Step 4 of 5

Setting up the account and checking the controls work

This step is a procedure, done in order, in one sitting of about half an hour. The important half is the second half: a setting you have not tested is a setting you are hoping about.

Why this is written in general terms

You will not find menu names or button labels here. That is deliberate, for two reasons.

The first is that interfaces change, often several times a year, and a walkthrough written against one version becomes wrong quietly. The second is that this course is about a category, not about one product: the same nine things need doing whichever game you chose, and learning them as a pattern means you can set up the next one without reading anything.

So each item below describes what to achieve. Where it sits in a particular game or device is for that vendor's own help pages, which are the current, authoritative source.

The setup procedure, in order

Nine things, done in this sequence

Choose the account email. Use an adult's address that you will still be able to reach in two years. Not a child's school address, which disappears when they change schools and takes the account recovery path with it.
Set a password used nowhere else. Long matters more than complicated. Store it in a password manager, or write it down and keep it somewhere a visitor would not look.
Turn on two-factor authentication if it is offered. This is the second check — a code or a prompt — that stops a stolen password from being enough on its own. If recovery codes are issued, save them with the password.
Decide and set the payment method. Use the one you agreed in Step 2. Prefer a method that cannot complete a purchase without an explicit approval, and avoid leaving card details saved in a browser the player uses.
Set purchase approval on the device. Separately from the game, phones, tablets and computers have their own setting requiring a password or an adult's approval before a purchase completes. This is usually the stronger of the two controls, because it applies to everything on the device.
Set the chat and social settings. Match the answer you wrote in Step 2 — open, limited to known friends, or off. Do this before the first session rather than after, because the first session is when friend requests arrive.
Set the screen time limit on the device. Apply the time rule using the operating system's own tools rather than the game's, so it survives the game being reinstalled or a second game appearing.
Test every control you just set. Covered in detail below. Do not skip it.
Write down what you set and where. A short list on paper or in a note. After an update you will want to check these again, and you will not remember where half of them were.

Testing each control

Testing takes about ten minutes and is the difference between a setup and an assumption. Each test is the same shape: try to do the thing the control is supposed to prevent, and see what happens.

Test the purchase approval. Begin a purchase of the smallest available item and stop at the point where approval would be required. If you reach a confirm button without being asked for anything, the control is not on. Cancel and go back to item five.

Test the chat setting. If chat is meant to be off, open the game and try to send a message. If it is meant to be limited to friends, try to message somebody who is not one. The outcome should be obvious; if it is ambiguous, treat it as not working.

Test the time limit. Set it temporarily to a few minutes and let it run out while you are watching. You want to see what the player will see — whether it warns, whether it closes mid-activity, whether it can be dismissed. Then set it back to the real value.

Test the account recovery. Use the forgotten-password link and confirm the email arrives at an address you control. Then set the password back. This is the test people skip and the one that matters most on the day something goes wrong.

If a test fails, that is the test working

A control that does not behave the way you expected has told you something useful while nothing was at stake. Fix it and test again. There is no deadline on any of this, and nothing bad is happening to your device while you work it out.

A word on passwords and account recovery

Game accounts are targeted because they hold things of value and because their owners are often young. The defences are the ordinary ones, and the Australian Cyber Security Centre publishes general guidance on passphrases, multi-factor authentication and account security at cyber.gov.au, which is a better reference than anything we could summarise here.

Two habits specific to games are worth adding. First, the offers that circulate among younger players — a site promising in-game currency in exchange for logging in — are a common way accounts are taken, and the answer is simply that account details are never entered anywhere except the vendor's own site. Say that out loud to the player once; it is more effective than any setting.

Second, if an approach of that kind does appear, Scamwatch is where it can be reported in Australia.

Writing down what you set

The record does not need to be elaborate. For each of the nine items, write what you chose and where the setting lives — "purchase approval: on, in the tablet's family settings" is enough.

Keep it with the password rather than in the game, and date it. In Step 5 you will come back to this list after updates, and a dated list makes it obvious whether something was changed by an update or was never set in the first place.

What to do when something goes wrong

Three ordinary problems and where each is handled. A charge you did not expect goes first to the vendor or app store refund process, and to your bank if that does not resolve it. Contact or behaviour from another player that is harmful goes to the game's own reporting tool first, and the eSafety Commissioner is the Australian body for serious online harms. A question about what the vendor has done with personal information is a privacy question, and the OAIC publishes guidance on privacy rights in Australia.

None of these is an emergency and none requires software to be bought. They are processes, and they work better when the account details and the dated setup record are in front of you.

The worked example, Step 4

The hypothetical household, Step 4

The adults set up the account on the lounge-room laptop using one of their own email addresses and a long passphrase kept in a password manager. Two-factor authentication is available, so they turn it on and save the recovery codes alongside.

Testing finds two things. The purchase approval works as expected on the laptop. The chat setting, however, is not where they assumed: limiting messages to a known list turns out to be two settings rather than one, and after the first attempt a test message still goes through. They fix it and test again.

They set the time limit through the laptop's own controls rather than the game's, let it expire once while watching, and discover it closes without warning — so they add a manual five-minute call instead. The whole sitting takes thirty-five minutes. This household is an invented illustration, not a real one.

Before you move on

Every one of the nine items should be done and four of them tested. If a control could not be found at all, write that down as a known gap rather than leaving it vague; Step 5 asks you to review it.

Step 4 checklist

The account uses an adult's long-lived email address.
The password is long, used nowhere else, and stored somewhere I can find it.
Two-factor authentication is on if the vendor offers it, and recovery codes are saved.
The payment method is the one agreed in Step 2, and card details are not saved where the player can use them.
Purchase approval is on at the device or app store level, not only in the game.
Chat and friend settings match the Step 2 answer, set before the first session.
The time limit is set using the device's own screen time tools.
I have tested the purchase approval, the chat setting, the time limit and the password recovery.
I have a dated written record of every setting and where it lives.
I have told the player that account details are never entered on any site except the vendor's own.