Use this checklist to protect your personal information and recognise suspicious requests. These are general security practices, not a claim that any platform is risk-free.
Protect your sign-in details
- Use a unique password stored in a password manager. Do not reuse your email password.
- Enable multi-factor authentication where the service offers it, and protect your email account as well.
- Never share passwords, one-time codes or recovery codes with support agents or people contacting you on social media.
Check the destination
Read the complete domain name before entering personal information. A familiar logo or HTTPS padlock does not prove that a site is legitimate. Avoid links in unexpected messages and independently verify the support channel you are using.
Do not install remote-access software or share your screen at the request of someone who contacts you unexpectedly. Screen sharing can expose sign-in codes and payment details.
If you suspect an account has been compromised
- Stop interacting with the suspicious message or page. Do not send additional money to unlock an account or resolve a supposed security issue.
- From a trusted device, secure your email and change reused passwords. End unfamiliar sessions where the service supports this.
- Keep dated screenshots and reference numbers. Redact passwords, full card numbers, identity documents and verification codes before sharing evidence.
- Contact the relevant service through an independently verified channel. If payment information may be exposed, contact your payment provider promptly.
Return to the information centre
Practical next steps
Before following an unfamiliar sign-in request, use our website impersonation checks. When collecting evidence, review what to hide in a screenshot and keep a clear support issue record. Browse all consumer guides.