Guide · Accounts

Securing a new online game account

Registering for an online game takes a minute. Protecting the account properly takes only a little longer, and it is far easier to do on the first day than after something has gone wrong. This guide follows the public advice published by the Government of Canada and applies it to the specific situation of a new game account.

Why game accounts are worth protecting

A game account can seem trivial when you create it. Over time, though, it can come to hold a saved payment method, items you have bought, a balance of game currency and a long history of progress. It may also be linked to an email address that you use for other things. That combination is why game accounts attract the same phishing and takeover attempts as other online accounts.

None of this means a new account is at risk simply by existing. It means the ordinary good habits that protect an email or banking login are worth applying here too.

Setting up the account

1. Register only on the publisher's own website or inside its official launcher. Type the address yourself or use a link you have reason to trust. Check the address bar before entering any details.
2. Choose the email address deliberately. Some people use a separate address for games and shopping so that game-related mail is easier to recognize and less mixed in with personal messages. Either way, make sure the email account itself is well protected, because it is the route to resetting your game password.
3. Use a passphrase that you use nowhere else. The Canadian Centre for Cyber Security's best practices for passphrases and passwords explain why length and uniqueness matter, and how a password manager can help you keep track.
4. Turn on multi-factor authentication if the game offers it. Get Cyber Safe's page on multi-factor authentication describes the common methods, such as an authenticator app or a code sent to you.
5. Confirm your email address when the game asks. It makes recovering the account possible later.
6. Save the recovery codes, if the game provides them, somewhere you will find them and others will not.
7. Review privacy and communication settings, including who can message you and whether your profile is visible to strangers.

Recognizing phishing aimed at players

Most attempts to take over a game account start with a message that tries to get you to sign in on a fake page or to hand over a code. They often borrow the look and tone of the game itself. Get Cyber Safe's guidance on securing your accounts covers the general signs; in games they commonly take the forms below.

The simplest defence is a habit: never sign in through a link in a message. If a message claims to come from the game, close it, open the game or the publisher's website yourself, and check there.

Keeping the computer side in order

Account security and device security go together. A strong passphrase does not help much if the computer has malicious software that records keystrokes. The basics are well covered by public guidance and do not require any particular product:

• Keep your operating system, browser, graphics driver and game launcher updated.
• Use the security features that come with your operating system, and keep them switched on.
• Install games and mods only from sources you trust, such as the publisher's site or an established store.
• Be wary of programs that promise cheats, unlocks or unlimited currency. They are a common way to spread malicious software, and using them usually breaks a game's rules as well.
• Back up anything important on the computer, separately from the game.

The Canadian Centre for Cyber Security publishes more detailed advice for individuals as well as for organizations, and is a sound reference if you want to go further.

If you lose access to an account

If you cannot sign in, or you notice activity you did not carry out, work through these steps in order.

1. Try the official password reset on the publisher's website. If it works, choose a new passphrase you have never used.
2. Secure your email account next, since an attacker who controls it can reset other passwords too.
3. Contact the game's support team through its official website and explain what happened. Most publishers have a process for recovering compromised accounts.
4. Check your payment methods for purchases you did not make, and contact your card issuer if you find any.
5. Report fraud or scams to the Canadian Anti-Fraud Centre, especially if you lost money or shared financial information.
6. Turn on multi-factor authentication once you regain access, if it was not already on.

Settings inside the game and launcher

Beyond the password and sign-in method, most games and launchers have a settings area that is easy to overlook in the excitement of a first session. It is worth a few minutes once the account exists. Look for a list of devices or sessions currently signed in, and sign out any you do not recognize. Check whether purchases require the password to be entered again, and switch that on if it is offered. Review who can send you friend requests, messages and invitations, and whether your online status and match history are visible to everyone or only to friends. If the launcher offers to remember your password on a shared computer, decline. Finally, note where the account's security and recovery options live, so you can find them quickly if you ever need them in a hurry.

Personal information in games

Online games collect personal information when you register and while you play: your email address, payment details if you buy anything, and often chat logs and device information. Publishers describe this in their privacy policies, which are worth skimming before you register. If you have a concern about how a company handles your personal information, the Office of the Privacy Commissioner of Canada explains your rights under federal privacy law and how to raise a concern.

Within the game, share as little as you need to. A display name that does not include your real name, a profile that does not show your location and care with what you say in voice chat all reduce what a stranger can learn about you.

A ten-minute routine to repeat

Once every few months, or after any security news about a service you use, spend a few minutes on a quick review: confirm that multi-factor authentication is still on, check the list of signed-in devices if the game shows one, look over the purchase history, and update your passphrase if you have reused it anywhere. Small, regular checks are easier than a recovery process after the fact.