Protect the account and its recovery route
Use a unique password and secure the email or phone account used for recovery. Enable additional authentication if the service offers it. A strong password does not help if recovery access is left exposed.
Treat codes as credentials
One-time codes can authorise access or changes. Enter them only in the process you initiated on the verified service. Support impersonators may ask you to read a code aloud or forward it; do not do so.
Respond to suspicious activity
- Use a known address to review account sessions and change credentials.
- Sign out of unfamiliar sessions where the service allows it.
- Contact the provider through an established channel.
- Keep records without publishing private information.
Related reading
Login troubleshooting and registration checks cover the next steps.