Reference · Accounts

Keeping a game account secure

A collection RPG account represents months of accumulated progress and, for some players, money. The measures that protect it are ordinary and well documented, and the Australian government publishes most of them for free. This page collects them in the order they are worth doing.

General guidance based on publicly available advice from Australian government sources, linked throughout. It is not security advice for any specific situation. Last reviewed: 22 September 2026.

Binding the account first

Many titles let a new player start immediately as a guest, with the account tied to the device rather than to an identity. It is a convenient start and a poor place to stay. A guest account generally cannot be recovered if the device is lost, replaced or reset, and the vendor has no way to establish that it was ever yours.

Binding — linking the account to an email address or to an external identity the vendor supports — is the single measure with the best ratio of effort to protection, and it takes a minute. Do it before investing time, not after. If you later want to move between a desktop and a phone, a bound account is also the mechanism that makes it possible, as covered on the desktop and system basics page.

Use an email address you will still control in two years, and one you can access if the device running the game is unavailable. An address tied to an employer or an internet provider is a poor choice for the same reason.

Passphrases and what makes one strong

The Australian Cyber Security Centre's published guidance for individuals favours long passphrases over short complex passwords, and favours a different one for each account. Length contributes more to resistance than substitutions do, and uniqueness is what stops one disclosed password from opening several accounts.

• Use a passphrase of several unrelated words rather than a single word with characters substituted.
• Use a different one for the game account, the email address it is bound to, and the payment method attached to either.
• Store them in a password manager rather than in a note, a spreadsheet or a browser profile shared with others.
• Change one only when there is a reason to — a disclosure, a shared device, a suspicion — rather than on a routine schedule.

The email address matters as much as the game account, because it is the route through which the game account is recovered. An attacker with the email address generally does not need the game password at all. Protecting the mailbox first is the correct order of operations.

Multi-factor authentication

Multi-factor authentication asks for a second piece of evidence in addition to the password — a code from an application, a prompt on a registered device, or a hardware key. The Australian Cyber Security Centre recommends enabling it wherever it is offered, and its site explains the options in general terms.

Not every game vendor offers it on the game account itself. Where it is not offered, enable it on the email address the account is bound to, which achieves much of the same effect by protecting the recovery path. Where a choice of methods exists, an authenticator application or a hardware key is generally considered stronger than a code sent by text message.

Buying and selling accounts

A market exists for developed accounts, and it carries risks that the listing never mentions. Most titles' terms of service prohibit transferring an account, which means a purchased account can be closed without compensation if the vendor identifies the transfer. Beyond the terms, the practical problem is that the seller retains the recovery path: the original email address, the original security answers, and any linked identity. Recovery can be initiated long after the sale.

The same structure applies to services offering to play an account on your behalf, which require handing over the credentials, and to services offering discounted in-game currency, which generally obtain it through a payment method that may later be reversed — taking the purchase, and sometimes the account, with it.

None of this requires alarm. It requires only the observation that the cheaper route in this category is usually cheaper because someone else is carrying a risk that ends up being yours.

Offers aimed at players

Scamwatch, run by the National Anti-Scam Centre, collects reports and publishes current advice. Approaches aimed at players tend to share a small number of shapes, and recognising the shape is more durable than memorising examples.

A free grant of premium currency

Usually requires entering the account credentials on a page that is not the vendor's. Premium currency is the vendor's product; nobody else can grant it.

An urgent notice about the account

A message claiming a ban, a breach or a pending closure, with a link to resolve it. Check the account by opening the game directly rather than by following the link.

A trade arranged outside the game

An exchange conducted through a chat platform with payment in advance. There is no mechanism to reverse it and no vendor obligation to help.

A tool promising automation or guaranteed results

Software requiring credentials or modifying the client. This risks both the account under the title's terms and the machine it runs on.

Reporting in Australia

If something has gone wrong, several avenues exist and they handle different things.

1. Contact the vendor first through the support route on its own site. Account recovery, unauthorised access and disputed in-game purchases start there, and the vendor is the only party able to act on the account itself.
2. Report cybercrime through the Australian Cyber Security Centre, whose site sets out how to report and what happens next.
3. Report a scam to Scamwatch. Reports inform the National Anti-Scam Centre's published warnings even where an individual loss cannot be recovered.
4. Contact your bank immediately if payment details were disclosed. Speed matters more here than anywhere else in the list.
5. Serious online abuse — in-game chat, group channels or adjacent platforms — falls to the eSafety Commissioner, which operates complaint schemes and publishes guidance for families.
6. Mishandling of personal information by an organisation can be raised with the Office of the Australian Information Commissioner, after raising it with the organisation itself.

Common questions

Related reading

Spending and consumer rights covers disputed and unauthorised purchases. Desktop and system basics covers moving an account between devices. The glossary defines account binding and cross-progression.