Unfamiliar login notice
Compare its time and device with your activity; use a known address instead of the message link.
Different secrets have different roles
A password is a reusable secret, so keep a separate one for each service. Choose a long, difficult-to-guess value. A reputable password manager can reduce the need to memorise many separate credentials.
A one-time code may approve a time-limited action. Match the message with an action you actually initiated. Do not share unexpected codes or approve unfamiliar requests.
Device access can expose saved sessions as well as passwords. Lock your phone, update software and avoid unfamiliar apps. Changing one website password does not remove every risk from a lost device.
Match the warning to the response
Understanding the source of a risk helps set the first action.
Lost phone
Prioritise device locking and email control, then check relevant services for session removal.
False assistance
Stop sharing information with anyone requesting money, a PIN or a code. Keep evidence.
Act in the right order after exposure
If a password was reused, start with important email access and then the relevant accounts. End unfamiliar sessions where possible and enable additional verification if the service offers it.
Tell support when the problem occurred, what message appeared and what you already did. Do not prove your case by revealing a password or financial PIN. Mask private details in screenshots.
Three priorities when suspicious
Stop the exchange
Avoid further interaction with the unknown link, app or person.
Regain control
Secure your email and relevant accounts through known routes.
Report with evidence
Preserve the message time and source for the actual service.
Questions about account security
Can I tell a worker my code?
No. Keep one-time approval codes to yourself.
Is a logo enough to trust?
No. Check the domain and recipient too.
Why secure email first?
It may receive recovery messages for other services.
Should I send a password here?
No. Describe the issue without secret credentials.