Step 4

Step 4 of 5

Making an account and checking it works

This is the step where something is actually created. The work is small, because the decisions were made in Steps 1 to 3. What is left is doing it in an order that you will not regret in six months.

What an account is, and why it matters more than the install

The program on your computer is replaceable. If the drive fails, you install it again. The account is not replaceable: it holds every item you have earned, everything you have paid for, and your standing with other players. Losing access to it is the one failure in this whole course that cannot be undone by trying again.

Account recovery, in nearly every online game, runs through the email address you registered with. If you lose access to that email address, you usually lose access to the account too, regardless of how well you remember the password. This single fact should decide which email address you use, and it is why that choice comes before the password.

It also means the account is worth a few minutes of care that the rest of the process does not need. Ten minutes spent on Step 4 is the cheapest insurance in the course.

The order of operations

The following sequence applies to online PC games generally. Individual vendors arrange their screens differently and use different wording, so treat this as the order of the decisions rather than a tour of any particular interface.

1. Reach the sign-up page from the vendor's own site. Type the address yourself, or follow a link you have already checked. Do not sign up through a link in an unexpected message.
2. Choose which email address the account will use. An address you control, will keep for years, and whose own password you know. If a child is playing, consider an address an adult can also reach.
3. Choose a long, unique password. Not one you use anywhere else. Length matters more than symbols.
4. Choose a display name that is not your real name. Other players will see it. It should not reveal who you are, where you live, your school or your workplace.
5. Verify the email address. Open the message and follow the link. Until this is done, many accounts cannot be recovered at all. Many vendors also treat an account as inactive until it is verified.
6. Turn on two-factor authentication immediately, before you play, while you are still in the settings and still paying attention.
7. Install the client from the vendor's own site and let the first update finish before expecting anything to work.
8. Run the first-launch checks listed further down this page.

Passwords and two-factor authentication

A password is unique if it is used in exactly one place. That is the property that matters, more than any rule about capital letters, because the common way accounts are lost is that a password exposed somewhere else is tried here. A long passphrase of several unrelated words, used nowhere else, is both stronger and easier to type than a short mangled word.

Two-factor authentication, often shortened to 2FA, means that logging in needs your password plus something else: a code from an application on your phone, a code sent by text message, or a physical key. It is the single most effective thing you can switch on, because it makes a stolen password insufficient on its own.

Where a vendor offers a choice, an authenticator application is generally preferred over text messages, because text messages depend on your phone number remaining under your control. The Australian Cyber Security Centre publishes free, plain-language guidance on passphrases and multi-factor authentication for individuals, and it is a better reference on this than any games site, including this one.

Getting to the right page in the first place

Game accounts are a target precisely because they have value, and the usual method of attack is not technical. It is a message or a page that looks like the vendor and asks you to log in. Three habits deal with nearly all of it.

Reach login pages by typing the address or using your own bookmark, rather than by following a link in an email, a chat message or an advertisement. Treat any message about your account that creates a sense of hurry — a suspension, an expiring reward, a verification deadline — as something to check by logging in separately rather than by clicking. And accept that a genuine vendor will never need your password sent to them, by any channel, ever.

Scamwatch, run by the National Anti-Scam Centre, collects reports of scams in Australia and publishes current examples and advice on what to do if you have been caught by one. If something has already gone wrong, that is where to start.

First-launch checks

The first time a large online game starts is the occasion when most new players conclude something is broken. Usually nothing is. These checks, in this order, settle it.

The worked example household

The product used as this course's example

For the game this course refers to by name, the affiliate programme states that the action it pays us for is a reader creating and activating an account, and that the game runs on desktop computers — Windows, macOS and Linux. We have not been given its sign-up screens, its security options or its recovery process, so the sequence above is written for the category rather than as a tour of that vendor's interface. Use the vendor's own support pages for the specifics.

Visit the World of Tanks websitePaid affiliate link. Multi.kuk.shop s.r.o. is paid a commission if you create and activate an account after following it; your cost is unchanged either way. Everything in this step can be done at any vendor, and the course does not need you to use this one.

Step 4 checklist