Download

Securing a game account: passwords, phishing and recovery

Simple habits to protect an online game account: a unique password, spotting suspicious credential requests, verified downloads and what to do when in doubt.

Account and securitySuggested level: BeginnerTogu TeamPublished on 5 min read
A masked thief beneath a warning sign, illustration from the Dofus client

A game account protects weeks or years of work: characters, items, history. The most common risks don’t come from some rare technical flaw, but from a reused password, a fake website or a message that pushes you to act fast. This article gathers general advice drawn from public sources, applicable to any online service. It does not describe how a Togu account specifically works.

Use a unique password

In its advice for a good password (published on January 26, 2017), the CNIL (the French data protection authority) recommends that a sensitive account be locked with its own unique password, to avoid cascading breaches: if one service is compromised, your other accounts don’t fall with it. As an example, it gives a password of at least 12 characters mixing lowercase letters, uppercase letters, numbers and special characters, which can be shorter when the account has additional security measures. It should say nothing about you: the name of a pet or a favorite film can be guessed.

So you don’t have to remember everything, the CNIL mentions password managers, which encrypt all your passwords with a single master password. It advises against storing passwords on a sticky note, in a text file or in your email, and against saving them in the browser of a shared computer. Applied to a game: don’t reuse your email password or the password of any other service.

Spot a suspicious credential request

Cybermalveillance.gouv.fr defines phishing as a fraudulent message or website that impersonates a trusted third party in order to obtain personal data, such as usernames or passwords. Its recommendations, consulted on October 13, 2026, can be summarized as follows:

  • never share a password by message or over the phone;
  • before clicking, hover your cursor over the link, without clicking, to read the real address, or use a bookmark you created yourself;
  • check the address shown in the browser: sometimes a single character is enough to fool you;
  • at the slightest doubt, contact the organization concerned directly;
  • if the site allows it, check the date of your last login to spot any access you don’t recognize.

Ankama’s support gives similar advice for its own games in its article on phishing, consulted on the same date. It advises not to trust a site’s appearance, never to look up a site from keywords given by a player, not to trust dubious links received in game and never to download game-related files from an unofficial site. It also states that a moderator will never ask for a username or password in game and that the publisher does not send emails threatening a ban. These rules describe Ankama’s practices; they say nothing about those of any other service, but the logic carries over: no serious service needs your password by private message.

Finally, remember a separation rule: a publisher’s account should only be entered on that publisher’s website. Do not enter your credentials for a publisher on the website or in the program of a private server, whatever the reason given.

A booby-trapped file is another way into your account. Start from the project’s official page that you opened yourself, via a typed or bookmarked address, rather than from a link received in a conversation. Our guide to downloading a game without falling for a fake installer details the checks to make before opening a file. For Togu, the Download page states that the launcher can only be downloaded from that page and that Togu never asks for your Ankama password.

React if account access seems compromised

Act quickly and in this order, following the guidance of the cited sources:

  1. Change the password of the affected service from its official website, then change it everywhere you had reused it (Cybermalveillance.gouv.fr).
  2. Use the service’s blocking tools if they exist. For its own accounts, Ankama advises you to block the account via the dedicated page if a phone number is linked to it, otherwise to change the password, then to contact support with an official proof of identity attached.
  3. If you opened a suspicious file, Ankama recommends an antivirus, antispyware and antirootkit scan.
  4. Keep the evidence, in particular the phishing message you received, and report it: Cybermalveillance.gouv.fr mentions Signal Spam for emails, 33700 for text messages and Phishing Initiative for websites.
  5. If banking details were shared, ask your bank to block your card; in the event of a fraudulent charge or identity theft, the same guide advises filing a complaint.

The role of two-factor authentication and recovery

The CNIL and Cybermalveillance.gouv.fr recommend enabling two-factor authentication when the service offers it. It adds an extra check: the password alone is no longer enough to log in. It doesn’t protect against everything: a code given to fake support staff, or entered on a fake site, loses its value. So never give a verification code to anyone who asks for it.

Account recovery likewise relies on an email address or phone number you still control: keep this information up to date and protect your email with a strong, unique password. This article does not describe any recovery or two-factor authentication feature of Togu. For the security rules already published by the project, see the community rules page and the FAQ.

Sources