Step 3 of 5

Step 3 — The account and the email confirmation

Registration is the point where a game stops being something you read about and starts being a record somebody keeps about you. This step covers what the form asks for, what it does not need, and the confirmation email that arrives afterwards — including how to tell the real one from an imitation.

What a sign-up form asks for

Nearly every registration in this category asks for the same four things: an email address, a password, a display name, and agreement to the terms. Some add a date of birth, a country, or a tick box offering news and offers.

Treat each field as a question you are allowed to think about. The email address and password are genuinely needed, because they are how the account is reached and recovered. The display name is public and visible to strangers in every match, so it should not be your full name, your school, your workplace or anything that identifies where you live. A date of birth is often used to decide which settings apply; answer it honestly, because an inaccurate answer can switch off protections meant for the person playing.

The marketing tick box is optional by design. Leaving it unticked does not affect the account. If it is pre-ticked, untick it unless you want the mail.

Choosing the mailbox first

Decide which email address the account will use before you open the form, because the decision is hard to change later and it has consequences.

The mailbox you choose becomes the recovery route for the account. Whoever can read that mailbox can reset the password and take the account. On a shared family computer that is worth thinking about in both directions: a parent may want access to a child's game account, and an adult may not want a housemate to have access to theirs.

Using a separate address for game accounts is a reasonable habit. It keeps game mail away from work mail, and it means a leak at one service does not immediately point at your main address. What matters more is that the address is one you can actually open on the computer you are registering from — because the next thing that happens is a message to it.

The password, and why it must be unique

Use a password that is used nowhere else. The reason is specific rather than general: when a service is breached and a list of addresses and passwords is published, attackers try those same pairs on other services. A password reused between your email and your game account turns one breach into two.

Length matters more than symbols. A long passphrase of several unrelated words is both stronger and easier to type than a short string of substitutions. A password manager, built into your browser or installed separately, removes the need to remember any of it. The Australian Cyber Security Centre publishes current guidance on passwords and passphrases, and it is the source to follow rather than the folklore that circulates in game chat.

The registration, step by step

If the confirmation message has not arrived after ten minutes, look in the junk or spam folder, then use the site's own resend function. Do not search the web for a support address; use the one on the site you registered with.

What double opt-in means

You will see the phrase double opt-in used about registrations like these. It describes a two-part sign-up: you enter your address, and then you prove you can read that mailbox by following a link in a message sent to it. Only after the second part is the address treated as confirmed.

The arrangement exists to stop people signing others up to things, and to keep bad addresses out of a publisher's records. For you it has one practical consequence: an account is not finished when the form is submitted. Until you open the message and confirm, the registration is incomplete, and in many systems the account cannot be used for anything.

Telling a real confirmation from a fake one

Messages that imitate game confirmations and account warnings are common, because accounts in this category are worth money. Four habits make the difference.

• Expectation. A confirmation you did not ask for, arriving when you have registered for nothing, is not a confirmation. It is either a mistake or bait.
• Timing. The real message arrives within minutes of your registration. One that arrives days later, about an account you confirmed long ago, deserves suspicion.
• Pressure. Real confirmation messages are dull. Threats of deletion, warnings about suspicious activity, and offers of free items are the vocabulary of the imitations.
• Route. When a message asks you to sign in, do not use its link. Open the site yourself, the way you did at registration, and sign in there. If the message was genuine, whatever it describes will be waiting in your account.

Scamwatch, run by the National Anti-Scam Centre, publishes descriptions of current methods and takes reports from the public. It is worth reading once before you register anywhere, and it is where to report a message that turns out to be a scam.

Two-factor authentication

Two-factor authentication means that signing in needs your password plus a second piece of evidence, usually a code from an application on your phone. It is the single most useful setting on a game account, because it makes a stolen password insufficient on its own.

Most publishers in this category offer it in the account or security section of their website. Turn it on at registration, and keep the recovery codes the service gives you somewhere outside the computer — printed, or in the password manager. Those codes are the way back in if the phone is lost.

Shared computers and saved logins

On a computer used by several people, a game account that stays signed in is available to everyone who sits down at it. That matters most where a payment method is saved against the account, which is Step 5's subject, and it matters for chat and friend lists as well.

Decide deliberately whether the account stays signed in, and whether the browser offers to remember the password. Neither choice is wrong. A household where everyone knows which choice was made has far fewer arguments than one where it happened by default.

What happens to the details you give

The publisher keeps what you provide, and its own privacy policy governs what it does with it. Read that policy's sections on what is collected, who it is shared with, and whether the data is held overseas. Those three answers tell you most of what you need.

Australian privacy law gives people rights over personal information held about them, and the Office of the Australian Information Commissioner publishes plain-English material on what those rights are and how to complain. Whether a particular overseas publisher falls within Australian jurisdiction is not something this course can tell you; the OAIC's own material is the place to start.

The example household at this step

What the vendor of Enlisted states

The registration for Enlisted follows the pattern described above: an account is created, the email address is confirmed, and the game is then launched for the first time. The vendor's material describes this as registration with confirmation of the email address followed by logging in to the game, on desktop computers running Windows, macOS or Linux.

Everything else about its sign-up — which fields are required, what its privacy policy says, which security options it offers — is on its own site, and this course does not describe its screens. The checklist below works on any registration in this category.

Visit the Enlisted website — opens in a new tab.

Paid affiliate link: a commission is paid to LOKGROUP s.r.o. if you register through it. Your registration is unchanged by that, and so is this step.

Before you move on

Checklist for Step 3