Brief 05-3Step 3 of 5

Step 3 — Registering, confirming your email and staying out of trouble

The sign-up form takes ninety seconds. The decisions behind it — which address, which password, whether to turn on a second factor — are the ones that determine whether this account is still yours in three years. This step is about making those decisions once, properly.

Choosing the address

The email address you register with is the master key to the account. Password resets go to it. Security warnings go to it. If a dispute ever arises about who owns the account, control of that inbox is the evidence that settles it. Choose accordingly.

A work address is a poor choice, because you lose it when you change jobs, and because your employer can read it. An address belonging to a school is worse, for the same reason on a shorter timescale. An address tied to an internet service provider is also fragile, since it often disappears if you switch providers. A personal address at a mainstream provider that you expect to keep is the ordinary right answer.

Some people make a separate address used only for games and similar sign-ups. That is a reasonable habit: it keeps the noise out of the inbox that matters and makes a suspicious message easier to spot, because almost nothing should arrive there. The cost is one more inbox to check and one more account to secure. Either approach is fine, provided you can still get into it next year.

A password you use nowhere else

The single most useful rule about passwords is that each important account gets its own. The reason is not that attackers guess well. It is that lists of addresses and passwords leak from other services, and the leaked pairs are then tried in bulk against every popular site. If the password on your game account is the same one you used on a forum that leaked in 2019, the strength of the password is irrelevant — it is already known.

On what makes a good one, the practical advice from the Australian Cyber Security Centre is to prefer length over complexity: a passphrase of several unrelated words is both stronger and easier to remember than a short string of substituted characters. Their guidance pages are plain enough to read in one sitting, and they are written for ordinary people rather than for administrators.

Three things not to do. Do not reuse the password from your email account, because that is the account that can reset everything else. Do not build the password out of things a stranger can look up — a surname, a birth year, a team. And do not type it into a page you reached from a link in a message; go to the site yourself.

Where to keep it

If every account has its own long password, you cannot remember them all, and you should not try. The two workable answers are a password manager, or paper.

A password manager is a program that stores passwords under one master password and fills them in for you. Most browsers now include one. A dedicated manager usually offers more, including a check for passwords you have reused. The trade-off is real and worth stating plainly: everything is behind one master password, so that master password must be long, unique, and never reused.

Paper is not a joke. A notebook kept in a drawer at home is beyond the reach of anyone on the internet, which is where nearly all the risk is. It fails against housemates, burglary and fire, so it suits a household where those are the smaller worries. What does not work is a file called passwords on the desktop, or a note in an email to yourself.

Two-factor sign-in

Two-factor authentication — also called multi-factor authentication, 2FA or MFA — means that knowing the password is not enough to get in. A second thing is required: a code from an app on your phone, a code sent by message, or a small hardware key. Many game publishers offer it, and some offer small in-game rewards for switching it on.

An authenticator app is generally the better of the common options, because codes sent by text message can be intercepted if someone takes over your phone number. Whichever you choose, the important part is the recovery codes the service shows you when you turn it on. Those are the way back in if you lose the phone. Write them down and keep them somewhere other than the phone.

Turn this on for the email account first, and the game account second. The order matters: an email inbox without a second factor undoes the protection on everything that resets through it.

Filling in the form

1. Go to the publisher's website by typing the address yourself or using a result you have checked, not by following a link in an email or a message from someone you do not know.
2. Check that the address in the browser bar is the publisher's own domain and that the connection is secure before you type anything.
3. Enter the email address you chose in 3.1 and read it back once. A typo here means the confirmation message goes to a stranger.
4. Enter a password used on no other account, taken from your manager or written in your notebook as you create it.
5. Choose a display name. This is the name other players will see, so avoid anything that identifies you — your full name, your school, your suburb. The eSafety Commissioner publishes practical advice on what to keep out of a public profile.
6. Give only what is required. Fields marked optional are optional; a date of birth is often required for age-rating reasons, but a phone number, a postal address or a real name usually is not.
7. Read what you are agreeing to, at least as far as the sections on account termination and refunds, before you submit.
8. Submit, then go to your inbox and wait a few minutes. Confirmation messages are not always instant.

The confirmation email, and the fakes that imitate it

A genuine confirmation message arrives shortly after you submit the form, comes from the publisher's own domain, and asks you to do one thing: confirm the address, usually by following a link or entering a short code. It does not ask for your password. It does not ask for payment details. It does not threaten to delete anything within a deadline.

The fakes imitate exactly this moment, because it is the one time you are expecting a message from a company you have just dealt with. Scamwatch, run by the National Anti-Scam Centre, describes this family of attacks and takes reports of them. The checks below are the ones that cost you nothing.

Reading a confirmation message

Sender domain	Look at the text after the @ sign, not at the display name. A display name is free text and can say anything.
Where the link goes	Rest the pointer on it and read the address shown by the browser. If it does not go to the publisher's domain, do not follow it.
What it asks for	Confirming an address never requires your password or a payment. Any request for either is the end of the conversation.
Timing	If a confirmation arrives when you did not just register, somebody typed your address into a form. Do nothing and delete it.
Urgency	Deadlines and threats of deletion are a pressure technique. A real confirmation link simply expires quietly.
A safer route	If in doubt, ignore the message, go to the site yourself, sign in, and look for the resend-confirmation option in the account settings.

Once you have confirmed, sign in once to check that the account works. For the example game used in this course, the material supplied to us describes the sign-up as complete at exactly that point: registered, email confirmed, logged in. That is the shape of the thing, and it is the same shape almost everywhere in this category.

If something has already gone wrong

Suppose you followed a link you should not have, and typed a password into it. Change that password immediately, starting with your email account if the same password was used there. Then change it anywhere else it was reused. Then turn on a second factor on both accounts.

If money was involved, contact your bank straight away; they can sometimes act quickly on a recent transaction. Reports can be made to Scamwatch, and the Australian Cyber Security Centre publishes step-by-step guidance on what to do after an account has been taken over. Reporting is useful even when nothing can be recovered, because it is how the pattern becomes visible to the people whose job it is to act on it.

None of this means you are under attack right now. It is the ordinary maintenance of a normal online account, and it takes an afternoon once.

Before you move on

At the end of this step you have a working account on a publisher's site, reached by typing their address yourself, protected by a password that exists nowhere else, recorded somewhere you can find it, with a second factor switched on and the recovery codes stored off the phone. Nothing has been installed yet. That is Step 4.