Entry · Consumer protection

Account safety and common scams

A game account accumulates value over years, which is why accounts are traded and why people try to take them. This entry describes the ordinary protections that work, the approaches most often used against players, and the Australian services that handle reports.

Why a game account is a target

Three separate things make an established account worth something to someone else. It contains progress that would take a long time to rebuild, which has resale value on grey markets. It often has a payment method attached, or at least a purchase history that suggests one exists. And it is tied to an email address and a password that a great many people reuse elsewhere, which makes it a stepping stone rather than a destination.

None of that is cause for alarm, and nothing about reading this page suggests anything has happened to any account of yours. It is simply the reason the ordinary precautions below are worth ten minutes when an account is created, rather than an hour of recovery later.

The protections that actually matter

The Australian Cyber Security Centre publishes step-by-step guidance for individuals and families on exactly these measures, and it is the best available reference on each of them.

• A unique passphrase. Long and unique beats short and complicated. The requirement that matters most is that the passphrase is used on this account and nowhere else, because reuse is what turns one breach somewhere unrelated into a lost game account.
• Two-factor authentication. Where the game or its account portal offers it, turn it on. An authenticator application is preferable to codes sent by text message, and recovery codes should be written down and kept somewhere physical.
• A dedicated email address. Using a separate address for game accounts limits what a compromise reaches, and makes unexpected mail easier to recognise as unexpected.
• A password manager. This is what makes unique passphrases practical across dozens of accounts, rather than an aspiration abandoned after the third one.
• Payment hygiene. Know which card is attached, and check the statement after the first purchase. Prepaid or virtual cards limit exposure where a service supports them.

Approaches used against players

These are described so they are recognisable, not to suggest any of them is happening to you.

Bonus code and promotion pages

A site offers codes for in-game currency or premium time and asks you to “log in to claim”. The login form is the point of the exercise. Codes issued by a publisher are redeemed on the publisher’s own site or inside the game client, never on a third party’s page. This is the reason the product entry in this library declines to promote a code whose stated lifetime has ended.

Currency generators

Any page offering to generate premium currency is describing something that does not exist: the currency is a record on the publisher’s server. What these pages collect is credentials, survey completions, or an installed program.

Account buying, selling and sharing

Almost all publishers prohibit transferring accounts, so the transaction has no protection on either side, and a seller who retains the recovery email can take the account back at any time. Sharing an account with a friend who plays better, in order to raise a statistic, has the same weakness.

Messages about a ban or a policy violation

Mail claiming your account is suspended unless you confirm details is a standard phishing pattern, because it produces a reaction before it produces thought. Open the game client or type the publisher’s address directly instead of following the link.

In-game contact from “support”

Staff do not ask for a password in chat, and do not need it. Treat any in-match or in-chat request for credentials, a code or a recovery email as a fabrication regardless of how the name is styled.

Modifications, skins and third-party tools

Some communities have well-known and permitted modification packages; downloads that arrive through a link in chat are a different matter. An unsupported tool can breach the game’s terms as well as carrying something unwanted.

If an account is compromised

1. Change the password on the email address attached to the account first. While that address is under someone else’s control, every other reset is undone as fast as you perform it.
2. Change the game account password and revoke active sessions where the service allows it, then enable two-factor authentication if it was not already on.
3. Contact the publisher’s support through its own site and ask for an account review. Include dates, times and anything you noticed.
4. Contact your bank if a payment method was attached, and ask about unauthorised transactions. Do this early — dispute windows are finite.
5. Change the password anywhere else the same one was used. This is the step people skip and the one that matters most.
6. Report it. Cybercrime can be reported through cyber.gov.au, and scams through Scamwatch, run by the National Anti-Scam Centre.

Where to take different problems in Australia

Each of those pages describes its own remit and reporting process, and each is worth reading from the source rather than from a summary. Reporting is useful even when nothing can be recovered: the pattern data is how these approaches are tracked and disrupted.

Where to read next

The economies entry explains what in-game currency is and why offers to sell it cheaply are implausible. Classification and parental guidance covers the household side, including chat and purchasing in games played by younger people.