Before, during and after sign-in
Before signing in, verify the address and device. During sign-in, protect the password and OTP. Afterwards, review unexpected alerts, close sessions you no longer need and sign out on any shared device.
Use evidence rather than appearances
A logo, testimonial, familiar name or polished interface is not independent evidence of identity or safety. Check who operates the destination and how support, privacy and complaints are handled.
Know what should stay private
Passwords, OTPs, payment PINs and recovery codes belong to you. Check available two-factor authentication options. If someone requests a private code through a message, stop and verify the request using a separate contact route you already trust.
Take control early
If you see activity you do not recognise, secure the relevant accounts, review active sessions and contact verified support. Keep a record of what happened while avoiding further interaction with a suspicious link.
Keep the next step clear.
Check current provider information, protect your personal details and use the route that matches your question.