Game accounts, sign-up and account security

What "single opt-in" means

Sign-up flows in this category are usually described in one of two ways. A single opt-in flow asks for an email address and a password and lets you into the account after you confirm the address. A double opt-in flow adds a separate consent step, typically for marketing messages, before the account is treated as complete.

The advertiser's material for World of Tanks describes a single opt-in flow with an activation step: create the account, activate it, play. The activation step is a confirmation message sent to the address you supplied, and the account is not usable until you act on it. Readers who never see that message should check the spam folder before assuming the sign-up failed, because a confirmation message from an unfamiliar sending domain is exactly what a filter is built to divert.

Whatever the flow is called, the consequences are the same. The email address becomes the key to the account. Everything else — the password, the two-factor method, the recovery questions — is replaceable through that address, which is why the choice of address matters more than any other decision in the sign-up.

Setting an account up properly the first time

1. Choose the address deliberately. An address tied to an employer, a school or an internet provider you may leave is a poor choice, because losing it means losing the recovery route. A personal address on a provider you control is the right answer.
2. Use a unique password. Reuse is what turns a breach at an unrelated site into a compromise of your game account, because attackers try leaked pairs against everything. The Australian Cyber Security Centre explains passphrases and password managers at cyber.gov.au.
3. Complete activation immediately. An unactivated account looks like a failed sign-up and invites a second registration attempt, which is how people end up with two accounts and progress split between them.
4. Turn on two-factor authentication. If the publisher offers it, enable it before you have anything worth stealing. An authenticator application is stronger than a code sent by text message, because a text message can be redirected by a successful port-out of your mobile number.
5. Record the recovery details. Note which address the account uses and where the two-factor secret is stored. A recovery attempt three years from now depends entirely on whether you can answer those two questions.

How the common scams are built

The approaches aimed at players are not technically sophisticated, and they repeat across titles. Recognising the shape is more useful than memorising examples, because the examples rotate.

The launcher login page that is not the launcher

A link in a message, a forum post or a video description leads to a page that reproduces the publisher's login screen. Credentials typed into it go to whoever built the page. The defence is structural: reach a login only by typing the publisher's address yourself or by using the installed client, never by following a link to one.

The item or currency code offer

A message offers a code for an item, a vehicle or in-game currency, in exchange for logging in somewhere, installing something, or "verifying" the account. Publishers distribute promotional codes through their own channels and do not ask for a password to apply one.

The discounted key reseller

A marketplace sells codes below the publisher's price. Some of those codes were bought with stolen payment details, and when the payment is reversed the code is revoked — often after the buyer has used it, sometimes taking the account with it. Buying from the publisher or a store the publisher names avoids the whole category.

The account purchase or share

Buying, selling or sharing accounts breaches the terms of service of essentially every publisher in this genre, which means the buyer has no recourse when the original owner recovers the account through the email address they still control.

The support impersonation

A message claiming to be from support asks for a password, a two-factor code or a screen share to resolve a problem. Legitimate support does not need any of those. Verify through the publisher's own support portal, reached the way you would reach it if no message had arrived.

Current examples of these approaches, including the ones circulating in Australia at any given time, are published by Scamwatch, which is run by the National Anti-Scam Centre, at scamwatch.gov.au.

What a game publisher knows about you

An account of this kind holds an email address, a chosen display name, payment details if you have ever bought anything, connection records including IP addresses, and a detailed history of play. Publishers in this genre operate internationally, so that information is generally held and processed outside Australia.

Australian privacy law sets expectations about how organisations handle personal information, and the Office of the Australian Information Commissioner explains those rights, including access and correction, at oaic.gov.au. The practical step before creating any account is to read the publisher's own privacy policy for two things specifically: what is done with play data, and whether an account can be deleted rather than merely deactivated. Prowave, for its part, collects nothing at all — see the privacy policy for what that means in detail.

If an account is compromised

1. Change the password on the email address first. While an attacker holds the mailbox, every reset you perform on the game account can be undone.
2. Change the game account password and revoke active sessions if the publisher's account page allows it.
3. Enable two-factor authentication if it was not already on, and check whether the recovery address or phone number has been altered.
4. Contact the publisher's support through its own portal, with the account name and the approximate time you lost access.
5. Report it. Cybercrime affecting Australians can be reported through ReportCyber, reached from cyber.gov.au, and scams can be reported to Scamwatch. Reporting does not usually recover the account, and it does feed the picture those agencies use.
6. If payment details were stored on the account, contact your bank or card issuer as a separate step rather than waiting for a charge to appear.

Accounts shared within a household

Where an adult sets up an account that a younger player uses, the practical arrangement is for the adult to hold the email address and the two-factor method, and for payment details not to be stored on the account at all. That removes the purchase question from the game entirely and turns it into a household conversation instead. The eSafety Commissioner publishes material on family technology agreements and gaming at esafety.gov.au, and classification information is covered on the classification page.