How do you keep a game account, and what do you do if it goes wrong?

Why game accounts get targeted

Three reasons, and they are worth knowing because they explain the shape of everything that follows. An established account can be sold, because progression takes time and some people would rather buy it. A payment method saved on an account can be used. And an account with a long friends list is a convenient place to send messages from, because a link from someone you have played with for two years gets clicked far more often than a link from a stranger.

None of this means anything is wrong with your account. It means the effort of setting it up properly, once, is worth more here than in most software.

Passphrases, and the one that matters most

The Australian Cyber Security Centre publishes the plain-English version of this guidance for individuals and families, and it is worth reading in its own words. The short form is that length beats complexity: a passphrase made of several unrelated words is both harder to break and easier to remember than a short password full of substituted characters.

The rule people skip is uniqueness. A passphrase used on two sites is only as safe as the weaker one, and gaming forums, fan wikis and mod sites are not built to the same standard as a bank. Reuse is how an old forum breach becomes a stolen game account years later.

Above all, the email address attached to the account is the master key. Anyone who controls that inbox can reset the game password, and usually the payment details with it. It deserves the longest passphrase you have and multi-factor authentication before anything else does.

The patterns that turn up in every game community

The support message

A message claiming to be from a moderator or support staff member, saying the account has been reported and will be suspended unless you verify it. Real support does not ask for a password, and real support does not contact you first through in-game chat or a social account.

The giveaway or beta invitation

A link offering premium currency, a rare vehicle or early access, which leads to a login page that looks exactly right. The page is a copy. The address bar is where the difference shows.

The trade that needs your login

Any arrangement requiring you to hand over account details to complete it. There is no legitimate version of this, even between friends, and account sharing usually breaches the terms of service regardless of outcome.

The modified client

A download promising better performance, extra features or removed restrictions. It is software of unknown origin, running with your permissions, on the computer where you also read email.

The friend with a favour

A message from an account you know, asking you to click something or vote for something. If it reads slightly unlike them, it probably is not them.

Setting the account up properly, once

• Create the account on the publisher's own domain, and check the address bar before typing anything.
• Use a passphrase that is not used anywhere else, and store it in a password manager or somewhere physically safe.
• Use an email address you will keep, and secure that address at least as well as the game.
• Turn on multi-factor authentication for both, if the option exists.
• Do not save card details on the account unless you buy regularly.
• Keep the recovery details current — an old mobile number on the account is a locked door with the key thrown away.
• Download the client and any updates from the publisher's site only.

If an account is compromised

Order matters here, because fixing things in the wrong order lets an intruder undo the fix.

1. Secure the email account first. Change its password, check its forwarding rules and recovery options, and sign out of all sessions. While someone else controls the inbox, every other reset is reversible.
2. Change the game password and, if the publisher offers it, sign out of all devices.
3. Turn on multi-factor authentication if it was not already on.
4. Check payment activity on the account and on the card. Contact your bank if anything is unfamiliar — they can act faster on a recent transaction than on an old one.
5. Contact the publisher's support desk through their own website. Expect to prove ownership with purchase receipts or the original registration email, which is precisely why those are worth keeping.
6. Report it. Cybercrime affecting Australians can be reported through the Australian Cyber Security Centre, and scams through Scamwatch, run by the National Anti-Scam Centre. Reporting will not usually recover an account, but it is how these operations are tracked and shut down.

What publishers know about you, and what this site does not

Registering for an online game means handing over at least an email address and a nickname, and playing means the publisher records how and when you play — they need to in order to run matchmaking and stop cheating. Most also collect technical information about the device. What any particular publisher does with it is set out in their own privacy policy, which is worth a scan before you sign up rather than after.

If you are in Australia and an organisation covered by the Privacy Act mishandles your personal information, the Office of the Australian Information Commissioner is the body that explains your rights and handles complaints. Its site sets out how access and correction requests work, and the process for complaining when an organisation does not resolve something directly.

For our part, Vanguard Digital collects nothing. There is no form anywhere on this site, no account, no newsletter and no tracking of any kind — no analytics, no advertising pixels, and no cookies at all. If you email us, we have your email; otherwise we do not know you were here beyond the ordinary server log our host keeps. The privacy policy and cookie policy spell that out in detail, and there is nothing in either that describes collection we do not actually do.

Accounts for younger players

If the account belongs to a child in your household, the practical questions are who controls the recovery email, whether purchases can be made without an adult, and what chat is enabled. The eSafety Commissioner publishes advice for parents and carers on online gaming, including how to report abusive or predatory behaviour. The classification page here covers the game-content side of the same decision.