An online gaming account may contain enough information to identify a user, access funds, reconstruct behaviour and target future fraud. Security therefore cannot stop at encrypting the login page.