Accounts, email and the confirmation step
Creating an account takes two minutes, and the consequences last for years. This step is about making those two minutes count: which email address to use, what a good passphrase looks like, why a confirmation message exists at all, and how to tell a genuine one from an imitation. It takes about eighteen minutes to read.
Why an account exists in a free game
In Step 1 we established that a free-to-play game earns nothing at installation and therefore needs you to come back. An account is how it recognises you when you do. It holds your progress, your items, who you have played with, and — if you ever spend anything — your purchase history.
That makes a game account more valuable than most people assume. An account with years of progress and paid items attached to it is worth something to somebody, which is why game accounts are stolen and resold, and why the five minutes you spend on this step are not wasted caution.
The practical point: treat a game account as a real account. Not as serious as internet banking, more serious than a newsletter.
Choosing the email address
Use a separate email address for games. Not a fake one, not a disposable one that expires, but a real, free, working address that is not the address your bank, your employer or your government services use.
There are three reasons. The first is containment: if a game company has a data breach and the address leaks, the leaked address is not the one attached to anything that matters. The second is clarity: a lookalike message pretending to come from a game is obviously wrong when it lands in an inbox your bank has never heard of — and equally, a message from a game that arrives in your main inbox is immediately suspicious. The third is simple tidiness, because game accounts generate a lot of mail.
Set this address up before you sign up for anything, and write down which address you used where. A list of four lines on paper in a drawer is a perfectly respectable system and has no breach risk at all.
Using one dedicated address across several game accounts is fine and is much easier to keep track of than a different address per game. The thing that must never be shared across accounts is the password.
Building a passphrase you can actually remember
A passphrase is a password made of several unrelated words rather than one word with substitutions. The Australian Cyber Security Centre publishes current, plain-English guidance on passphrases and account security for individuals at cyber.gov.au, and that is the source to follow rather than anything invented here.
The general shape of the advice is consistent and easy to apply: length beats complexity, unrelated words beat a single word with numbers bolted on, and the same passphrase must never be used on two services. That last rule is the one that does the real work. When a password is reused, a breach at the least careful service you have ever signed up to becomes a break-in at the most important one.
If remembering several long passphrases sounds impossible, that is because it is. The two workable answers are a password manager — a program whose job is to store and fill them — or a written list kept somewhere physically safe. Both are legitimate. The ACSC's site discusses password managers in general terms; this course does not recommend any particular product, and nothing here is a paid placement.
A second factor, in general terms
Two-factor authentication, often shortened to 2FA, means that signing in needs something beyond the passphrase: typically a code from an app on your phone, or a code sent by email or text. It is the single most effective thing you can turn on, because it means a stolen passphrase on its own is not enough.
Many game services offer it, usually under a heading like “Security” or “Account protection” in the account settings on the company's website rather than inside the game. Turn it on at sign-up if it is available, while you are already thinking about it. If the service offers recovery codes, write them down on paper and keep them somewhere other than the computer.
If a service offers no second factor at all, that is not a reason to panic. It is a reason to be stricter about the two things you do control: a unique passphrase, and an email address that is not shared with anything important.
The confirmation email and what it is for
After you submit a sign-up form, most services send a message to the address you gave and ask you to click a link in it. This is email confirmation, and it does two sensible things: it proves the address exists and belongs to you, and it stops someone registering accounts using other people's addresses.
Until you confirm, many services keep the account in a limited state — you may not be able to sign in, or not be able to use everything. That is normal, and it is why a sign-up is usually described in three parts: create the account, confirm the address, then sign in for the first time.
It also means the first message you receive from a game is predictable. You asked for it, it should arrive within a few minutes, and it should do exactly one thing. Anything that arrives later, unprompted, asking for something else deserves the scepticism described next.
Telling a real message from an imitation
Messages that imitate a legitimate service in order to collect your sign-in details are called phishing. Game accounts are a regular target. The Australian Competition and Consumer Commission's Scamwatch service publishes current information about how these approaches work and how to report them; it is the place to check a suspicion, and the place to report one.
The habits that help are general rather than game-specific:
- Expectation. Did you just do something that would cause this message? A confirmation email thirty seconds after signing up is expected. The same email three weeks later is not.
- Destination. Hover over a link and read the address your browser shows at the bottom of the window before clicking. The domain should be the company's own.
- The request. A confirmation message asks you to confirm. It does not ask for your passphrase, a payment, or a code from another message.
- Pressure. Claims that an account will be deleted or suspended within hours are designed to stop you thinking. Real services give real notice.
- Go the long way. If you are unsure, do not use the link. Type the company's address into your browser yourself and sign in there. If something genuinely needs your attention, it will be waiting.
None of that implies your device is infected or that you are personally under attack. It is ordinary hygiene, the email equivalent of checking who is at the door.
What a sign-up form should and should not ask
| Normal | Worth a pause |
|---|---|
| Email address | Full residential address |
| A username or display name | Date of birth with no stated reason, beyond an age check |
| A password or passphrase | Phone number as a condition of playing |
| Country or region | Payment details before anything free has happened |
| Agreement to terms and a privacy policy | Identity documents |
The right-hand column is not automatically sinister — an age check has an obvious purpose, and some services ask for a phone number for account recovery. The point is to notice the request and decide, rather than typing on autopilot. If something on the right appears and no reason is given, that is a fair moment to close the tab.
What you are agreeing to
The tick box at the bottom of a sign-up form is a contract and a privacy notice. You do not need to read every clause, but it is worth opening the privacy policy once and looking for three things: what is collected, who it is shared with, and how to delete the account. If those three are hard to find, that in itself tells you something.
Australian privacy rights are explained in plain language by the Office of the Australian Information Commissioner, including what rights you generally have to access information held about you and to complain. Whether and how those rights apply to a particular overseas game company is a question about that company; the OAIC's site is the correct starting point rather than a forum.
Our own privacy practices are on the Privacy Policy page, and they are short, because this site collects nothing.
Paid affiliate link: Raw Segment is paid a commission by the affiliate network that operates the link when a reader follows it, creates an account, confirms the email address and signs in to the game. We are telling you that plainly here because this is the step where it would happen. You are charged nothing, and the advice on this page is the same either way.
If the player is under eighteen
An account in a parent's name, used by a child, is still the parent's account, with whatever payment details are attached to it. The cleanest arrangement is usually a separate account for the young person, set up together, with no payment method stored on it.
The eSafety Commissioner is the national regulator for online safety and publishes material for parents and carers about online games, in-game contact with strangers, and how to report serious online abuse. Step 4 covers classification and spending, and Step 5 covers contact with other players; both are worth reading before a young person's first session rather than after it.
You should now have: a dedicated email address for games, a passphrase used nowhere else, a second factor turned on if the service offers one, recovery codes on paper, and a clear idea of what a genuine confirmation email looks like. Step 4 is about money and classification, and it is the step to read with anyone else in the household who will use the account.
Checklist 3 — a sign-up you will not regret
- Create or nominate an email address used only for games, separate from banking and work.
- Write down which address you used, on paper, with the service name beside it.
- Build a passphrase of several unrelated words, used on no other service.
- Read the current passphrase guidance at cyber.gov.au once, so your habit matches the official advice rather than this page.
- Check the account settings for two-factor authentication and turn it on if it exists.
- Write any recovery codes on paper and store them away from the computer.
- Before clicking any link in a confirmation email, hover over it and read the destination.
- Confirm you can reach the sign-in page by typing the company's address yourself, and prefer that route whenever in doubt.
- Open the privacy policy and find three things: what is collected, who it is shared with, and how to delete the account.
- Decide whether a payment method will be stored on the account. For a first month, “none” is a sound default.
- If a young person will use the account, set it up with them and read Step 4 together.
- Bookmark scamwatch.gov.au so you have somewhere to check a suspicious message later.