Urgent credential request
Stop if a message asks for a password or one-time code. Reach the verified service independently.
Protect the routes that lead to an account
An email account can be the recovery route for several services. Protect it with a unique password and any appropriate verification options it actually offers. A strong password on one service is not enough if recovery email access is lost.
A familiar logo can be copied. Inspect the full address and how you arrived there, especially after a message urging immediate action. A padlock describes connection encryption, not the honesty or legal status of an operator.
Collect less information when asking for help. A page name, time and redacted error are usually a better starting point than a full identity document or a credential. This website’s general mailbox does not need passwords or codes.
Warning signs and immediate actions
Consider the following points separately to understand the subject and its practical conditions.
Unexpected installation
Do not grant screen sharing or device permissions to resolve a supposed account problem.
Unfamiliar session
If a verified service shows unknown access, review available session controls and change affected credentials.
Respond to possible exposure
If you entered a password on a suspicious page, change it from a trusted device at the actual service. Replace it wherever it was reused. Check the recovery contact for changes you did not make.
If an attachment or app may have compromised a device, stop using that device for sensitive access until it has been checked. Preserve relevant messages and transaction references while keeping secrets out of reports.
Contain an access problem
Stop the interaction
Close the suspicious conversation and do not send additional data.
Regain control
Secure the contact account and reset affected passwords through trusted routes.
Review and report
Inspect available account records and report specific unauthorised changes to the actual provider.
Account security questions
Can I send a code to support?
No. A one-time code can authorise access and should remain private.
Is a padlock sufficient?
No. It does not establish the operator’s identity, trustworthiness or permission to offer a service.
What if I reused a password?
Replace it on every affected service with a different password and secure recovery contacts.
What belongs in a screenshot?
Only the error and relevant page context. Hide personal identifiers, balances and confidential fields.