Account safety for online game accounts

An account in a long-running online game accumulates years of progression, purchases and a name that cannot be replaced. This page describes how such accounts are typically lost, what reduces the likelihood, and which Australian body handles which kind of problem. It is general guidance written from public sources, not advice about your particular situation.

The short version

A unique password and multi-factor authentication on both the game account and the email address behind it prevent most account takeovers. Nearly all the rest arrive through a message that asks you to sign in somewhere. Scams can be reported to Scamwatch; practical security guidance comes from the Australian Cyber Security Centre.

Why game accounts are worth taking

The reason is unromantic: accounts have resale value. An account with a developed progression tree, purchased vehicles and an established name represents hundreds of hours that somebody else would rather not spend, and there is a market for them regardless of whether the publisher's terms permit transfers. A stolen account can also be used to run scams against the people on its friends list, who are far more likely to trust a message from a known name.

The practical consequence is that these accounts are targeted deliberately and generically, not because of anything the account holder has done. Treating a game login with the same care as an email login follows from that, and it is a reasonable habit rather than an anxious one.

How accounts are actually lost

Four routes account for the overwhelming majority of cases, and none of them is technically sophisticated.

A reused password: A password used on the game account was also used somewhere else, that other service suffered a breach, and the combination was tried against game accounts. This requires no attack on the game at all. It is the most common route by a wide margin.
A sign-in page that is not the publisher's: A message, an advertisement or a link in a chat channel leads to a page that resembles the publisher's login screen. The credentials entered go to whoever built the page. These pages are usually promoted with an offer of items, currency or beta access.
The email address behind the account: If the email account can be reached, password resets follow. An email address protected less carefully than the game account is the weak point in the chain, and it is frequently an old address the owner has half forgotten.
Software installed to help with the game: Modifications, cheats, currency generators and launchers from unofficial sources. A tool that promises an advantage in the game is a poor candidate for trust, and running one has consequences for the account beyond whatever the software itself does.

Measures that make a practical difference

A unique password on the game account. Unique means used nowhere else, which in practice means generated and stored by a password manager. This single measure removes the most common route.
Multi-factor authentication where the publisher offers it. An additional factor means a stolen password on its own is not enough. Turn it on when registering rather than intending to later.
The same protection on the email account. The email address is the recovery route for everything else. It deserves at least as much care as the account it protects.
Signing in only from the publisher's own site. Reach the login page by typing the address or using your own bookmark, not by following a link from a message or an advertisement. This habit defeats the second route entirely.
Nothing installed from an unofficial source. Game clients and updates come from the publisher.
No stored card details on the game account. If an account is compromised, the damage is bounded by what is reachable from it.

The Australian Cyber Security Centre publishes guidance for individuals on passphrases, multi-factor authentication and what to do about a compromised account. It is written for a general audience and is the sensible reference for the detail behind each point above.

Account trading and third-party marketplaces

Sites offering to sell accounts, currency or items for real money sit outside the publisher's terms in most cases, and that fact does more work than it appears to. Because the transaction is not recognised by the publisher, there is no arbitration when it goes wrong, no recovery of an account that is reclaimed by its original owner, and no recourse if the account is suspended for the trade itself.

The same applies to offers arriving through in-game chat or social media: free currency, a giveaway, an early access code, an offer to boost your account if you hand over your login. There is a straightforward rule that covers all of them. Nobody who needs your password is offering you anything. Scamwatch, operated by the National Anti-Scam Centre, publishes descriptions of current scam types and accepts reports.

Signals worth pausing on

A message creating a deadline: an account will be closed, a reward expires, a verification must happen today.
A login page reached by clicking rather than by typing the address yourself.
An offer of in-game currency or items in exchange for signing in somewhere.
A support representative who contacts you first and asks for a password or a one-time code. Publishers do not do this.
A web address that is nearly the publisher's, with an extra word, a different ending, or a hyphen inserted.

Which Australian body handles which problem

These services have distinct remits, and sending a problem to the wrong one mostly wastes your time.

Australian government services and what each one does. Links go to the official site in each case.
If the problem is	The relevant body	What it does
A scam, or an attempt at one	Scamwatch	Run by the National Anti-Scam Centre; collects reports and publishes information about current scams.
A compromised account or device, or general security questions	Australian Cyber Security Centre	Publishes practical security guidance and provides a reporting route for cybercrime.
Serious online abuse, image-based abuse, or a child safety concern	eSafety Commissioner	Australia's online safety regulator; handles reports and publishes guidance for parents and young people.
Mishandling of personal information	Office of the Australian Information Commissioner	Regulates privacy under the Privacy Act 1988 and receives privacy complaints.
A misleading claim or a purchase dispute	ACCC	Administers the Australian Consumer Law; state and territory fair trading offices handle individual disputes.

In every case the publisher's own support channel is the first stop for an account problem, because the publisher is the only party that can restore an account. The bodies above address the wider conduct rather than the individual account.

If an account is compromised

Order matters here, and the instinct to start with the game account is the wrong one.

Secure the email address first, including its password and its multi-factor settings. Everything else can be reset from there, by you or by whoever took the account.
Use the publisher's own account recovery process, reached by typing the publisher's address yourself.
Change the password on any other service where the same password was used. This is usually more places than people remember.
Check for unexpected charges on the payment method attached to the account, and contact your bank if any appear.
Report a scam to Scamwatch, and follow the ACSC guidance for a compromised account.

Keep the correspondence. Publisher support processes for account recovery generally ask for evidence of ownership, and original purchase receipts or the earliest registration emails are often what settles it.

Younger players and shared machines

Games in this category commonly include voice and text chat with people outside the household, and that is the part worth arranging in advance. Configure the chat and privacy settings in the client rather than assuming the defaults are restrictive, and make sure whoever is playing knows where the mute, block and report controls are.

The eSafety Commissioner is the Australian authority on this, with material aimed specifically at parents and carers and a formal route for reporting serious online abuse. For what a particular game contains, the Australian Classification Board publishes the classification decision and the consumer advice for titles classified in Australia.

Related pages on this site: the setup checklist puts these settings before installation, and the spending page covers payment controls in more detail.