Calm Trait · beginners' workbook

Step 3 of 5

Accounts, email confirmation and what you are agreeing to

Almost every online game begins with a registration form and an email you have to confirm. This step explains why that exists, what each field is for, how the confirmation step works, and how to tell a genuine confirmation message from one sent by somebody else.

Why a game wants an account at all

An online game keeps your progress on its own servers rather than on your computer, as Step 1 described. It therefore needs a way to know that the person connecting today is the same person who connected yesterday. That is what an account is: a label the publisher can attach your progress to, plus a secret only you should know.

A second reason is that the publisher needs a route to reach you — to confirm a purchase, to tell you the account was accessed from somewhere new, or to let you recover access when you forget the password. An email address is the usual route because it is one almost everybody already has.

A third reason, less often stated, is commercial. An email address is also a marketing channel, and most publishers will send you messages about the game unless you tell them not to. Whether that is acceptable is your call, but it should be a call you make knowingly rather than discover later.

The fields on a registration form, one at a time

Registration forms vary, but the same handful of fields recur. None of them should be a surprise by the time you fill one in.

If a game's registration asks for something that has no obvious purpose — a phone number, a postal address, identity documents — it is reasonable to stop and ask why before supplying it. Not every such request is improper, but a free game that wants your address at sign-up is asking for more than it needs to let you play.

What confirming an email address does

After you submit the form, most publishers send a message to the address you gave, containing a link. The account does not fully exist until you open that link. This arrangement is often called double opt-in, and it does two useful things.

It proves the address is real and reachable, so account recovery will work later. And it proves the address belongs to the person registering, which stops somebody creating accounts against other people's addresses.

From your side the sequence is short: submit the form, switch to your email, find the message, open the link, and the account becomes active. Two ordinary complications are worth knowing. The message can take a few minutes, so waiting is normal. And it can land in a spam or junk folder, so check there before concluding it never arrived.

Most games give the confirmation link a time limit — commonly a day or so, though the publisher sets it. If yours expires, the fix is to request a new message from the same sign-in page rather than registering a second account.

Telling a real confirmation from a fake

A message that says "confirm your account" is one of the most imitated kinds of email, because it is one of the most expected. The general advice below comes from the national bodies that publish on this, and it is worth reading their material directly: Scamwatch publishes current scam types and what to do about them, and the Australian Cyber Security Centre publishes general advice on recognising malicious messages.

Four habits cover most of it.

1. Expect it, then act on it. A confirmation you asked for, arriving within minutes of asking, is ordinary. The same message arriving on a Tuesday when you registered nothing is not.
2. Read the destination, not the text. Hover over the link, or press and hold on a touch screen, and read the address that appears. It should be the publisher's own domain. Text can say anything; the destination is the fact.
3. Refuse extra requests. A genuine confirmation link confirms an address. It does not ask for your password, your card number or a copy of your licence. Any message that does is not what it claims to be.
4. Go the long way round when unsure. Rather than opening the link, type the publisher's address into your browser yourself and sign in there. If a confirmation is genuinely pending, the site will tell you.

If you believe you have handed credentials to a fake page, change that password immediately, and change it anywhere else you reused it. Scamwatch also takes reports, which feed the national picture even when nothing can be recovered for you.

Passwords and the second factor

Two rules carry nearly all the benefit. The first is that a game password must not be a password you use anywhere else, and particularly not the one on the email account you just gave the game. If a game's database is ever exposed, a reused password turns one publisher's problem into yours.

The second is to turn on two-factor authentication if the publisher offers it. That means signing in needs the password plus a short code, usually from an application on your phone. It is the single most effective thing an ordinary person can do for an account, and the Australian Cyber Security Centre's guidance covers how it works.

A password manager, including the one built into your browser, solves the problem of remembering different passwords. The alternative — writing them in a notebook kept away from the computer — is unfashionable but far better than reusing one password everywhere.

What you are agreeing to when you tick the box

Registration includes agreement to a terms of service document and a privacy policy. Nobody reads them in full, but four things are worth locating, and all four are usually findable with the browser's search function.

What the publisher collects and who it shares with, which is in the privacy policy. Whether purchases are refundable, and on what terms. What conduct can get an account suspended, which matters because a suspension can take purchases with it. And how to close the account and delete the data, which is the part people most regret not knowing.

Australian law sits behind those documents and cannot be removed by them. The Australian Consumer Law applies to goods and services supplied to consumers in Australia, and the ACCC explains those guarantees. Privacy handling in Australia is overseen by the Office of the Australian Information Commissioner. A publisher's terms describe the publisher's position; they do not describe the limits of your rights.

The worked example

Our hypothetical household registers. They use the household email address, invent a display name that is not either of their names, answer the date of birth honestly, set the country to Australia, and untick the marketing box. They create a password that exists nowhere else and save it in the browser's password manager.

The confirmation message does not arrive for six minutes, and when it does it is in the junk folder. They hover over the link, see the publisher's own domain, and open it. The account activates. Total elapsed time, about ten minutes, most of it waiting.

As a concrete illustration, the course's running example, Enlisted, follows exactly this pattern according to the network that operates our link: register, confirm the email address, then launch the game. We do not describe the publisher's own screens, because they change and because the point of this step is the pattern, not one company's layout.

Visit the Enlisted website

Paid affiliate link. Evropastar s.r.o. may be paid a commission if you register through it. Your price is unaffected, and nothing in this step depends on you using it.

Before you move on

You should now have, or be able to create, an account with a confirmed email address and a password used nowhere else. You should know where the publisher's terms and privacy policy are, and you should have formed an opinion about the marketing tick box rather than scrolling past it.

If you have gone this far and decided you would rather not hand over an email address at all, that is a complete and sensible answer. Nothing obliges you to continue, and there is no deadline.

Step 3 checklist

1. Decide which email address the account will use, and confirm you can read it on this computer.
2. Choose a display name that reveals nothing about who or where you are.
3. Create a password used on no other site, and record it in a password manager or somewhere safe off the computer.
4. Answer the date of birth honestly.
5. Set the country to Australia if that is where you are.
6. Read the marketing tick box and set it the way you actually want it.
7. Open the confirmation message, check the link destination is the publisher's own domain, then open it.
8. If no message arrives in ten minutes, check the junk folder before doing anything else.
9. Turn on two-factor authentication if the publisher offers it.
10. Find and bookmark the publisher's refund terms and its account closure instructions.

— end of step three — address confirmed — proceed —