Step 3 — Registering and confirming an email address

Step 3 of 5

Registration takes two minutes and sets up consequences that last for years. The address you give becomes the way you recover the account; the password you choose decides how easily someone else can take it; and the confirmation message that arrives afterwards is exactly the kind of message that scammers imitate. This step handles all three carefully.

None of it costs anything, and none of it requires software beyond a browser and an email account you can read.

Choosing the address

Use an address kept for game and entertainment accounts, not the one attached to your bank, your tax affairs or your employment. The separation does three useful things: it keeps promotional mail out of an inbox where you need to notice things; it means a breach at a game publisher does not hand anyone the address tied to your financial life; and it makes it obvious, later, that a message claiming to be from a bank but arriving at your gaming address is not genuine.

Any ordinary mail provider is fine. What matters is that you can still read the mailbox in two years. A work address fails that test the day you change jobs, and so does an address belonging to an internet plan you might leave.

If the player is a child or a teenager, think about who holds the recovery address. An arrangement where a parent's address receives account recovery mail is simple at the start and awkward to add later. The eSafety Commissioner publishes general guidance for families on setting up online accounts together, which is a reasonable thing to read before you fill in a form on a child's behalf.

Building a password worth having

The single most important rule is not complexity. It is that this password is used here and nowhere else. Reuse is what turns one company's breach into a problem for every account you own, because the stolen pairs of address and password are tried automatically against other services.

The Australian Cyber Security Centre's general advice for individuals, published at cyber.gov.au, is to use long passphrases: several unrelated words strung together, which are far easier to remember than a short string of symbols and considerably harder to guess. Four unrelated words is a sound starting point, and it does not need to mean anything to anyone but you.

Avoid anything a stranger could learn about you in ten minutes: a pet's name, a street, a birth year, a football club. Avoid the word "password" in any disguise, and avoid substituting digits for letters in an ordinary word, because that pattern is the first thing guessing software tries.

Where to keep it

A password you cannot remember is no use, and a password reused because it was memorable is the problem described above. There are two workable answers.

The first is a password manager: a program that generates and stores a different password for each account, protected by one passphrase you do remember. Most browsers and both major desktop operating systems include one at no cost, and the general advice from the Australian Cyber Security Centre discusses how they work. Using the one already built into the system you have is a perfectly respectable choice.

The second is paper. A notebook in a drawer at home is not fashionable advice, but it is resistant to every online attack, and for a household where one adult manages a few accounts it works. What does not work is a text file on the desktop called passwords, or a note in a phone with no screen lock.

Two-factor sign-in, explained plainly

Two-factor authentication, often shortened to 2FA or called multi-factor authentication, means proving who you are twice: once with something you know, the password, and once with something you have, usually a code from an app on your phone or a code sent to you. Someone who steals the password alone still cannot sign in.

Turn it on if the game offers it. It is usually in account settings under "security". A code generated by an authenticator app is stronger than a code sent by text message, because text messages can be intercepted or redirected, but a text-message code is still a great deal better than nothing.

When you switch it on, most services show a set of recovery codes. Write them down and keep them with the password. They are what gets you back in when the phone is lost, and they are generated once.

Accounts for online games are a common target precisely because they accumulate value over time. Treating one like an account that matters is proportionate, not paranoid.

The confirmation message

After the form is submitted, most publishers send a message to the address you gave and will not finish setting up the account until you act on it. That is the double opt-in pattern introduced in Step 1, and it protects both of you: it proves the address exists and that it belongs to the person registering.

The sequence is always the same shape. You submit the form; a message arrives within a few minutes; you open it and either follow its confirmation link or copy a short code back into the still-open browser tab; the account becomes active; you sign in for the first time.

In the vendor's own description of Enlisted, this is exactly what is asked of a new player: register, confirm the email address, then sign in to play. The vendor does not state anything further about that process, and neither does this course.

Visit the Enlisted website Paid affiliate link. This site is paid a commission if you register after following it; what you pay is unaffected, and the advice in this step is the same either way.

Leave the registration tab open while you check your mail. Many confirmation flows expect you to return to the same tab, and closing it is the most common reason a code appears to stop working.

Telling a real confirmation message from a fake one

A registration is one of the few moments when you are actively expecting an email with a link in it, which is why imitations of these messages are common. The defence is a habit rather than a tool.

• Did you just ask for it? A confirmation message you did not trigger is either someone typing your address by mistake or an attempt to make you click. Either way, the answer is to ignore it, not to follow it.
• Read the sender's domain, not the display name. The name beside a message is decoration and can say anything. The part after the @ is what matters, and it should be the publisher's own domain.
• Hover before you click. On a desktop computer the real destination appears in the status bar at the bottom of the window. A mismatch between the words and the destination is the clearest warning sign there is.
• Treat urgency as suspicious. Genuine confirmation messages do not threaten to close an account in two hours. Manufactured time pressure is a technique, not an accident.
• Never type a password into a page you arrived at from an email. If you believe something needs attention, open the site yourself by typing its address.

Scamwatch, run by the National Anti-Scam Centre, describes the approaches currently being reported in Australia and takes reports at scamwatch.gov.au. Reading its current material once a year is a cheap way to keep the habit fresh, and reporting something costs nothing.

What you are handing over, and who regulates it

A registration form of this kind usually collects an email address, a display name, a password and a country, and the service then records technical information such as the address your connection uses. Publishers set out what they collect in their own privacy policy, which is linked from the registration page and is worth opening once before you submit.

In Australia, the handling of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, overseen by the Office of the Australian Information Commissioner at oaic.gov.au. Many game publishers are based overseas, and whether and how those rules apply to a particular overseas business is a question of fact rather than something this course can answer for you. The OAIC's own material is the place to start if you want to understand your position.

The practical point is narrower: give the minimum the form actually requires. Optional fields are optional, and a date of birth or a mobile number you were not obliged to supply is information you have chosen to hand over.

If the message never arrives

1. Wait five minutes. Delivery is not instant and the resend button rarely helps in the first minute.
2. Check the junk or spam folder, and any "promotions" category your mail provider applies.
3. Confirm the address you typed. A transposed letter is the usual culprit, and some registration forms will happily accept an address that does not exist.
4. Use the site's own resend function, from the tab you still have open, rather than registering a second account.
5. If a second attempt fails, contact the publisher's support through its own website. Do not search for a support phone number; fake support contacts are a recognised scam pattern.

Before you move on

You should now have an active account tied to an address you control, a password used nowhere else, recovery codes written down somewhere sensible, and a clear idea of what a genuine message from the publisher looks like.

Step 4 is the first time anything is downloaded. Have your four figures from Step 2 beside you.

Checklist: Roll call for Step 3

1. 3AThe address I registered with is one I will still be able to read in two years.
2. 3BIt is not the address attached to my bank, my tax affairs or my employer.
3. 3CMy password is a long passphrase used on this account and nowhere else.
4. 3DIt is stored in a password manager or written down somewhere physically secure.
5. 3ETwo-factor sign-in is switched on if the publisher offers it.
6. 3FThe recovery codes are written down and kept with the password.
7. 3GMy display name does not reveal my real name, school, workplace or suburb.
8. 3HI filled in only the fields the form actually required.
9. 3II checked the sender's domain before acting on the confirmation message.
10. 3JI have confirmed the address and signed in once successfully.
11. 3KIf a child is the player, an adult holds the recovery address.