Unsolicited code
Do not use or share a code you did not request. Review security through a known access route.
Protect your account and personal information
Security involves more than a strong password. Recognizing the wrong destination, keeping codes private and responding in a sensible order also matter.
Three routes of risk
Reusing one password across services lets one disclosure affect other accounts. Keep important credentials distinct. Prioritize the connected email account because recovery messages may reach it.
Phishing messages can use familiar names and logos. Pause when an urgent deadline, reward or threat is used to request information. Open a known address yourself instead of following the message link.
Unnecessary apps and permissions can also create risks. Do not enter secrets while screen sharing or remote control is active. Updated software and a screen lock provide basic protection.
Signs and immediate responses
When something looks wrong, prioritize regaining control and noting the facts instead of deleting all evidence.
Unexpected changes
An unrequested email or password change message calls for securing the connected email first.
Remote help pressure
Do not give an unknown person control of the screen. Stop if supposed support asks for a code.
Choose a clean device after suspicion
If a device may be compromised, entering a new password on it can expose the change too. Use a clean device under your control. Where the relevant service offers it, close unfamiliar sessions.
Keep a note of the time, type of change and associated messages. Avoid public screenshots containing sensitive information. Give support only the details needed to understand the event.
Three priorities after a warning
Stop the connection
End suspicious conversations, links and remote access.
Restore core control
Secure email and relevant passwords from a clean device.
Report the facts
Contact the relevant service with the time and symptoms.
Account security questions
Should I give support my code?
No. Use a one-time code only in the relevant form you initiated.
Does a logo make a message trustworthy?
No. Names and logos can be copied; check the destination and nature of the request.
Is a password change enough?
Also check the connected email, device and unfamiliar sessions.
Can I report security concerns here?
General questions can be emailed. Account recovery belongs with the relevant service, without sharing secrets.