Everworks › In Australia › Account safety

Account safety for players

A game account in this category accumulates months of progress, which gives it a value outside the game and makes it worth someone else's attention. This page describes how those accounts are typically taken, in general terms, and what the sensible protections and the recovery steps are. It is written as ordinary guidance, not as a warning about your particular machine, which Everworks knows nothing about and cannot assess.

Why these accounts attract attention

Three reasons, none of them dramatic. A long-running account represents time that someone else would rather not spend, so there is a market for accounts. The credentials attached to a game account are often reused elsewhere, which makes the account a route to something more valuable. And the surrounding communities — chat servers, trading groups, fan sites — are places where strangers talk to strangers about accounts, which is the environment social engineering needs.

The Australian Cyber Security Centre publishes general guidance on protecting online accounts, passwords and multi-factor authentication at cyber.gov.au. Nothing on this page departs from it; the value added here is the game-specific context.

The protections that actually matter

A password used nowhere else

The most common way an account is lost is not a targeted attack on the game but credential reuse: an address and password exposed in an unrelated breach are tried across other services. A unique password per account removes that entirely, and a password manager makes it practical.

Multi-factor authentication, where the publisher offers it

An authenticator application is preferable to a code sent by SMS, since SMS can be intercepted through number-porting fraud. Where a game offers no second factor, the protection falls back on the email account attached to it, which should have a second factor of its own.

A recovery email address you still control

Accounts created years ago often point at a work address from a previous job or a defunct provider. Recovery runs through that address, so an address you cannot open is the same as no recovery at all.

Purchase receipts kept somewhere

Publishers commonly verify ownership during recovery by asking about purchase history. A folder of receipt emails is the difference between a recovery that takes a day and one that fails.

The approaches players actually encounter

These are patterns, described so they are recognisable. They are not claims about any title in this library.

• The currency seller. A site or a private message offering in-game currency below the official price. Payment is taken and nothing arrives; where something does arrive, the account can be penalised by the publisher for the transaction itself.
• The giveaway that needs your login. A giveaway that asks for account credentials to “verify eligibility”. No publisher needs your password to give you something attached to your account.
• The account recovery service. Offered to someone who has already lost access, which makes it effective: it takes a payment, collects the remaining credentials, and delivers nothing.
• The modified client. An unofficial client or tool promising automation or advantages. It requires credentials to work, which is the point of it, and installing software from unverified sources carries the ordinary risks the ACSC describes.
• The impersonated support contact. A message claiming to be from support asking you to confirm details or follow a link. Publishers contact players through the official channel and the address on file; a message arriving through a chat platform is not that.

If an account is taken

1. Reset the email account first. Change its password and check its forwarding rules and recovery settings. Recovering the game account is pointless while someone else can intercept the recovery message.
2. Use the publisher's official recovery process. It is the only route that works. Third-party recovery services are the scam described above.
3. Gather evidence before contacting support. Purchase receipts, the account's creation date, the platform used, and the approximate date access was lost. Support decisions turn on what you can show.
4. Check where else that password was used. Change it everywhere it was reused, starting with email, banking and any account holding payment details.
5. Remove stored payment methods. Where the account has a payment method attached through a platform, remove it while access is uncertain.
6. Report it. Losses and attempts can be reported to Scamwatch, run by the National Anti-Scam Centre. Cybercrime affecting Australians can be reported through the Australian Cyber Security Centre at cyber.gov.au. Reports do not usually recover an individual account, and they are how patterns are identified.

A ten-minute review, once a year

Most account losses are avoidable by a review that nobody schedules. It is short enough to do while something else installs, and it is more useful than any single protection because it catches the settings that quietly went stale.

Open the game account's security page and confirm which email address is attached to it, then open that mailbox and confirm you can still receive and read mail in it. Check whether multi-factor authentication is switched on and which method it uses, replacing SMS with an authenticator application where the publisher offers one. Look at the list of connected platforms and third-party applications, and remove anything you no longer recognise or use — tools granted access two years ago are still holding it. Check whether a payment method is stored, and decide deliberately whether it should be. Finally, look at the recovery codes the publisher issued when the second factor was enabled: if you cannot find them, generate a new set and store them somewhere that is not the same machine you play on.

None of that depends on anything having gone wrong. It is maintenance, in the same sense as checking a smoke alarm, and it takes the same amount of attention.

Buying and selling accounts

Account trading is against the terms of service of most publishers, which means the account can be closed with no recourse when a transfer is detected. Beyond that, a purchased account remains recoverable by its original owner through the publisher's own recovery process — the buyer has no standing at all. This library takes no moral position on it; the practical position is that the buyer holds nothing enforceable.

Chat features, and reporting harm rather than fraud

Clan and alliance content brings chat with it, and chat brings the ordinary problems of any online space. Publishers provide in-game reporting and blocking tools, which are the first step. Where behaviour goes beyond a game dispute — serious harassment, image-based abuse, threats, or anything involving a child — the Australian body is the eSafety Commissioner, which has statutory schemes for online harms and publishes what it can and cannot act on. If there is an immediate threat to someone's safety, that is a matter for the police rather than any regulator.