Creating and activating an account you will not lose

Step 4 of 5

An account in a long-running online game accumulates years of progress, and in many cases money. Everything in this step is aimed at one outcome: that in three years you can still sign in, even if you have forgotten the password, changed computers and lost the original email. Getting that right takes about twenty minutes once, at the beginning.

The order to do things in

Sign-up flows differ between publishers, but the sequence underneath them is the same across the category: an email address is registered, a password is set, a message is sent to that address, a link or code in that message confirms the address, and only then is the account fully usable. That confirmation step is what "activating" means. An account that has been created but not activated is often limited or, after a while, discarded.

Because the email address is the root of everything — it is where password resets go and where the activation message arrives — it is the first decision, not an afterthought.

Choosing the email address

Three qualities make an address suitable. You must be able to sign in to it today, you must expect to be able to sign in to it in several years, and it must not be an address you share with other people.

That rules out a work address, which you lose when you change jobs, and an address belonging to a school, a university or an internet provider you might leave. A personal address at a major provider that you already use for important things is the ordinary right answer.

A separate address created specifically for games is a reasonable alternative, with one condition: it has to be an address you will actually keep checking. An abandoned mailbox is worse than a shared one, because the password reset arrives somewhere you never look.

Choosing the passphrase

A passphrase is simply a password made of several unrelated words rather than one word with substitutions. Length is what makes it hard to guess, and words are what make it possible to remember.

Two rules carry nearly all the value. The passphrase must be unique to this account, not reused from an email account, a bank or a shopping site. And it must be long. The Australian Cyber Security Centre publishes general guidance on passphrases and on protecting accounts at cyber.gov.au, and for anything about how to construct and store credentials it is a better source than a game's own help page.

A password manager — the one built into your browser is a reasonable starting point — removes the need to remember anything but one strong passphrase. If you prefer paper, paper kept somewhere only you can reach is not a foolish option either; the real risk for a game account is reuse across sites, not somebody searching your desk.

Two-factor authentication

Two-factor authentication means that signing in needs both the passphrase and a second, changing code — usually from an app on your phone, sometimes by email. It matters more for game accounts than people expect, because accounts with progress and purchases in them are worth stealing and are traded.

If the publisher offers it, turn it on at sign-up rather than later, and write down or print whatever recovery codes are given to you at that moment. Those codes are the way back in if the phone is lost, and they are usually shown exactly once.

The activation message, and what it is for

The activation message does two jobs. It proves that the address you typed is real and reachable, which protects the publisher from accounts created with mistyped or invented addresses. And it proves to you that password resets will actually arrive, which is the thing that matters on the day you need one.

If it does not appear within a few minutes, the ordinary causes are a typing error in the address, a spam or junk folder, or a mail provider that is slow. Request it again from the publisher's own site, not from a link in another message. If it still does not arrive, check the address letter by letter before creating a second account — duplicate accounts on the same address are a common tangle.

The affiliate arrangement behind this site is paid when a reader creates and activates an account through the link, which is one reason this page explains activation carefully; it is also, genuinely, the step most often left half-done.

The procedure, in order

1. Decide the email address using the three qualities above, and sign in to it so you know the password works.
2. Prepare the passphrase before you start: several unrelated words, unique to this account, stored in a password manager or written down somewhere private.
3. Go to the publisher's own website by typing the address or following a link you trust, and begin the registration there rather than from an advertisement.
4. Enter the address and passphrase, and read the consent boxes rather than clicking through them — one of them is usually marketing email.
5. Open the activation message and follow its link or enter its code. Nothing is finished before this.
6. Turn on two-factor authentication if it is offered, and save the recovery codes immediately.
7. Set the privacy and chat options you decided on in Step 3, before the first session rather than after.
8. Record where the account lives: the address it is registered to, the date, and where the recovery codes are kept. One line in a notebook is enough.

If you want to see what a registration flow of this kind looks like on a large title, you can visit the World of Tanks website, where sign-up and login are the first thing offered.

Paid affiliate link: this site is paid a commission if you create and activate an account after following it. You pay no more than you otherwise would, and every instruction above works the same on any publisher's site.

The messages that are not from the publisher

Once an account exists, messages will arrive about it. Most are ordinary. A few are attempts to take the account, and they follow recognisable shapes: a warning that the account will be closed unless you confirm it, an offer of free in-game currency, a notice that you have won something, a claim that a purchase needs verifying.

The habit that defeats all of them is the same one: never sign in from a link in a message. Open a new tab, type the publisher's address yourself, and look for the same notice inside your account. If it is real, it will be there. If it is not, you have lost nothing.

Attempts of this kind can be reported to Scamwatch, which is run by the National Anti-Scam Centre and collects reports from the public. Reporting is free and takes a few minutes.

If the player is under 18

Step 3 settled whose name the account is in. Two practical consequences follow here. The recovery address should be an adult's, so that a lost password is an adult's problem to solve. And any payment method should not be stored on the account by default, which is a setting rather than a conversation.

The eSafety Commissioner publishes guidance for parents and carers on games and online contact, including how to report serious online abuse. It is the public body for this and its material is free.

The household, at Step 4

The hypothetical household registers the account to an adult's long-standing personal email address, with a four-word passphrase stored in the browser's password manager. Two-factor authentication is switched on during sign-up and the recovery codes are printed and put in the drawer with the passports.

The activation message takes about a minute to arrive. They set profile visibility to private and turn voice chat off before the first session, as agreed in Step 3, and write one line in the household notebook recording the address the account is registered to and where the codes are.

The household is an illustration written for this course, not a real family, and it reports nothing about how the game turned out.

Checklist 4 — the account

• Choose an email address you can sign in to today and expect to control in several years.
• Confirm that address is not shared with anyone else and is not tied to a job or a school.
• Prepare a passphrase of several unrelated words, used for nothing else.
• Decide where the passphrase will be stored — a password manager or somewhere private on paper.
• Begin registration from the publisher's own website, typed or from a link you trust.
• Read the consent boxes before accepting, including the marketing email one.
• Open the activation message and complete the confirmation. The account is not finished until this is done.
• Turn on two-factor authentication if it is offered, and store the recovery codes immediately.
• Apply the privacy and chat settings decided in Step 3 before the first session.
• Write one line recording the registered address, the date, and where recovery codes are kept.
• Agree the rule: never sign in from a link in a message.

All six checklists on one printable page →