Step 3 — Accounts, email confirmation and the terms you agree to

What a game account actually is

An online game keeps your progress on its own servers rather than on your computer. A game account is the record that says which progress is yours. Everything you build, earn or buy is attached to it, and the copy on your computer is only the part that draws the picture.

Two consequences follow. The first is useful: you can reinstall, replace the computer, or play from a different machine, and your progress is waiting. The second is the one to take seriously: the account is the thing of value, and losing access to it loses everything attached to it.

An account is also a contract. When you tick the box, you are agreeing to a document, and in most of this category you are agreeing to a licence to use software and a service rather than buying anything. That distinction runs through the rest of this step.

Why there is a confirmation email

Nearly every sign-up in this category sends an email with a link in it, and the account is not fully active until you follow that link. The step is often described as confirming or verifying your address, and it does three jobs at once.

• It proves the address exists and reaches you, so that a recovery message later actually arrives.
• It proves somebody did not type your address by mistake, or on purpose, to create an account in your name.
• It slows down the automated creation of large numbers of accounts, which is a real problem for online games.

Practically: the message can take a few minutes, it frequently lands in a junk or spam folder, and the link often expires after a set period. If nothing arrives within ten minutes, check the junk folder before requesting another, because requesting another sometimes invalidates the first.

One habit worth forming at this moment. Follow the link from the email you asked for, having just signed up, and never from an unexpected message. Step 3 returns to that below, because the confirmation email is one of the most imitated messages there is.

Choosing which email address to use

Use an address you will still control in five years, that you check, and that is itself protected properly. The email account is the master key: anyone who can read it can usually reset the password on everything attached to it.

Some people prefer a separate address for games and other hobby sign-ups, which keeps marketing out of the main inbox and limits what a single breach reveals. That is a reasonable arrangement as long as you genuinely check it. A forgotten address is worse than a shared one, because recovery messages arrive somewhere nobody is looking.

Avoid a work address. You may not have it after you change jobs, and the account will outlive the employment.

Avoid disposable or temporary addresses entirely. They defeat recovery, and many services refuse them anyway.

A password you can live with

Two rules carry nearly all of the benefit: make it long, and do not use it anywhere else. Length matters more than punctuation, and reuse is what turns one site's problem into your problem everywhere.

A password manager — a program that generates and stores passwords for you — removes the need to remember any of them. If you would rather not use one, a passphrase of four or five unrelated words is long, memorable and easy to type.

If the game offers two-factor authentication — a second code, usually from an app on your phone, required in addition to the password — turn it on. For an account that holds years of progress, it is the single most useful setting available.

The Australian Signals Directorate's Australian Cyber Security Centre publishes general guidance for individuals and families at cyber.gov.au, including on passphrases and multi-factor authentication. It is written for the public and is free to read.

Five parts of the terms worth reading

Nobody reads the whole document, and pretending otherwise helps nobody. Instead, use the browser's find function and search for five things. Ten minutes is enough.

1. Whether you own anything

Search for "licence" and "ownership". In most of this category you receive a limited, revocable licence to use software and in-game items rather than ownership of them. Knowing that before you spend is better than discovering it afterwards.

2. Suspension and termination

Search for "terminate" and "suspend". Look for what conduct can end an account, whether there is any warning, and what happens to purchases if it ends. Also look for what happens to a dormant account.

3. Account sharing and transfer

Search for "transfer" and "share". Many services prohibit sharing an account, selling it, or letting somebody else play on it. If your household plans to share one account, read this clause before you build the plan around it.

4. Refunds and purchases

Search for "refund". Note what the publisher offers of its own accord. Separately, note that in Australia the consumer guarantees under the Australian Consumer Law apply to goods and services supplied to consumers and cannot be excluded by a contract term, whatever a document says. The ACCC publishes general guidance on consumer rights.

5. Changes to the agreement

Search for "amend" and "modify". Most services reserve the right to change the terms and treat continued use as acceptance. Knowing which address change notices go to is part of why Step 3 spent time on the email address.

Reading the privacy policy quickly

The privacy policy is a separate document from the terms, and four questions get most of the value out of it: what is collected, who it is shared with, whether it leaves the country, and how long it is kept.

For an online game, expect the answers to include an email address, a chosen display name, payment details if you buy anything, technical information about your computer, and records of what you do in the game. Most of that is unavoidable for a service of this kind.

In Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles set the framework for how many organisations handle personal information. The Office of the Australian Information Commissioner explains the principles at oaic.gov.au, and the same office handles privacy complaints. Which rules apply to a particular overseas publisher is a question about that publisher, not one this course can answer for you.

For what this site collects — which is very little — see our own privacy policy.

Confirmation emails that are not confirmation emails

Because every service sends one, an email that looks like a confirmation or a security notice is an easy thing to imitate. Three habits handle nearly all of it, and none of them requires you to judge whether a message looks convincing.

1. Expect it, or ignore it. Follow a confirmation link only in the minute after you asked for one. An account notice that arrives out of nowhere is a reason to open the site yourself, by typing the address, and look at the account there.
2. Never give a code to a person. A two-factor code is for you to type into the official site. No legitimate support team asks for it by message, chat or voice.
3. Treat free-item offers as the oldest approach there is. In-game currency in exchange for your login details is not a generous stranger.

Scamwatch, run by the National Anti-Scam Centre, collects reports and publishes descriptions of current approaches at scamwatch.gov.au. The eSafety Commissioner is the national regulator for online safety and publishes guidance on online abuse and on gaming for families.

What sign-up means for the game named here

For Crossout, the sequence the publisher describes is the ordinary one for this category: register, confirm the email address, then log in to the game. It is also the sequence that earns this site a commission, and we would rather set that out beside the instructions than somewhere you have to go looking for it.

Treat that as a reason to apply this step carefully rather than quickly. The five searches above take ten minutes, and they are the same ten minutes whether or not anyone is paid for your sign-up.

Visit the Crossout website Paid affiliate link. If you create and confirm an account after following this link, the affiliate network that operates it pays Nullphase a commission. You pay the same either way, and nothing in this course depends on your following it.

The worked example, continued

In the invented Melbourne household, one of the adults opens the terms document and runs the five searches. "Licence" tells them the items are licensed rather than owned. "Terminate" tells them conduct in the game can end the account. "Share" turns up a clause prohibiting account sharing — which matters, because their plan had been one account for the household.

They change the plan: one account, one person, and if a second person wants to play, a second account. They set a long passphrase stored in the browser's password manager and turn on the second factor. They use a hobby email address that one of them checks weekly.

The whole of Step 3 took them about twenty minutes, and it replaced an arrangement that the agreement would have prohibited.

Before you move on

You should now know which email address the account uses, what the password arrangement is, whether a second factor is available, and the answers to five specific questions about the agreement. Step 4 is the practical one: installing, and finding out whether it works.