, which is to ignore its links and check the service directly.

Step 4 moves from the account to the money: the Australian classification system, what purchases inside a game look like in Australian dollars, and the particular care that randomised purchases deserve in a household with anyone under eighteen in it.