Maintain the account as well as the password
Keep browser and device software current, avoid sharing access and review unknown sessions. On public networks, do not ignore unexpected certificate or sign-in warnings. Update recovery information when your contact details change.
Use evidence rather than appearances
A logo, testimonial, familiar name or polished interface is not independent evidence of identity or safety. Check who operates the destination and how support, privacy and complaints are handled.
Know what should stay private
Passwords, OTPs, payment PINs and recovery codes belong to you. Check available two-factor authentication options. If someone requests a private code through a message, stop and verify the request using a separate contact route you already trust.
Take control early
If you see activity you do not recognise, secure the relevant accounts, review active sessions and contact verified support. Keep a record of what happened while avoiding further interaction with a suspicious link.
Keep the next step clear.
Check current provider information, protect your personal details and use the route that matches your question.