Step 4 of 5

Setting up an account and checking it works

This step is a procedure rather than an explanation. It is written in general terms that apply to almost any online game, because every publisher arranges its own menus differently and a walkthrough of one company's screens would be useless for the next.

Have these ready first

Set aside thirty minutes and have four things to hand: the web address you wrote down in Step 3, the email address the account will use, a way to record a passphrase, and the phone or device that will receive the second-factor codes. Doing this in one sitting matters more than it sounds, because an account left half-configured is the one nobody comes back to.

One decision before you start: the account should be held by the person who can cancel the payment. In a household with children that is an adult, even when the child will do all the playing. This is not about trust; it is about who can act when something needs acting on.

The nine-part setup procedure

1. Start from the address you wrote down. Open the publisher's own site using the address recorded in Step 3. Not a link from a message, a chat, a video description or an advertisement. This single habit removes most of the risk in the whole process.
2. Decide which email address the account will use. Use an address an adult controls. A separate address used only for game accounts is a small amount of work that keeps game mail out of the main inbox and makes an unexpected message from the publisher easy to notice.
3. Create a passphrase used nowhere else. Long and unique beats short and complicated. The Australian Cyber Security Centre's advice on passphrases is at cyber.gov.au. Record it in a password manager, or on paper kept somewhere sensible at home — the common failure is not someone finding it, it is nobody remembering it.
4. Enter age details accurately. Give the real date of birth. Publishers apply age-based protections — restricted chat, restricted purchasing, different defaults — based on what you type, and an inflated age quietly switches those protections off.
5. Turn on multi-factor authentication immediately. Do it before you do anything else, while you are still in the settings. If the publisher offers an authenticator app as well as text messages, the app is generally the better option. Write down the recovery codes and keep them offline.
6. Set the chat and contact options deliberately. Find the privacy, social or communication settings and go through them one at a time: who may send messages, who may send friend requests, whether voice chat is on, whether the profile is visible to strangers. Choose each one rather than accepting whatever it came as.
7. Decide how payment will work. Three options, covered below. Whichever you pick, look for a purchase confirmation or store lock setting and switch it on, particularly if Step 3 found randomised paid items.
8. Install the client and let it finish updating. Download only from the publisher's own site or an official app store. Let the first update run to completion before anyone tries to play, because a half-updated client produces errors that look like faults and are not.
9. Test the account before anyone relies on it. Sign out and sign back in. Confirm the second factor actually prompts. Confirm a purchase cannot be made without the step you just configured. Then hand it over.

More on passphrases and the second factor

A passphrase is several unrelated words together rather than one word with substitutions. It is easier for a person to remember and harder for software to guess than the short, awkward passwords most people were taught to make. The ACSC publishes the national guidance on this and it is written for ordinary readers, not specialists.

The rule that matters most is uniqueness. If the game account shares a password with your email, then one breach anywhere becomes a breach everywhere, because the email address is how every other account is reset. If you do nothing else in this step, make the game password different from the email password.

Multi-factor authentication means a second check after the password: a code from an app, a message to a phone, or a prompt on a device you already hold. It is the single most effective thing available to an ordinary household, because it makes a stolen password insufficient on its own.

Payment, and the three household arrangements

There are three common arrangements, and the right one depends on who is playing.

• No payment method stored at all. The account cannot buy anything until someone deliberately enters card details. The most restrictive and, for a child's account, often the simplest.
• A prepaid card or gift card. Spending is capped by what is on the card. This gives a child some independence without an open line to the household account, and it makes the monthly number from Step 2 self-enforcing.
• A stored household card. Convenient for an adult playing alone. For a shared or child-used account, pair it with whatever purchase confirmation or password-on-purchase setting the publisher and the device both offer.

Whichever you choose, set a calendar reminder for any subscription's renewal date a few days before it falls. A subscription that renews unnoticed for a game nobody plays is the most common avoidable cost in this whole subject.

Device and store controls, beyond the game

The game's own settings are one layer. The device and the store it came from are another, and they are often stronger because they apply to everything rather than to one title.

On phones and tablets, the app store has purchase controls: requiring a password or biometric check for every purchase, or disabling in-app purchases entirely. On computers, the operating system has family or standard-user accounts that limit what can be installed and bought. On consoles, the platform holder has its own family settings with spending limits and play-time limits that work across every game on the machine.

The eSafety Commissioner publishes plain-language guides for parents and carers on the controls available across common devices and services, at esafety.gov.au. It is a better starting point than a search, because the guidance is written for Australian families and kept current.

One honest caveat: controls are a tool, not a substitute for knowing what is going on. They are most useful when the household knows they exist and why, rather than when they are installed quietly and discovered later.

Testing it, properly

Five minutes of testing now prevents a long evening later. Work through these deliberately, in this order:

1. Sign out of the game completely and sign back in. Confirm the second factor prompts, and that the code arrives where you expect.
2. Use the "forgotten password" link once, without completing it, to confirm the reset email arrives at the address you intended. A recovery path that was mistyped at sign-up is useless and silent.
3. Open the store or shop inside the game and start a purchase without finishing it. Confirm you are asked for whatever confirmation you configured.
4. Check the chat settings from the player's side rather than the admin side, and confirm they behave the way you expect.
5. Find the report-a-player function, so the person playing knows where it is before they need it.
6. Note the publisher's support page address with your records.

Step 4 checklist