Guide

Keeping a game account safe

Game accounts get taken over for ordinary, well-understood reasons. This page describes the mechanics calmly, sets out the habits that address them, and points at the Australian government services that publish the underlying advice and receive reports.

Nothing here suggests that any reader's account is currently at risk, and no page on a website is in a position to know that. The argument is simpler: the measures below take about twenty minutes in total, they apply to every account a person holds rather than to one game, and they are much easier to put in place before they are needed than afterwards.

How account takeovers usually happen

Four mechanisms account for most of it, and none of them is exotic.

Reused passwords

Credentials exposed in a breach of one service are tested automatically against others. A password used in two places is only as strong as the weaker of the two services holding it, and game accounts are tested often because they can be resold.

Phishing

A message or page that imitates a vendor and asks for a sign-in. In games the pretext is usually a gift, a tournament invitation, a moderation warning or a trade, and the link is sent through in-game chat or a chat platform rather than by email.

Unsafe downloads

Modifications, cheat tools, unofficial launchers and “free” copies obtained from aggregators are a long-standing route for software that reads credentials from a machine. Downloading only from the vendor or a storefront the vendor names removes most of this category.

The email account

Whoever controls the registered email address usually controls the game account, because that is where password resets go. An email account without its own strong protection is the weak point in every other account a person holds.

It is worth understanding why game accounts attract this attention at all, because the reason shapes the defence. An established account carries progression, items and sometimes a payment method, and all three have resale value to someone who never intends to play. That makes the account interesting on its own terms rather than as a route to something else, and it means the protection it deserves is closer to what a shopping account gets than what a forum login gets.

Passphrases and multi-factor authentication

Australian government advice on both is published for a general audience by the Australian Cyber Security Centre, whose personal security guidance covers how to construct a passphrase and how to turn on multi-factor authentication across common services. It is worth reading at the source rather than in summary, and it is not trying to sell anything.

The short practical form is this. A long passphrase made of several unrelated words is easier to remember and harder to attack than a short string with substitutions in it. Every account that matters gets its own, which in practice means using a password manager rather than memory. Where a service offers a second factor, an authenticator application is generally preferable to a code sent by text message, and the backup codes are stored somewhere other than the device that generates them.

Recognising the approaches aimed at players

Phishing directed at players tends to use a small set of pretexts, and knowing the set is more useful than inspecting each message for spelling mistakes.

• An offer of currency, items or early access in exchange for signing in through a link.
• A warning that an account will be suspended unless it is verified, delivered in chat rather than through the vendor's own client.
• An invitation to a tournament, a test or a beta, hosted on a site that resembles the vendor's but is not on its domain.
• A trade or gift that requires signing in on a third-party page first.
• A friend's account sending an unexpected link — a common pattern, because a taken-over account is used to reach its contacts.

The reliable defence is procedural rather than perceptual: never sign in through a link someone sent you. Open the vendor's client or type the address yourself, and check the notification there. Anything genuine will still be waiting.

Scamwatch, run by the National Anti-Scam Centre, publishes current scam patterns and is where an attempt can be reported.

If an account is taken over

Working in order matters, because changing the game password first is usually wasted effort if the email account is the one that has been reached.

1. Secure the email account first

   Change its passphrase, review its forwarding rules and recovery addresses, and turn on a second factor if it is not already on. Forwarding rules left behind by an intruder are easy to miss and quietly defeat every later step.

2. Reset the game account and end other sessions

   Change the password and, where the vendor provides it, sign out all devices or invalidate active sessions. Remove any stored payment method while you are there.

3. Tell the vendor, with detail

   Use the official support channel. Include the account identifier, the approximate time you lost access, and anything purchased or changed without your knowledge. Keep the reference number.

4. Deal with the money separately

   If purchases were made, contact the card issuer or payment provider as well, since their dispute processes have their own time limits. The spending guide covers the Australian consumer position.

5. Report it

   Cybercrime affecting Australians can be reported through the ACSC's site, and scams to Scamwatch. Reports rarely recover an account directly, and they are still worth making: they are what the public warnings are built from.

Recovery is easier if it was planned. Knowing which email address an account sits on, where the backup codes are and what the vendor's support channel is turns a bad afternoon into a short administrative task. None of that can be assembled while locked out.

If a vendor loses your information

A breach at a game vendor is a different problem from a takeover of your account, and it is handled by a different body. The Office of the Australian Information Commissioner regulates the Privacy Act 1988 (Cth) and administers the Notifiable Data Breaches scheme, under which entities covered by the Act must notify affected individuals and the Commissioner about a data breach likely to result in serious harm. The OAIC's site explains what to expect in a notification and how to make a privacy complaint if a vendor's response is inadequate.

Practically, a breach notification is the moment to change the passphrase on that service and on anywhere the same one was used, and to watch for messages that refer to the breach as a pretext — those follow reliably.